Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
8 views

What is the best way to transmit password hash over unreliable TSL?

I have TSL connection between my server and client. I have no certificate, so connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept password hash and use it ...
0
votes
1answer
8 views

How does LSARPC protocol work?

I'm trying to understand how does the LSARPC protocol work internally. In particular, I would like to know how secured is it. I couldn't find anything in the internet or in different books.
3
votes
1answer
43 views

How to protect against adversaries snatching booted laptops to defeat full disk encryption?

I read an article describing how FBI agents snatched Ross Ulbricht's laptop while it was running to defeat full-disk encryption: Two plainclothes FBI agents, one male and one female, walked up ...
1
vote
2answers
82 views

Will hashing passwords in my use case improve security and why?

I am developing an application the architecture of which is arranged as follows: Session host <---> Central relay server <---> Session client All communication between the initiating ...
0
votes
2answers
51 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
0
votes
0answers
13 views

Authentication API that just returns ID with right email / password combination a security problem?

Two companies. MegaSocialPlatform CorporateCompany. CorporateCompany wants that their employees can reuse their current login credentials of CorporateCompany.com on MegaSocialPlatform, so ...
1
vote
2answers
64 views

REST API security

I'm working on a REST API that will let an Android app communicate with a website. Sadly more than half of the people that are going to use it can't do so over HTTPs, so I will have to maximize ...
-1
votes
1answer
54 views

Checksum for authentication - is it reliable?

I've just made the prototype for my new secure password-based authentication method, but there are several doubts about chosen size of password and alphabet. The method is simple - user calculates the ...
0
votes
1answer
20 views

How to make sure that only files I generated pass?

I have the following situation: I have an app on a User device, and my main server. The app can send the main server pdf-files and jpg-files. Now my problems are: -> What is the best way for the ...
-2
votes
0answers
26 views

Assignment on two factor key authentication in cloud system [on hold]

I am doing a assignment on two factor key authentication in cloud system. but I could not find any white papers related to this. Its grateful if you can provide some notes or sources related to this ...
1
vote
1answer
71 views

Is using Google Authenticator to login from the same device secure?

If you visit a site from your desktop, and use GA to login, you create an airgap. But if you visit a site from your mobile, and use GA to login, in what way are you still protected from Android ...
1
vote
2answers
27 views

HTTP BA from a different Server [duplicate]

There is a weird situation that I am stuck with regarding HTTP Basic Authentication. Below is a hypothetical situation: Lets say there is a certain domain, say https://myfacebook.com and there is a ...
0
votes
3answers
41 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
0
votes
1answer
43 views

PGP Key publishing on MIT PGP Public Key Server [duplicate]

I have a public pgp key, so that users can send me an encrypted message. Ofcourse, any user that wants to send me a message, wants to verify that the public key (s)he has, really belongs to me. From ...
1
vote
2answers
81 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
0
votes
0answers
54 views

Which kind of identification and authentication is used to secure an airplane? [migrated]

What does the pilot use? a password? my wife identifies and authenticates herself to her car every morning using her car keys. I don't see the pilot in movies use a similar key?! I don't expect the ...
3
votes
1answer
49 views

Login to one site using other site's credentials

I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook ...
3
votes
2answers
58 views

Adding a new user: email temp password vs link with token

I'm a developer working on a website for the first time and have a question about new user activation. The way our site is setup now a user creates a new account and they get emailed a temporary ...
0
votes
1answer
57 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
1
vote
1answer
45 views

Correct auth method using oAuth 2.0?

Been trying to wrap my head around oAuth 2.0, but I'm struggling figure out the correct way to implement it for our system, as there are so many different approaches. Our specifications are: Secure ...
0
votes
1answer
45 views

Why do private networks use both X.509 and User/Password authentication

For example, the school network I am on requires both a name & password to log in along with having its X.509 certificate installed in my browser. Why does it need both? Shouldn't name and ...
0
votes
1answer
33 views

What's the best, most unique (and uneditable) hardware id or key for each computer? [closed]

I'm a C# programmer and I'm looking for the best way to "know" what hardware is running my software. What is the best uneditable and unique "hardware id" in each computer?
0
votes
1answer
65 views

How to incorporate the man-in-the-middle

I am designing a web-based back-end for an online service. The service could support web based portals and mobile apps as front end. But I am stuck on how to support third-party, i.e untrusted, web ...
0
votes
0answers
20 views

PHP Session Security, setcookie vs setauth [migrated]

I'm trying to implement high security on a website but while I thought my code wasn't good enough, it seems to be higher than other articles out there. However I was wondering if someone could have a ...
5
votes
1answer
52 views

