Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
0
votes
0answers
10 views
API authentication without Oauth2 server
I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login ...
2
votes
1answer
112 views
How can I implement authentication in my proxy server?
I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet.
So far I am aware of IP and/or MAC address based authentication.
...
0
votes
1answer
47 views
How does does the “Sign out all other sessions” feature work in Gmail?
In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
6
votes
1answer
111 views
Build a secure channel without SSL/TLS
I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service).
1. ...
0
votes
1answer
54 views
Asynchronous vs. Synchronous authentication process
I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database).
I'm at the stage where I have to design the authentication and I had a question about ...
-1
votes
0answers
16 views
App authenticating with Google
My iPad App uses an oAuth authenticator to get access to a user's analytics data on Google. After a welcome screen, users are shown the standard Google sign in page. The signup page is presented from ...
4
votes
1answer
93 views
Known examples of spoofed Change Request?
A Change Request from a client (in the commercial sense of the word) to an organisation supplying an IT system to that client, can add or modify requirements for that system. Are there any known ...
5
votes
3answers
76 views
API message verification without storing private key?
I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved.
It seems the current common practice for "authenticating" users in API requests is ...
16
votes
6answers
476 views
How can I share certain information only after my death?
I want to make sure that after I die, a special someone gets a vital piece of information from me (like the password to my bank account), but:
I don't want anyone to be able to get that information ...
4
votes
1answer
46 views
NFC used in place of contact based smart card two-factor authentication
My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
2
votes
1answer
61 views
HTTP Basic Auth is enough?
I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
4
votes
2answers
88 views
Securing a REST api at the message level
I'd like some feedback on the following authentication idea, does it makes sense, and is there a standard
way of doing this (or similar) so I can rely on a well tested implementation.
I've seen many ...
13
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
2
votes
3answers
79 views
Does Gmail 2-factor auth increase security on smartphones?
So I have enabled 2-factor authentication on Gmail, which means that if I log in on a new machine, it sends a token to my phone.
Now, if I access Gmail from my phone, it seems like I have only one ...
2
votes
1answer
56 views
Is it secure to use a URL to automatically authenticate to an OAuth-protected API?
I'm looking for a way to create a URL that allows a user to login to our application without providing a username and password.
We have created an API which is protected using OAuth 2.0. I want to ...
5
votes
1answer
112 views
How do I make or get computer certificates to use with IPSEC user authentication on Windows?
I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
5
votes
1answer
121 views
Motorola Human Authentication Pill/Vitamin Security?
This appears to be hot news today, Motorola announced a form of pill that a user can swallow which is activated and powered by stomach acids and transmits a signal back which can be used to ...
0
votes
3answers
85 views
Connect to Mysql database from remote host without remote access
I have a website which is managed through CPanel. I know that remote database connections are disabled by default and I have tested that it is indeed disabled.
I know that many people have some of my ...
2
votes
0answers
50 views
What are the security implications of (not) expiring login screen session? [duplicate]
I manage a single sign on solution (CAS) for a group of related web applications. The CAS specification states that Login Tickets are associated with every login attempt which can only be used once.
...
6
votes
0answers
195 views
Web Authentication using PKI Certs [migrated]
I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
79
votes
3answers
48k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
2
votes
2answers
65 views
Login system using authenticated encryption without storing user password
I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about.
First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
1
vote
1answer
60 views
What are the security implications of using TOTP for single factor authentication?
(Note: I am not actually planning to do this. This question is strictly theoretical.)
TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
3
votes
4answers
2k views
Two-factor authentication w/certificate and username & password?
Example scenario:
ActiveSync
Authentication method:
certificate-based authentication AND Active Directory domain username-password
Encrypted on device:
public & private key
AD username ...
-1
votes
2answers
107 views
How does Google detect new devices for two factor authentication
When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device.
How do they ...
2
votes
1answer
68 views
Authenticating users on offline devices such as ipad
We are wanting to authenticate the user inside a webapp (javascript/html inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realise this ...
