Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
0answers
13 views

IP authetication, usage stats and bad house-keeping

If a content publisher using IP authentication stores overlapping or duplicated IP ranges in its access management systems are accesses, clicks, etc. counted multiple times?
1
vote
0answers
17 views

Account Connected Devices ignoring Credential changes

Hello People of Security, one of my accounts got attacked, so they(Provider) did expire my password. I'm currently not able to log into my account. So when I started an older PC of mine, I was still ...
0
votes
0answers
43 views

Login time duration [on hold]

I'm working on a project for improvement of hacking detection. One of my ideas is based on "login time duration" of the user spent while login on an online-banking website vs "copy/paste" fast ...
0
votes
1answer
62 views

How to secure Web directories allowing only me to acess them

I have a web folder with some PHP files that are hosted in my website(e.g. www.mysite.com/myfiles/my_file.php) that I access and trade information using ajax for a Web App that I have. My question is,...
0
votes
1answer
115 views

What do think about this multi-factor authentication system made by me? How can I improve it?

I designed an authentication system as a project for a cyber security class. I want you to critique it please. Here is a quick explanation: Note: Sorry no images but I'll provide links to videos for ...
0
votes
1answer
15 views

Can 802.1X, EAP and RADIUS work together?

So this is an academic question I came up with while researching the topic. Can 802.1X, EAP and RADIUS work together to provide a secure authentication? If yes, how? Thanks!
-6
votes
4answers
137 views

Keeping passphrase away from telepathic interception [on hold]

Assuming that someone is able to telepathically intercept thoughts and words in my mind, what mechanism will allow me to authenticate securely? A solution that does not yield to physical search or ...
0
votes
1answer
35 views

Windows Firewall: Restricted RDP to 1 IP, but still see login attempts from other IPs

I restricted the Firewall rules for RDP incoming restricting the Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. I did not ...
11
votes
3answers
2k views

Would a (password + combination of images) be stronger for user's login regarding keyloggers?

The scenario: We have a login system for a web application that requires a plaintext password and 3 images (from a collection of images that the users select during registration, the images are ...
0
votes
1answer
31 views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
1
vote
1answer
24 views

Instant signin links for users from trusted third party sites

I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
0
votes
0answers
12 views

How to enumerate smartcard logon attempts in Windows?

I need to provide my users with feedback when they log on at their workstations. This feedback needs to include: Date/time and workstation id of last successful login Number of unsuccessful login ...
0
votes
0answers
25 views

Authentication in WPA from a user's perspective

I have read several articles that discuss the differences between WEP and WPA but I haven't seen an answer to my question, which is : How is the authentication used in WPA different from that used ...
0
votes
2answers
41 views

session credentials on the client

I am developing an IE11 based application running on a web server inside our corporate network The application makes calls to a 3rd party API which requires client certificates and username/password ...
28
votes
5answers
5k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
1
vote
2answers
76 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
0
votes
1answer
56 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
0
votes
1answer
50 views

Numerous login attempts detected from an internal machine to the active directory domain controller

We have recently identified numerous login attempts from an internal machine to the active directory domain controller. The attempts are directed at the domain administrator account. As an initial ...
2
votes
2answers
112 views

My Yahoo accounts keep making random accounts for me on other websites. Why?

I have two Yahoo email accounts. Both will randomly recieve new emails about a new account that was made under my name and my email address, however, I'm not setting up these accounts. I have had ...
1
vote
1answer
63 views

Is Auth0 Passwordless Authentication secure?

I see this advertised Medium post about building a React application with passwordless authentication through Auth0. from the link, here is the explanation of how it works: Passwordless ...
3
votes
0answers
41 views

Simple Authentication Method to Secure REST API

I've been desperately trying to find a simple method of securing my API but still haven't found one that works. Unlike a lot RESTful APIs my API doesn't need user logins, tokens that expire, or other ...
-1
votes
2answers
41 views

Block requests containing URL of other websites

GET / HTTP/1.1" 200 166113 "-" "Mozilla/5.0 (compatible; dsada/2.0; +http://www.asd.com/search/asddd.html) I found this request repeated continuously in my logs. How can I prevent this (requests ...
84
votes
9answers
15k views

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
1
vote
3answers
52 views

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully ...
0
votes
2answers
67 views

Security of picking unique passwords for users [duplicate]

I am learning more about security in web design so I can build more robust sites. As I see it password security is one of the main concerns, if a database is hacked then chances are passwords will be ...
0
votes
0answers
15 views

Security mitigation vis policy between Android watch and Android smartphone TEE

We are an e-store company and we have native apps for Android and iOS smartphones. We are building a new app for Android/Apple watch and enable authentication between the watch app and native app on ...
1
vote
2answers
70 views

Is phone-based authentication more secure than passwords?

