Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

-2
votes
0answers
10 views

“Please do not use special characters in your password” is this an unambiguous indicator of potentially insecure infrastructure?

Background Trevor has chosen to sign up with a provider of on-line services, wherein such provider requires that passwords consist solely of alphanumeric characters. Context Trevor asked a ...
-1
votes
0answers
28 views

Is there a safe way to persist readable passwords?

Is there a safe way to store all your login credentials, keyed by the application they are for, in a file or some similar medium ? Additionally, is there a way to store them securely in the cloud ...
6
votes
5answers
1k views

Why is being able to login with capslock bad?

I recently discovered a service where the password was not case sensitive. I understand basic principles of encryption and hashing so I am a bit worried, is this service storing my password in plain ...
1
vote
1answer
32 views

Google account 2FA only with HW security key?

Is it possible to configure 2FA access to a Google account using only HW security key (e.g. Yubikey) without verification SMS code option ? It seems that SMS confirmation code is still primary 2FA ...
0
votes
1answer
81 views

Authorization before Authentication?

From a conceptual point of view, can authorization occurs without authentication taking place first? I'm thinking about few cases where authorization seems to occur without authentication taking place ...
1
vote
1answer
47 views

How does a public key authenticator work? (as opposed to public key signatures)

In the documentation for djbs library NaCl under the headline Security model you can read that the library provides public key authentication without non-repudiability (http://nacl.cr.yp.to/box.html). ...
1
vote
1answer
72 views

How can storing a userId as client-side-sessions be safe?

The documentation for session handling in ninjaFramework states: [...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. ...
1
vote
3answers
397 views

Securing REST API with HMAC and basic auth

I was wondering if giving users choice of a method for securing their access to API would be a good idea. Background: We are creating and deploying applications for our customers, which help them do ...
2
votes
2answers
37 views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
11
votes
1answer
110 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
1
vote
3answers
72 views

How secure is this token url for subcontractors with no accounts?

Imagine you are a cab company that subcontracts independent drivers to drive within certain cities and towns. You send the subcontractor a link to a page that has fields for the subcontractor to ...
1
vote
3answers
75 views

Vulnerabilities despite FIDO U2F?

FIDO U2F seems much more secure than one-time-passwords (OTP), especially TOTP, because of the challenge-response architecture. In what ways is a U2F user still vulnerable? I presume if a user's ...
0
votes
1answer
40 views

Authentication on remote, unmanned, unconnected machines/devices

What proven methods exist for authentication of a user on remote, unconnected machines/devices where establishing unique login credentials for the users isn't practical due to the number of ...
3
votes
2answers
277 views

SSH cache secrets

Why does SSH use public key crypto each time you connect to the server? RSA/DSA are computationally expensive, so why can't they just be used the first time to share a secret, and then in the future ...
4
votes
2answers
69 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
4
votes
2answers
62 views

Understanding Digital Certification as as a whole starting from a normal http request

I am very new to security and i do not come from an IT background. Please pardon me if i ask some very simple and questions that don't make sense. I am trying to understand the difference between ...
3
votes
2answers
114 views

My IP address switched suddenly and then switched back

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private). Even though today I ...
3
votes
1answer
101 views

OS login password: How does it work?

I am making an application to create a password for a user. I am a bit baffled over how it all works though. Namely I want to be sure that my application will store the correct hash so the user can ...
1
vote
1answer
58 views

How dangerous is reflected request query strings?

I have discovered a possible security flaw in a login for a site that many people rely on. I won't say the site but in the URL there is something similar to ...
0
votes
1answer
75 views

Active directory authentication and authorization for an application

Currently all our applications are web based and our authentication and authorization mechanism is always through the database. eg database logins and access controls defined at database. However now ...
0
votes
0answers
5 views

Enabling MFA in Windows 7 [migrated]

How does one set on Windows 7 that you have to login with 2 methods? For example, first time with your password and then you are forced to use fingerprint or smart card ... and after that your PC will ...
1
vote
0answers
55 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising when wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide ...
1
vote
1answer
52 views

Choosing token over Session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and send ...
3
votes
1answer
55 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
0
votes
0answers
13 views

What is the goal of sign a key in BrowserID certificate?

