Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
17 views

Tomcat Client authentication

I want to make sure that my webapp is secured: I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed). ...
0
votes
0answers
24 views

How can I convert a domain controller account to local account for forensic analysis? [migrated]

I am doing a forensic analysis of a Windows machine that has multiple local accounts but have a domain controller or active directory account. I can analyze the files of the user because the files are ...
1
vote
4answers
86 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
0
votes
0answers
17 views

How are the sequence numbers generated in an 802.11 frame?

An 802.11 frame consists of sequence number in it. How are these sequence numbers generated? How random is it? Do these sequence numbers follow any particular pattern for the management frames in the ...
2
votes
1answer
69 views

How safe is Two Factor Authentication (TOTP)?

If someone gets my phone and saves the values my authenticator generates, will that person be able to find out the shared key, which he/she will be able to generate codes himself/herself? If so, how ...
0
votes
1answer
27 views

Would Poly1305-PBKDF2 be secure

I have a Poly1305-implementation (not Poly1305-AES) in my library. The difference: Poly1305-AES uses a key and a nonce and then uses AES to generate a one-time-key from key + nonce. This is ...
3
votes
0answers
26 views

Deal with number changes in a phone number based authentication/login system

Twitter Digits (https://get.fabric.io/digits) provides an authentication/login system based on phone numbers for mobile apps, and several other mobile apps (e.g. Square Cash, ...
-3
votes
2answers
34 views

Is there any benefit to login to a website as anonymously as possible, if you've already been there from an identifiable IP address?

Here's a basic example of the situation I am in: 1.Friend downloads full-length, new release movie on shady internet site (felony). 2.Uploads it to a randomly created, cloud hosting service account ...
6
votes
1answer
57 views

Does iPhone home button act as Secure Attention Key?

On an iPhone, does pressing the home button act as a Secure Attention Sequence? The home button is a physical button. You can press the home button whereever you are and go back to the home screen. ...
2
votes
2answers
56 views

token based authentication attacks

JSON Web Token seems to be a very good tool to authenticate users. But I wonder if an attacker can take the token used by another user and use it for his own attacks. And to be more precise what makes ...
5
votes
2answers
131 views

Is Twitter digits login (sms auth code) insecure?

Twitter released(some time ago) a new kit named Digits which allows the client to login with a phone number and an authorization code (received through sms). I find it great for the user experience ...
1
vote
3answers
74 views

Securing a secondary login page for inputting a multi-factor auth token

I would like to implement the following use case: User lands on the login page User submits login credentials Credentials are validated and they are redirected to another page for inputting the ...
0
votes
2answers
59 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
2
votes
1answer
33 views

Choosing a group of symbols that contains a password

My bank employs a step in its authentication process besides [the card itself and] the regular password, where the user has a secondary password (3 small sequences of letters, such as Hy X Ba) ...
-7
votes
1answer
67 views

How to attack on a web page to gain username and password? [closed]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
3
votes
1answer
48 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
2
votes
1answer
35 views

How to verify installed packages [closed]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
1
vote
0answers
34 views

If I have the cell #. switch ID and name, can I locate an physical address? [closed]

Only a PRO can help me! My husband had an affair, said it was over five years ago and I should not be concerned, ever again. Yet, the result was devastating, medically with cancer. I believe people ...
0
votes
2answers
50 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
9
votes
1answer
501 views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
0
votes
0answers
3 views

Zywall USG 100 - How connect to modem interface? [migrated]

I have an Zywall USG 100. My modem have this ip: 192.168.1.100 and is connected into WAN1 port on the Zywall. The Zywall have this ip: 192.168.1.1 I used the "quick configuration setup", and all ...
1
vote
1answer
63 views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
2
votes
1answer
31 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
2
votes
1answer
48 views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
1
vote
0answers
22 views

AD Authentication using LDAP : Can I authenticate outside of DMZ/Domain [migrated]

The method I use to authenticate a user's credentials on active directory is (Simplified): New DirectorySearcher(New DirectoryEntry(path, user, pass, AuthenticationTypes.Secure)).FindOne() On fail, ...
2
votes
2answers
97 views

Single-use password as the default authentication method?

