Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
3answers
92 views

Custom Authentication in a RESTful API - Will this work?

I was just wondering if this would be a reasonable way to write a custom authentication method for a RESTful API. It seems moderately secure, but perhaps I'm way wrong here. 1) Email and Password are ...
1
vote
3answers
93 views

HTTPS client “pairing”

I've been redirected here from SuperUser, I hope the question is appropriate. I need to restrict usage of a certain site to a limited number of customers. More than that, actually: I would like to ...
34
votes
8answers
4k views

Is the UK Parliament e-petition system trustworthy?

Over the last few days, I've been hearing often about the petition to (pratically) "repeat" the Brexit referendum and I noticed that it is an online petition. I noticed that the "sign petition" form ...
8
votes
3answers
981 views

Two factor authentication with my bank

My bank requires a security dongle. Place the debit card in the card reader and enter a pin code. An 11 digit code appears which is entered on the bank's website and access is granted. But if I ...
2
votes
1answer
178 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
2
votes
2answers
61 views

Can identification imply authentication in biometric systems?

I know the difference between Identification and Authentication, which are basically claiming who you are and proving that claim. In terms of a system, they are username and password in general. But ...
0
votes
1answer
110 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
0
votes
1answer
72 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue We have a domain joined tablet that runs a Windows Store Application, we already have user identity and we need to call ...
6
votes
2answers
1k views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at http://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
2
votes
1answer
61 views

Is installation id secure enough to authenticate device's user against a Web Service API?

...or interactively asking for password / or having some certificate is inevitable? Context My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my ...
31
votes
4answers
13k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
5
votes
3answers
285 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
43
votes
5answers
8k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
5
votes
5answers
3k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
-1
votes
1answer
26 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
-1
votes
4answers
54 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
34
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
1
vote
0answers
12 views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
0
votes
0answers
134 views

Social game authentication exploit

We're running a popular social game and we have a security problem that is growing more and more popular these days. We have the following product requirements: There should be no registration to ...
0
votes
1answer
48 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
1
vote
1answer
101 views

Is it secure to refesh a JSON Web Token (JWT) auth token using the user credentials?

As I understand the answers to this question JWT: Is refresh an expired token is a good strategy?, one should use a refresh token to refresh an expiring auth token. Since my web app should be ...
1
vote
3answers
181 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
0
votes
0answers
14 views

Digital Signature on a Passive RFID tag with small-ish memory constraints

I'm pretty new to the crypto and security worlds and I'm looking for some guidance. Briefly, my project involves Widgets (physical items that need to be authenticated) and Gadgets (physical machines ...
0
votes
2answers
56 views

How does a Safenet eToken Pass(hardware token) generates OTP and based on which algorithm? How does authentication takes place against it?

I use hard token to login to a VPN but I don't get the concept behind it.The password is combination of a self generated PIN + OTP generated on eToekn Pass. How do authentication takes place at back ...
1
vote
2answers
114 views

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
0
votes
2answers
96 views

How secure is the hashing/salting/stretching process as described in this diagram?

Question I was just brainstorming about the hashing, stretching, salting part of the user password in the authentication process and I want it to be as secure as possible (no matter how paranoid that ...
1
vote
1answer
20 views

does openssh support authentication using public key fingerprints?

Cisco have two ways of enabling public key authentication: using the public key and using the public key hash. ip ssh pubkey-chain username <user> key-string <public key> OR ...
4
votes
2answers
61 views

Is CHAP authentication still secure?

Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure? I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in ...
9
votes
3answers
13k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
1
vote
1answer
78 views

How exactly are physically unclonable functions used in authenticaton if they are unclonable?

There is ongoing and quite promising research with prototypes presented about using physically unclonable functions (PUFs) in authentication. If they are practically unclonable, how is a PUF-based ...
0
votes
0answers
12 views

Mutual authentication between devices [on hold]

I have clear understanding of mutual authentication and I'm now trying to implement it just for testing purposes. Here is my scenario: I have a Linux machine A which acts as a self-signed CA. Now ...
0
votes
1answer
29 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
0
votes
0answers
17 views

Application specific password tools/papers?

We have our users/groups managed by an LDAP system. We would like to move away from logins to all internal systems using the main LDAP password but still want to centrally manage user accounts. We ...
3
votes
3answers
90 views

What security does the new option for two factor authentication that Google offers enforce?

Google has announced a new option for two factor authentication - a popup message. How does this improve security?
0
votes
0answers
34 views

Out source Authentication Service with PIN [closed]

I'm working on a mobile application project that requires PIN authentication. The majority of external services we have reviewed are your typical Email / Password authentication. The only PIN ...
4
votes
1answer
58 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
4
votes
2answers
2k views

“Extended Protection” primer and implementation guide to prevent MITM

Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks. Does anyone have a primer (or explanation in plain English) what this feature is, ...
6
votes
2answers
170 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
22
votes
4answers
9k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
0
votes
0answers
16 views

Mifare cards authentication

I have few questions about Mifare authentication: 1) Can you confirm me that the authentication between the reader and the tag is as follow: the reader send the correct key to the tag for the sector ...
-2
votes
1answer
109 views

What scenarios really benefit from signed JWTs?

UPDATE: I have concluded my research on this problem and posted a lengthy blog entry explaining my findings: The Unspoken Vulnerability of JWTs. I explain how the big push to use JWTs for local ...
3
votes
1answer
48 views

PIN Entry via HTML rendered Keypad

I have a web application that replaces a non-web predecessor. A low level set of users accessed basic functionality with touch panels in the non-web previous version of the product with the touch ...