I'm learning about the Mozilla Auth. it has an implementation of SRP protocol in https://github.com/mozilla/fxa-auth-server/blob/master/docs/overview.md and his client; example is ...
0
votes
1answer
19 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
2
votes
0answers
30 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
-1
votes
0answers
23 views

Is this legally reverse engineering - unsecured API [migrated]

Is it (in a legal sense) reverse engineering to 'hack' into a completely unsecured API? Simple REST API used in Android app No SSL (just strait HTTP) Passwords are sent in plain text over this ...
3
votes
1answer
46 views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
-1
votes
1answer
46 views

Is there any authentication scheme relying only on the “secret” question?

I know it's standard for websites to use usernames and passwords to authenticate users. From what I've read, question based authentication is usually used to either reset a password, or employ ...
1
vote
1answer
65 views

Does the carrier network autheticates itself to the SIM card?

From my understanding this is how SIM authentication works: When the mobile device starts up it obtains IMSI from the SIM card and send it to the operator network Operator network finds the Ki(128 ...
2
votes
1answer
88 views

OpenVPN username and password authentication only - unsafe?

Is it safe to only use username and password (and server certificate) for OpenVPN connection authentication? Are username or password ever transmitted in plaintext to the OpenVPN server? I found a ...
0
votes
2answers
143 views

Diffie-Hellman and MIM attack, and server identity

Diffie-Hellman and MIM attack: When variants of Diffie-Hellman algorithms like DHE, ECDHE etc. are used in SSL handshake for key exchange then can it become prone to man in middle (MIM) attack. ...
0
votes
1answer
73 views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
1
vote
3answers
120 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
0
votes
0answers
29 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
0
votes
1answer
43 views

Use PIN or Password [duplicate]

Which one is better, using PIN or password ? I want my app using PIN number to user login and register. Does not matter if I use PIN number only for user login and registration in my web application ? ...
-2
votes
0answers
59 views

implementing a secure client-server system

I am creating an Android app that communicates with a server. I need a safe way to transmit sensitive data so this is what I planed to do: Use ssl pinned to the app, so the app knows the server. Use ...
2
votes
2answers
76 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
2
votes
1answer
53 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
2
votes
2answers
57 views

Verification code within mobile phone applications

In most phone applications with two factor authentication I noticed that the verification code is usually 6 digits long. I wonder why 6 digits are needed - we already know that the user is associated ...
4
votes
3answers
86 views

2-Factor Authentication vs Security Questions

I have an account with a bank that has additional security option. When it does not recognize a device being used to access the account, it will either: Prompt with 1 of 3 security questions Send a ...
5
votes
2answers
197 views

How secure is PIN login to Windows?

I've just noticed that Windows 10 allow me to change my login method to PIN which is obviously much more convenient than entering my long and secure password after every startup / wake. I am just ...
0
votes
0answers
7 views

change login time/date on Linux [migrated]

Is it possible to 'backdate' a login time on a Linux server by changing the date? For example, I just ran lastlog on one of my servers and included in the expected records was this: root ...
2
votes
1answer
60 views

Logout tied to cookie expiry

I am looking for an event to automatically logout a user from the application. Typically I would do it when an inactive session expires. I was wondering if it is secure to do so using cookies. So here ...
1
vote
1answer
44 views

Authentication on client server

I have following requirements for system: My admins authenticate on client servers Over http Central authorization server My solution is based on O-Auth: user is redirected to authentication ...
4
votes
1answer
65 views

“MAC function must resist existential forgery under chosen-plaintext attacks”, what does that mean?

While reading about MAC (Message Authentication Code) I have faced this sentence: MAC function must resist existential forgery under chosen-plaintext attacks but I got confused. What does ...
1
vote
0answers
21 views

Relationship between the validity of license of an accredited CA (certificate authority and the validity of it's certificate? [duplicate]

To more clear, let's see my example: As I know, in Korea, the validity of a CA's license is only 2 years, but the validity of this CA's certificate is 10 years. Why is the valid time of the license ...
0
votes
0answers
9 views

Is it possible to UI automate testing involving Two-factor Authentication for an iOS app? [migrated]

I have an iOS app that uses 2FA for certain account related features. I'd like to create some UI automation tests for those features, but they require receiving either SMS messages or email. On a ...
3
votes
2answers
102 views

Can I prevent timing attacks with random delays?

I read recently about profiling for valid user accounts with timing attacks, IE the application-under-attack takes a predictably different amount of time to process say a login on a non-existent user ...