How to to make a file private by securing the url that only authenticated users can see

I was wondering if there is a way to secure an image or a file to be hidden when it is not authenticated. Suppose there is an image in my website which can only be seen if that user is authenticated. ...
0
votes
1answer
37 views

Revoke and regeneration in FIDO U2F / FIDO UAF

One of the benefits of using Software based Strong Authentication apps (e.g. RSA SecurID Software Tokens) is that if the device that is running the Token generation app is compromised or lost, the ID ...
0
votes
1answer
24 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
9
votes
5answers
3k views

Using Google Search results to determine password strength

Google is a repository of Internet data, as it indexes tremendous amount of data. It uses a prediction service to determine the rest of the search query. With such a huge repository in place, can we ...
1
vote
1answer
84 views

How to authenticate a legit thing App on the Internet of Things?

I want to develop a server for a sensor on the Internet of things (IoT). Everybody can buy the App for that specific sensor. The App will exchange data with the server. How can the server validate ...
5
votes
6answers
442 views

How to protect the company VIPs

Environment: small engineering company (<50 employees) and everyone is local administrator on their computer, including everyone in the management group. Setup: Some standard security features are ...
2
votes
1answer
29 views

PBKDF2 strong salt for client-side hashing

What should I use as a secure/strong salt for PBKDF2 hashing when salt is not available to use before login as it will be client-side javascript to hash user+pass with PBKDF2 ? I'm going to use ...
1
vote
1answer
25 views

PBKDF2 strong salt

I want to use a strong authentication scheme, so I decided to use PBKDF2. I'm using PBKDF2 with SHA256 algorithm, 5000 iterations and I use username (which is full email address of user) as salt. So ...
1
vote
1answer
43 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
0
votes
2answers
51 views

Remote administration methods

There is a requirement for users to remotely access one of my corporate servers from internet. Policy wise, i would want them to at least use 2FA for communication,eg VPN Tokens, password+SMS etc. ...
1
vote
0answers
38 views

Key derivation of public key without knowledge of private key? [migrated]

I'm looking for a convenient way to share a set of public keys across multiple services, while preserving privacy by preventing these services from tying the identity of these public key sets together ...
1
vote
0answers
13 views

Arduino AES library [migrated]

I am using this Arduino library and this Android library to: Create random string in Arduino Pass it to Android to encrypt with AES and shared secret key Pass back to Arduino to decrypt with AES and ...
0
votes
1answer
70 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
0
votes
1answer
88 views

Authentication and security of a REST API

Scenario: I design a REST API where authenticated users can hit the API over TLS. I have to use TLS as the data transmitted over the wire is sensitive. I don't need authorization right now, but I ...
2
votes
4answers
817 views

Analyze my custom web authentication scheme, based on a token derived from username and password

To avoid having the user to login every time his session expires, I want to implement a token based authentication system. My scheme works like this: Send the user login (send name + password) ...
2
votes
0answers
39 views

How secure is docker container-to-container traffic?

I'm working on building a web application using the microservice architecture pattern in a set of docker containers and I'm wondering about the importance of securing the communication between the ...
6
votes
3answers
192 views

Any way to prove that two devices are in the same physical space, for authentication?

I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs. This could be: A digital ID and the authenticator A consumer ...
1
vote
1answer
45 views

Unusual design aspects of AWS HMAC-based authentication, v4

I am designing a RESTful API in python. I want to use HMAC authentication. I could not find any suitable HMAC libraries, so I am rolling my own. However I want to use a well-known standard such as AWS ...
0
votes
0answers
36 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
1
vote
2answers
74 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
0
votes
2answers
65 views

Secure android and server calls

I plan on adding an authentication system on my android app using web services. When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
1
vote
0answers
30 views

How does disabling sign in upon confirmation make devise any more secure?

Referencing reasons given in this question http://stackoverflow.com/questions/18655334/avoid-sign-in-after-confirmation-link-click-using-devise-gem Devise does not allow the immediate sign-in of a ...
3
votes
1answer
74 views

Best approach to confirm email within mobile app?

Would appreciate your opinion on the options explored: a- Launch app and ask for a verification code that was sent to user email? b- Launch app by clicking deep link + verification code in the ...
-1
votes
0answers
10 views

monitoring local admin remote login [migrated]

Using SIEM system, how can I monitor the event of someone remote login into a computer using a local adminstrator account ? By using RDP you can remote login using local adminstrator account into a ...
3
votes
1answer
156 views

Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared ...
1
vote
1answer
102 views

secure use of psexec?

As of March 7, 2014 PsExec now "encrypts all communication between local and remote systems, including the transmission of command information such as the user name and password under which the remote ...