Let's say I ask my user to provide email, first and last name, last 4 of ssn, date of birth, and a phone number. On login, I send a 4 digit pin as a text. Considering users tend to reuse passwords ...
0
votes
1answer
20 views

Certificate Verification in openssl

I was going through the openssl server-client program given here---> http://simplestcodings.blogspot.com.br/2010/08/secure-server-client-using-openssl-in-c.html. I can see both the client and server ...
1
vote
1answer
146 views

Is simple authentication safe if over HTTPS?

Background For my app I need to know if users have entered the correct email password combo. Pretty common stuff. I'm using HTTPS, and salting and hashing the passwords. Question Now, what I am ...
82
votes
9answers
16k views

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it. What if I encrypt data and every password decrypts it, but ...
0
votes
0answers
42 views

Token authentication storage & encryption/hashing

I'm currently studying token authentication for web and native applications, in order to make users authenticate without using their password all the time via HTTPS. I kind of understand how tokens ...
3
votes
1answer
94 views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
3
votes
1answer
75 views

Understanding NTLM Authentication Step by Step

I was reading this link on ASP.Net Authentication and Authorization and these 5 steps were there explaining NTLM authentication. Client sends the username and password to the server. Server ...
0
votes
2answers
102 views

Anti session-hijacking mechanism using a session variable

Okay, So I'm brainstorming about a security architecture where on a website you have a 'secret' page, where a visitor (not user, just visitor) can enter 'secret' info. The visitor doesn't need to ...
0
votes
2answers
59 views

Is it less secure to require password and phone on sign in?

I'm concerned about the security of a system that requires its users to enter both their "email & password" and also their registered phone number which has to be verified upon each login. To me ...
1
vote
1answer
45 views

How can we serve sensitive encryped data without storing the key? Should I use user-defined passwords for keys?

System Background Sensitive data must be stored (i.e. Credit Card number or SSN) in the system for a notable period of time, to serve ongoing operation of the company. Anyone can insert sensitive ...
2
votes
1answer
43 views

How to check whether NTLM v2 or v1 is used for authentication?

Which tool should I use to check which NTLM authentication is used? Consider the fact that I am a user of the web application and not the owner. Are there any security concerns if a site uses NTLM ...
-2
votes
2answers
51 views

Two factor authentication + saved logins are safe?

I have two factor authentication. I understand that by using a keylogger an attacker can bypass that authentication. However I think that if I check regularly on saved logins or past logins I will ...
1
vote
3answers
85 views

Is there more of a security risk by providing an email when creating a new account?

With all of these recent breaches, I have been thinking about security best practices. One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
3
votes
2answers
258 views

Is using JWT token for “remember me” less secure than random session token?

I am after reading "https://stormpath.com/blog/token-auth-spa" and "https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence" (among others :-) ) and thing I would like ...
0
votes
1answer
83 views

SQL queries using SQL Injections do not work as I think they should

I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL ...
3
votes
2answers
81 views

Choice of authentication when both HTTP and HTTPS are supported

I am looking at a system where you are able to choose if you are going to connect to the web application via HTTP and/or HTTPS. You have to authenticate on either one. I know that the best option is ...
-1
votes
1answer
87 views

What is this type of authentication with device id and token?

I'm trying to understand this strategy of authentication that I'm using to access resources of an enterprise. Basically, they have given me clientId and clientSecret, which I use to generate deviceId ...
0
votes
3answers
112 views

Securing a private API that's visible on the public Internet

I'm making an API for my own software. The API currently used for registering users, viewing users information and updating users information. In the future it will be used for billing, support etc .....
0
votes
0answers
66 views

Generally speaking, how does the Facebook JavaScript SDK provide authentication?

I'm looking for a high level overview of how the Facebook JavaScript SDK authenticates users, and the techniques involved. All JavaScript apps use this standard code to import the Facebook Single ...
0
votes
0answers
17 views

Do OpenAttestation and OpenCIT have Intel hardware dependence?

These technologies have been developed by Intel - what looks like for Intel TXT machines, but curious if it will work for any machine equipped with a TPM chip?
0
votes
0answers
37 views

Securing a Web API Service Layer

We've created a website and am using a service layer to expose common functions so that other applications will be able to call via REST API. The main website will have users that will add/edit ...
1
vote
0answers
27 views

What's the best way to implement phone-based 2FA

Some websites (for ex. Google) call you and you hear an recorded number, which you have to type in your computer. Some websites (for ex. Amazon) display a number on your computer which you have to ...
0
votes
0answers
7 views

FID on iPad app on non company network

I am planning to implement SSO for one of company iPad apps. The app will never be on an App Store but instead loaded with third party authentication. The users on iPad will rarely be on the company ...
0
votes
1answer
37 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...