Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
4
votes
3answers
128 views
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?
Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account.
A ...
3
votes
2answers
131 views
Login with a hash. Is this secure enough?
I need to provide store's clients with a tool to check the status of their repair orders.
The clients doesn't have a user or password. They are only a record in the database. Yet I need to give them a ...
5
votes
5answers
96 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
1
vote
2answers
50 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
-1
votes
0answers
51 views
Which is the most popular one time password based authentication scheme? [closed]
Which is the most commonly used (popular) one time password based authentication scheme?
-3
votes
0answers
47 views
How to determine the sequence of ordering certificates by browser? [closed]
I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:
----------
| ...
-4
votes
0answers
33 views
missing configuration in apache to achive mutual SSL authentcaion [closed]
After implementing a Mutual Certificate Authentication with OpenSSL and Apache Web Server on CentOS platform. I tried this scenario ( see this diagram ):
----------
...
10
votes
5answers
394 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
15
votes
6answers
800 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
-8
votes
1answer
75 views
Can a cracked antivrus software do the job?
Some of my friends say that their cracked antivirus software updates regularly, and does the job as same as a legitimate software would do. Is this possible? How do they bypass the activation key ...
3
votes
0answers
106 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
4
votes
3answers
192 views
Is it okay to sign a PGP key without an IRL meeting?
[PGP] can get paralyzed by excessive analness.
— Phil Zimmermann
Preamble
I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
0
votes
5answers
99 views
Should I enforce a password policy on a web site?
For a commercial web site, is it important to impose some restriction on passwords to access the system?
Eg. special $char, Upper and lower case, numbers, at least a minimum length...
Can a CAPTCHA ...
1
vote
0answers
73 views
How can I implement authentication in my proxy server?
I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet.
So far I am aware of IP and/or MAC address based authentication.
...
1
vote
1answer
59 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
6
votes
2answers
166 views
Does prompting for security questions on new computers add any security on banking websites?
When you sign into Bank of America on a computer you haven't used with them before, the site prompts you to answer one of your security questions.
How exactly does this make the site more secure?
...
2
votes
1answer
148 views
How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
-3
votes
1answer
31 views
NTP Autokey Authenticated Timeserver - Free and Public [closed]
I would like to use authenticated NTP. Are there any free autokey supported NTP servers available to the public?
2
votes
1answer
67 views
Send credentials by sms [duplicate]
If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?
1
vote
0answers
36 views
How do you evaluate and audit Central Authentication Service (CAS)?
This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
5
votes
3answers
238 views
Why would a website allow answers to security questions to be used interchangeably?
I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are:
...
20
votes
2answers
561 views
How does Google Authenticator work?
Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent.
It works without any connectivity; it even works on plane mode. This ...
0
votes
2answers
93 views
How to allow only the public key owner to submit requests to my site? And what is this type of security called?
This was probably asked many times here, but I'm not finding any because I'm not sure what to look for.
I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
2
votes
3answers
78 views
How good is validating source with request.referer than checksum?
I have 2 portals(both are under my control & domain names are different)
In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.
Link which will be hit in ...
114
votes
7answers
18k views
CTRL+ALT+DEL Login - Rationale behind it?
Maybe a rather noobish question: Why is CTRL+ALT+DEL required at login on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a ...
3
votes
1answer
75 views
Are there any uses of having a non-deterministic salt value for hashes?
So I've been toying with the idea of having non-deterministic salt values for hashes.
Let me explain what I mean:
Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
8
votes
1answer
172 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
2
votes
4answers
224 views
Is it safe to allow users multiple login at different browsers & computers?
We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
7
votes
4answers
207 views
Candidate authentication in large scale assessment
First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes.
We're ...
2
votes
1answer
54 views
Authenticating a ciphertext
what can be considered as a downside of authenticating a ciphertext?
For example, can we say drawback of authenticating a ciphertext is that we lose
repudiation, for example, we can't prove to the ...
3
votes
2answers
122 views
Are there any serious problems with this method for generating single-use tokens?
I need your advice on the security of this design.
I have a scenario whereby a server application and a smart card application need to share a value e.g. 52, which has been encoded in a long decimal ...
1
vote
1answer
54 views
What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?
I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible.
On ...
4
votes
2answers
80 views
How Secure are Authenticity Token in Rails
I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
0
votes
1answer
117 views
Facebook Login for Intranet
How safe is Facebook Login? I'm currently building an intranet, for my small company. We're 10 employees, and no risk of them messing up from inside.
But is using Facebook Login safe for this? How ...
6
votes
3answers
514 views
Is there any SQL injection for this PHP login example?
I want to write a login form, and I got one example from the web.
I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like?
This is ...
1
vote
0answers
73 views
Two-way authentication with google authentication app [migrated]
Can someone guide me on what I've done wrong with implementing Google authentication app?
Here is what I've tried without success:
1# Create secret key
$chars = ...
2
votes
4answers
289 views
If someone steals my laptop while I'm logged in, how can I protect my browser?
My question has its roots in an xkcd from this week:
http://xkcd.com/1200/
Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I ...
2
votes
0answers
75 views
How do I make or get computer certificates to use with IPSEC user authentication?
I am having trouble and need some direction using computer certificates with windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
6
votes
3answers
133 views
Is there any sense in using two-step authentication for personal email address?
There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
4
votes
1answer
79 views
Authentication concept for sites served to another site
We are going to serve content to a Content Management System that embeds it through an iframe (yuck). Some pages that we serve need to be authenticated before – only a valid user should be able to see ...
2
votes
1answer
98 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
4
votes
4answers
320 views
What are the ways to implement two factor authentication?
We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
0
votes
1answer
56 views
Best practice for securing user credentials once they reach the server using Basic Auth + SSL
I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
2
votes
3answers
153 views
Secure login system - using sessions?
I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this:
<?php
session_start();
if (validPass() || isset($_SESSION['userId'])) {
...
2
votes
2answers
47 views
Client code tampering detection
I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
-2
votes
1answer
32 views
What is the notion challenge in authetication?
Can someone help me what is a challenge in authentication wordbook?
1
vote
1answer
129 views
Basic Authentication with WebAPI and HTML/JS Client?
I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
0
votes
1answer
64 views
What rules should be enforced for users to create a strong password?
I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best ...
5
votes
6answers
284 views
What's the most secure technique for authenticating user in a website?
I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
6
votes
3answers
194 views
What is the value in asking for a second password for sensitive operations?
When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions?
Does it provide any benefit over ...
