Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
0
votes
1answer
37 views
How does does the “Sign out all other sessions” feature work in Gmail?
In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
-1
votes
0answers
16 views
App authenticating with Google
My iPad App uses an oAuth authenticator to get access to a user's analytics data on Google. After a welcome screen, users are shown the standard Google sign in page. The signup page is presented from ...
0
votes
1answer
52 views
Asynchronous vs. Synchronous authentication process
I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database).
I'm at the stage where I have to design the authentication and I had a question about ...
6
votes
1answer
106 views
Build a secure channel without SSL/TLS
I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service).
1. ...
2
votes
1answer
60 views
HTTP Basic Auth is enough?
I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
4
votes
1answer
46 views
NFC used in place of contact based smart card two-factor authentication
My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
4
votes
2answers
87 views
Securing a REST api at the message level
I'd like some feedback on the following authentication idea, does it makes sense, and is there a standard
way of doing this (or similar) so I can rely on a well tested implementation.
I've seen many ...
2
votes
3answers
78 views
Does Gmail 2-factor auth increase security on smartphones?
So I have enabled 2-factor authentication on Gmail, which means that if I log in on a new machine, it sends a token to my phone.
Now, if I access Gmail from my phone, it seems like I have only one ...
2
votes
1answer
54 views
Is it secure to use a URL to automatically authenticate to an OAuth-protected API?
I'm looking for a way to create a URL that allows a user to login to our application without providing a username and password.
We have created an API which is protected using OAuth 2.0. I want to ...
4
votes
1answer
92 views
Known examples of spoofed Change Request?
A Change Request from a client (in the commercial sense of the word) to an organisation supplying an IT system to that client, can add or modify requirements for that system. Are there any known ...
2
votes
0answers
50 views
What are the security implications of (not) expiring login screen session? [duplicate]
I manage a single sign on solution (CAS) for a group of related web applications. The CAS specification states that Login Tickets are associated with every login attempt which can only be used once.
...
1
vote
1answer
60 views
What are the security implications of using TOTP for single factor authentication?
(Note: I am not actually planning to do this. This question is strictly theoretical.)
TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
2
votes
2answers
64 views
Login system using authenticated encryption without storing user password
I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about.
First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
16
votes
6answers
472 views
How can I share certain information only after my death?
I want to make sure that after I die, a special someone gets a vital piece of information from me (like the password to my bank account), but:
I don't want anyone to be able to get that information ...
-1
votes
2answers
106 views
How does Google detect new devices for two factor authentication
When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device.
How do they ...
2
votes
1answer
66 views
Authenticating users on offline devices such as ipad
We are wanting to authenticate the user inside a webapp (javascript/html inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realise this ...
0
votes
0answers
38 views
Top SAML 2.0 identity providers in the market [closed]
I am working on a product (service provider) which uses SAML 2.0 for authentication purpose. Having said that I wanted to know what you all think are the top and most trusted identity providers that ...
6
votes
0answers
195 views
Web Authentication using PKI Certs [migrated]
I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
1
vote
2answers
110 views
Password on login idea
In addition to the standard best practices on password logins. Has anyone considered a captcha like system but instead of just typing out what is in the captcha, the captcha will be directions on what ...
10
votes
3answers
188 views
Multi-tenancy, SSL Certificates, and Subject Alternative Name
The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension.
From the spec:
The subject alternative name ...
1
vote
0answers
42 views
Stateless REST API and secure server side password storage [duplicate]
RE: Duplicate - Did anyone actually read my question? The question marked as duplicate is in no way, shape, or form what I'm asking. I specifically state that a DB compromise must not allow an ...
5
votes
3answers
74 views
API message verification without storing private key?
I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved.
It seems the current common practice for "authenticating" users in API requests is ...
0
votes
3answers
102 views
Password and username used to connect to database in source code [duplicate]
In PHP scripts that communicate with the database I have the username and password to the database in plain text i.e. mysqli_connect('localhost:3306', 'root', 'PASSWORD!'). From OWASP
Do not ...
