Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
29 views

How to build a secure affiliate network

I'm going to build a demo affiliate network, which needs to be secured. Let say I have a web application called Affiliate Network Manager that manages all affiliates associated with my online book ...
5
votes
3answers
575 views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
4
votes
3answers
133 views

Why do some websites need time to log you in securely, while others can do it instantly?

I noted that on a lot of money-related websites (banks, paypal, etc), you are brought to a page that "logs you in securely". This is an example of one: Meanwhile, websites that also store very ...
1
vote
1answer
23 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
1answer
20 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
1
vote
0answers
21 views

Considerations when implementing a key based SSH-like auth scheme

I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
1
vote
3answers
23 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
1
vote
1answer
44 views

Client authentication flaw in old Netscape SSL protocol

Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
3
votes
1answer
54 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
1
vote
1answer
20 views

Api authorization basic concepts in detail

I am trying to write an application is rails. Which is more like a api application so that when a user gets redirected from his application into mine I would like to authorize him and start a session ...
1
vote
1answer
41 views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
1
vote
0answers
32 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
2
votes
4answers
98 views

Why not ask for a password and 2-factor token at the same time?

I have observed a number of web-based login forms that offer 2-factor authentication do token entry on a second form after validating your username and password. Is there a reason not to ask people ...
1
vote
2answers
92 views

LastPass login security

If LastPass does not store your master password, then how can you login to use their web app? Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and ...
10
votes
2answers
934 views

Does having 2-factor authentication help with HeartBleed?

I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
1
vote
0answers
26 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
0
votes
0answers
17 views

use application authentication after database authentication while application connects to a database [closed]

I have an application user id and a database userid. I need to use connection pool to connect to the database. But restrict my access based on my application user id. Is it possible to capture ...
9
votes
6answers
1k views

What methods can be used to prevent mistyped usernames?

I wanted to log on to my account on my bank's website. The account is protected by a number of security checks. The first one is what really amounts to a username, a confidential one. It's an 8-digit ...
0
votes
1answer
48 views

is there any 100% secure way for form authentication and sending information from client side to server side over internet pages? [closed]

i think for acquiring 100 % secure data transfer between forms on client side and c# code on server side ? my tools : i use IIS as my server and i wonder how can i reach for latest security that ...
-4
votes
1answer
46 views

Using same CSRF Token for Multiple account creation [closed]

While Pentesting through some sites i found that an Multiple account's can be created using same CSRF token which should not allowed.I want to place two scenario's to describe my question. Scenario ...
1
vote
2answers
88 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
1
vote
0answers
14 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
1
vote
0answers
65 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
1answer
122 views

Hashing the cookie token for persistent login

In a login system I'm doing, I'm using a per-user, per-device randomly generated cookie token. A part of the script looks like this: // Generate current device's token $token = ...
0
votes
1answer
45 views

Can I use 2 factor authentication for shared accounts?

Is it possible to use SecurID 2FA for Highly Privileged shared accounts? I am currently using CyberArk to vault passwords for privileged accounts. when I checkout a password, I would like to make sure ...
1
vote
0answers
78 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
1
vote
1answer
118 views

How to use TPM to perform platform authentication?

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the ...
1
vote
2answers
88 views

Hardware-restricted root login

I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and ...
0
votes
1answer
34 views

Web Application Security Tools For Login Authentication

currently i doing my final year project. I want to do a comparison of different types of web security tools to pen test login authentication. But, this is too broad and pointless. So, any one of you ...
3
votes
1answer
314 views

Securing mobile app rest requests

I am using Facebook login in a mobile native app, and I'm trying to figure out if my approach is secure enough. This is the flow (all communication is made over SSL): User logins to Facebook ...
1
vote
0answers
31 views

How exactly are physically unclonable functions used in authenticaton if they are unclonable?

There is ongoing and quite promising research with prototypes presented about using physically unclonable functions (PUFs) in authentication. If they are practically unclonable, how is a PUF-based ...
2
votes
4answers
187 views

How does a system authenticate a user using a hash function, after it has been salted?

I don't really understand how salting works. I read the Wikipedia article, but I still don't understand how can a system authenticate a salted hash? Let's say a user chooses a password. It's randomly ...
1
vote
1answer
41 views

MySQL authentication, how to pad the 20-byte salt

Im authenticating with a mysql server with the authentication method listed here. I observed the salt and hash using wireshark, and I know the password, but I am having trouble reproducing the hash I ...
3
votes
0answers
61 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
1
vote
2answers
66 views

SSL/TLS : Authentication mechanism

I have these doubts regarding authentication in SSL/TLS : Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, ...
1
vote
1answer
57 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...
1
vote
1answer
84 views

WordPress Hacked. Deny access via admin - helpful or not?

Does it actually help keep a site more secure to deny all access to WP admin and make changes directly on the FTP only? Our WP has been hacked twice now. It seems that everyone has a different idea ...
1
vote
2answers
85 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
3
votes
3answers
102 views

Alternative to security questions for account recovery when email isn't an option

I'm working on a project whereby a certain level of anonymity is required for users. One of stipulations is that no email is used at all, as it makes the barrier to entry too high for people who want ...
-1
votes
2answers
48 views

Log in security - saving a session [closed]

I am creating a log in system. The easiest system would simply check a database for a log in and password, then same a session var which states login=true I am interested in other things that I can ...
0
votes
1answer
98 views

Is this API Token scheme secure enough

I am designing a REST Api for a mobile application and have some worries over properly securing access to accounts. I am writing the API server in nodeJS and it will primarily be consumed by a mobile ...
2
votes
4answers
200 views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesnt even have support for SHA or other algorithms. But I can think of quite a few advantages, ...
1
vote
2answers
40 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
-1
votes
3answers
63 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
3
votes
2answers
96 views

Separation of secure login steps

I'm redesigning a login screen for a financial services application. Currently, this requests user ID and password, then (on the same screen) 2 digits from a 6-digit PIN are requested - these 2 digits ...
1
vote
0answers
48 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
1
vote
0answers
45 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...
1
vote
1answer
77 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
0
votes
2answers
58 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
1
vote
0answers
48 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...