Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

24
votes
2answers
1k views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
-1
votes
1answer
19 views

RADIUS use outside of network AAA

I've seen RADIUS used for wireless authentication, but are there any other use cases that RADIUS works well in? Has anyone had experience with using RADIUS for AAA between two applications? I'm ...
1
vote
2answers
64 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
4
votes
7answers
260 views

Should user IDs be implemented in online banking?

How common is it for a bank to request you to make a user ID as well as password when banking? Should they simply use a pre-determined number such as your credit-card, or are there advantages to have ...
1
vote
1answer
138 views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
1
vote
1answer
568 views

Forcing EAP-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE certificate based handshake with a FreeRADIUS server and WPA_supplicant - both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
0
votes
1answer
38 views

vpn and strong authentication, how does the two work as a pair?

Dont know. maybe I was to unprecise.... I basically am asking if a SSL-VPN solution is solving both the encryption and the authentication, like that the user authenticates himself to the vpn-client ...
7
votes
2answers
422 views

Can an attacker “simulate” a private IP address?

I have a SSH server with a rule that does not allow password connections outside the local network. So people already on the local network, either physically or via VPN, are allowed to connect with ...
4
votes
0answers
58 views

Security protocol for NFC stickers/cards

Lets say I'm using NFC cards for access control. NFC cards/stickers are easily readable and writable, so my worry is that the data on them could easily be cloned onto another card/sticker and bypass ...
2
votes
5answers
12k views

WiFi deauth attack - Difference between Aireplay and MDK3

I am currently working on some WiFi related security issues, and something appeared to me. I have an Open WiFi network, to which a client connects. I try the Deauth attack from Aireplay ...
2
votes
2answers
211 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
2
votes
2answers
72 views

Openssl ciphers: what does Au=ECDH mean?

I am trying to get a grasp on different stages of SSL. I have referred to some fantastic answers about how SSL/TLS works and specifically about authentication mechanisms, and numerous other sources. ...
1
vote
1answer
21 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
1
vote
2answers
93 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
3
votes
1answer
192 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
1
vote
1answer
75 views

Check HMAC after completing decryption or before?

I have written a piece of software that symmetrically encrypts big files (multi-megabyte). Plaintext is encrypted, after the encryption the HMAC is calculated and written into the header of the file. ...
1
vote
0answers
38 views

Time Based Authentication

I need a way of authenticating that a file was generated by a particular machine that has a unique ID and a unique random secret also known to the authenticator, as an added difficulty the file ...
3
votes
1answer
355 views

Security Implications of Google's Two Step Authentication’s Backup Codes

Sometimes, when I log in to Google, it asks me to print out some backup codes for the two step verification process. This seems like a big back door that breaks the whole point of two step ...
0
votes
1answer
275 views

How to build a secure stateless authentication system for a client-side JavaScript application

i'm building a stateless authentication system for a Dart application (Dart gets compiled to JavaScript, so the whole application is an index.html file which loads JavaScript and runs in the browser) ...
1
vote
1answer
49 views

Can a 0800 and 00800 be from different companies in UK [closed]

I recently received a call from a 00800 number, that seemed like a prerecorded message asking me to press some keys to continue. I disconnected. I later googled the number and I noticed that a ...
0
votes
0answers
15 views

At OpenSSH ssh server side key files has 0 data. I would like to know the reason for it

I am using the Monta Vista Linux. In this recently i have observed the ssh keys files has 0 data due to which the keys were not generating and i am not able to login to machine via ssh because of key ...
2
votes
1answer
212 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
0
votes
2answers
137 views

Why do I have to use multiple Keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
2
votes
2answers
303 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
1
vote
1answer
152 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
2
votes
1answer
68 views

Multiple logins on the same website

If a hacker uses MITM in an open WiFi network, he can easily grab plaintext passwords so that he can login from his PC and change it. Is there any solution for this? I wonder when we log in to ...
1
vote
1answer
339 views

secure use of psexec?

As of March 7, 2014 PsExec now "encrypts all communication between local and remote systems, including the transmission of command information such as the user name and password under which the remote ...
0
votes
2answers
87 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
3
votes
2answers
1k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
1
vote
2answers
72 views

Is it Safe to Send an Invalid Password Back to the Client?

It is common for websites to remember the username input value after an invalid login attempt but not the password input value. Take SE for instance. When I attempt to login with an invalid password: ...
1
vote
1answer
35 views

SSL cert vs public-key authentication

If SSL/TLS uses a pre-created certificate why does it also use public-key ciphers such as RSA and ECDSA for authentication (I do not mean MAC integrity)? Are they related?
2
votes
1answer
104 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
1
vote
2answers
80 views

SSL/TLS client authentication - practical client cert validation

How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do ...
1
vote
1answer
42 views

Should I show the security answer when the user goes back to edit the field?

So when a user signs up to create an account, they are required to select select questions and enter security answers. Once they do that, they can proceed forward to a review page that shows them the ...
-1
votes
1answer
75 views

Is this process a secure way for users to login? If so, is there a name for it already?

I thought of this process specifically to stop "man in the middle" attacks and replay attacks: User types their username into the client application. Client application sends the username to the ...
2
votes
1answer
31 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
2
votes
0answers
34 views

Using RSA-SHA as/instead HMAC in OpenVPN?

While reading the manual of OpenVPN 2.3, I came across the --auth alg option. The manual says: Authenticate packets with HMAC using message digest algorithm alg. (The default is SHA1 ). HMAC is a ...
1
vote
3answers
1k views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
2
votes
1answer
129 views

Is it a safe to hardcode my secret key in my iOS app?

Cloudinary iOS SDK configuration suggests to hardcode your api_secret in your iOS app's source code. Isn't that a security vulnerability since string literals can be extracted from the app binary, ...
1
vote
2answers
95 views

how to do 2 way ssl authentication without using a self signed CA

I have a requirement to set a 2 mutual ssl authentication between our apache and an application. I have purchased a cheap SSL from rapid SSL in order to do this. RapidSSL sent a zip folder with ...
1
vote
1answer
104 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
1
vote
3answers
64 views

What are the disadvantages of combining client-side and server-side authentication security?

Imagine situation: Application might or might not be run via SSL/TLS Application should not know password of the client because client might reuse passwords Wouldn't then combined client-side and ...
3
votes
1answer
43 views

How can I make sure that the incoming file is definitely of the expected file type?

I have a program to check if incoming files are in an expected filetype, e.g. PDF. The program first takes a look at the magic number, and determines the file type out of that. The problem is that I ...
0
votes
3answers
192 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
196
votes
7answers
34k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
1
vote
1answer
36 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
3
votes
2answers
327 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
2answers
127 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
3
votes
2answers
477 views

How does YubiKey protects it's secret key?

From what I understand, a YubiKey stores a secret key which can be used to generate passwords to enter a server. How does a YubiKey protect it's secret key? If it is plugged into an infected ...
1
vote
3answers
101 views

How YubiKey Challenge-Response works “locally”?

I have got a YubiKey NEO recently (and a bit disappointed that you can only have two activated second factor authentication methods out of all the listed). In password managers those support YubiKey, ...