6
votes
3answers
158 views
Can I spoof IP addresses when attempting to brute force a login?
I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
0
votes
3answers
85 views
Connect to Mysql database from remote host without remote access
I have a website which is managed through CPanel. I know that remote database connections are disabled by default and I have tested that it is indeed disabled.
I know that many people have some of my ...
5
votes
2answers
82 views
Is it common for a One-Time-Password system to become unsynchronized?
One-Time Passwords look like they can play a helpful role in a layered-security system, yet their use, especially paper-based TANs seem like clients could be vulnerable to getting out of sync with the ...
-3
votes
0answers
38 views
Wrong public key file indicated on ssh debug? [closed]
I'm trying to figure out if it is my fault that I can't ssh to a RSA-secured server or not so I enabled debugging upon ssh-ing to the server. I got this:
$ ssh -v skytreader@remoteserver
...
-1
votes
0answers
29 views
Why is my email address removed at the end of my matching public key file? [migrated]
I tried ssh-ing to a server that uses RSA verification. I was already able to ssh to this server months back but I find out that I can't do so today.
I investigated the keys in my computer. I emailed ...
1
vote
1answer
54 views
Secure authentication cookie for web site
Hello i want to know if this auth token is secure enough for a site of millions of logged in users:
...
4
votes
0answers
84 views
Designing single-sign-on with JSONP/CORS?
I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions).
I would like to do something ...
4
votes
2answers
72 views
Terminology: authentication vs verification
The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
5
votes
1answer
120 views
Motorola Human Authentication Pill/Vitamin Security?
This appears to be hot news today, Motorola announced a form of pill that a user can swallow which is activated and powered by stomach acids and transmits a signal back which can be used to ...
5
votes
2answers
76 views
Do keyfiles actually add any meaningful security in the presence of strong passwords?
In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
1
vote
2answers
127 views
Can unencrypted keys & logins be kept out of program memory?
No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will ...
1
vote
2answers
86 views
Security benefits of Single Sign-On [duplicate]
What are the benefits of a single sign-on implementation from the point of view of security?
From my point of view, if the account is compromised the attacker has access to any resource, so ...
4
votes
1answer
47 views
What attacks, if any, are possible against Security Support Provider Interface (SSPI)?
I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
4
votes
1answer
146 views
How is an HTTPS login secure when pages use HTTP?
When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
2
votes
1answer
78 views
Is TextKey SMS 2 factor authentication secure against cell phone cloning?
I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods.
In typical SMS authentication, the provider sends you an access code ...
2
votes
2answers
90 views
Does providing OAuth for mobile apps pose a security threat?
Let's take a look at the basic OAuth workflow:
The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
4
votes
3answers
163 views
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?
Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account.
A ...
3
votes
2answers
152 views
Login with a hash. Is this secure enough?
I need to provide store's clients with a tool to check the status of their repair orders.
The clients doesn't have a user or password. They are only a record in the database. Yet I need to give them a ...
5
votes
5answers
178 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
1
vote
2answers
81 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
-1
votes
0answers
69 views
Which is the most popular one time password based authentication scheme? [closed]
Which is the most commonly used (popular) one time password based authentication scheme?
10
votes
5answers
481 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
16
votes
6answers
1k views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
-10
votes
1answer
93 views
Can a cracked antivrus software do the job? [closed]
Some of my friends say that their cracked antivirus software updates regularly, and does the job as same as a legitimate software would do. Is this possible? How do they bypass the activation key ...
3
votes
0answers
237 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
3
votes
3answers
216 views
Is it okay to sign a PGP key without an IRL meeting?
[PGP] can get paralyzed by excessive analness.
— Phil Zimmermann
Preamble
I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
0
votes
5answers
105 views
Should I enforce a password policy on a web site?
For a commercial web site, is it important to impose some restriction on passwords to access the system?
Eg. special $char, Upper and lower case, numbers, at least a minimum length...
Can a CAPTCHA ...