The crazy password requirements (joke1, joke2) lead me to a situation where there is no way for me to memorize the passwords to the several sites that make those requirements. The result is that ...
2
votes
1answer
33 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
0
votes
0answers
7 views

Value of S and r in Fiat-Shamir Protocol [migrated]

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
1
vote
0answers
20 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
3
votes
1answer
94 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
3
votes
1answer
96 views

Enterprise Security : Where to Start? [closed]

I am trying to start self studying of Enterprise Security Context, but always feeling kind of lost among all the specs and standards etc. Unlike software development, this really is a challenge as far ...
1
vote
0answers
48 views

Logging in from one CMS to another

Two websites with different CMS, user should type login & password on one website and needs to be logged in second website automatically. Now i have this method, it works but i want to know - is ...
2
votes
1answer
76 views

Potential attack vectors using Javascript to log in [closed]

I would like to allow users of a website to be able to log in at any page. In order to provide a seamless experience my first thought was to collect user credentials (username and password) in a ...
2
votes
1answer
135 views

Why should canary values be chosen at runtime instead of compile time?

For buffer overflow attacks, my exam review says that there are drawbacks to choosing canary values at compile time vs runtime. Why would it be better to choose the canary value at runtime?
-1
votes
1answer
41 views

Fido U2F Public keys in registration response

What is the deference between the two public keys: user public key (2nd element in Token response) user public key inside signature in U2F Token response for registration ?
0
votes
0answers
9 views

Could not disable session resumption requested by OpenSSL client [migrated]

I'm developing SSL mutual authentication in android to connect to a https website using OpenSSL library. I want to disable session resumption requested by client in OpenSSL; In other words, it is ...
2
votes
1answer
69 views

How to implement application-specific passwords using strong hashes?

I am implementing a service where application-specific passwords seem a good choice to improve security. A question on why and when they might make sense has already been discussed here Google ...
1
vote
0answers
20 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
-1
votes
1answer
71 views

How can you use XSS to break this security on a site? [closed]

To delete your account on a website, the following form is used: <form action="/deleteaccount" method="post"> <input type="hidden" name="user" ...
28
votes
6answers
4k views

Silently Limiting Login Attempts

I've seen the following login rate limiting approach used on a web site I worked on, but I can't figure out if it's a good idea: After any failed login attempt, the site locks the user account for a ...
-2
votes
1answer
43 views

designing secure telnet [closed]

i came across this question and have been thinking about it without a final solution. The question is to design a secure telnet. essentially to login using a username and password using telnet. I do ...
2
votes
1answer
69 views

Do I have an SSH password?

I have an Ubuntu server hosted on DigitalOcean, I have been using SSH keys since the very beginning. (You can chose for it to be setup before the server instance has even been created). So I have ...
0
votes
1answer
51 views

FreeRADIUS EAP TLS Authenticate based on client certificate CN

I'd like to run FreeRADIUS for EAP TLS authentication but instead of running my own Certification Authority I'd like to use StartSSL. I've setup EAP TLS with StartCom as the only Trusted Root CA and ...
1
vote
1answer
54 views

What are the implications of using OAUTH? Do the positives outweigh the negatives? [closed]

OAUTH seems like a pretty good idea when it comes to helping people authenticate, cuts down on the # of passwords to remember and in general eases the friction of on-boarding. However it would mean ...
8
votes
4answers
1k views

Is having the username and password fields on different pages more secure?

An online bank I use requires inputting your username, navigating to a second page and then entering the password to login. What actual security advantage does this provide, if any?
2
votes
1answer
58 views

How to reset a second factor authentication without compromising the authentication process

I am designing a system that uses two-factor authentication. Where the user can only granted access only if the two authentication factors passed the verification. Let us assume that the first ...
1
vote
1answer
78 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
0
votes
1answer
86 views

Can I trace a spoofed text message? [duplicate]

Someone is texting me threats and I have no idea who. Is there a way to "unspoof" the number? I know for a fact that they are spoofing as a legit number, because I called it. Thanks in advance.
1
vote
0answers
67 views

Identify the attestation certificate (X.509) in Fido U2F registration response

I'm trying to identify the attestation certificate (X.509) in Fido U2F registration response as described in fido-u2f-raw-message-formats-v1.0-rd-20141008.pdf document: An attestation certificate ...
0
votes
1answer
57 views

Decrypting encrypted traffic with hacking an app [duplicate]

I am thinking how does telegram ensure that messages are secret. I understand they use the public key to encrypt and private key to decrypt. Why is it not possible for an attacker to download the ...