10
votes
3answers
189 views
Multi-tenancy, SSL Certificates, and Subject Alternative Name
The X509 specification allows a CA to issue a single certificate for multiple hostnames, by using the "Subject Alternative Name" extension.
From the spec:
The subject alternative name ...
0
votes
0answers
38 views
Top SAML 2.0 identity providers in the market [closed]
I am working on a product (service provider) which uses SAML 2.0 for authentication purpose. Having said that I wanted to know what you all think are the top and most trusted identity providers that ...
35
votes
8answers
24k views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
1
vote
2answers
110 views
Password on login idea
In addition to the standard best practices on password logins. Has anyone considered a captcha like system but instead of just typing out what is in the captcha, the captcha will be directions on what ...
1
vote
0answers
42 views
Stateless REST API and secure server side password storage [duplicate]
RE: Duplicate - Did anyone actually read my question? The question marked as duplicate is in no way, shape, or form what I'm asking. I specifically state that a DB compromise must not allow an ...
5
votes
5answers
181 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
0
votes
3answers
102 views
Password and username used to connect to database in source code [duplicate]
In PHP scripts that communicate with the database I have the username and password to the database in plain text i.e. mysqli_connect('localhost:3306', 'root', 'PASSWORD!'). From OWASP
Do not ...
6
votes
3answers
159 views
Can I spoof IP addresses when attempting to brute force a login?
I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
5
votes
2answers
82 views
Is it common for a One-Time-Password system to become unsynchronized?
One-Time Passwords look like they can play a helpful role in a layered-security system, yet their use, especially paper-based TANs seem like clients could be vulnerable to getting out of sync with the ...
-3
votes
0answers
39 views
Wrong public key file indicated on ssh debug? [closed]
I'm trying to figure out if it is my fault that I can't ssh to a RSA-secured server or not so I enabled debugging upon ssh-ing to the server. I got this:
$ ssh -v skytreader@remoteserver
...
-1
votes
0answers
29 views
Why is my email address removed at the end of my matching public key file? [migrated]
I tried ssh-ing to a server that uses RSA verification. I was already able to ssh to this server months back but I find out that I can't do so today.
I investigated the keys in my computer. I emailed ...
2
votes
3answers
301 views
Is using Google Voice number for two-factor authentication a big mistake?
Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
4
votes
0answers
85 views
Designing single-sign-on with JSONP/CORS?
I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions).
I would like to do something ...
1
vote
1answer
54 views
Secure authentication cookie for web site
Hello i want to know if this auth token is secure enough for a site of millions of logged in users:
...
4
votes
5answers
1k views
How secure are “mobile authenticators” versus traditional key fobs?
Two-factor authentication, password + device, seems to be increasingly mainstream among consumers with products like Activision Blizzard's Battle.NET authenticators. However, I am curious what the ...
4
votes
2answers
72 views
Terminology: authentication vs verification
The two words have a similar meaning and I'm having difficulty adequately explaining the difference to someone. You verify a person's identity by having them show a form of identification, such as a ...
1
vote
2answers
129 views
Can unencrypted keys & logins be kept out of program memory?
No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will ...
5
votes
2answers
76 views
Do keyfiles actually add any meaningful security in the presence of strong passwords?
In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
4
votes
1answer
148 views
How is an HTTPS login secure when pages use HTTP?
When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
1
vote
2answers
86 views
Security benefits of Single Sign-On [duplicate]
What are the benefits of a single sign-on implementation from the point of view of security?
From my point of view, if the account is compromised the attacker has access to any resource, so ...
4
votes
1answer
47 views
What attacks, if any, are possible against Security Support Provider Interface (SSPI)?
I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
2
votes
1answer
79 views
Is TextKey SMS 2 factor authentication secure against cell phone cloning?
I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods.
In typical SMS authentication, the provider sends you an access code ...
18
votes
2answers
972 views
Sending temp password when users first registered - is that good for anything?
One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
2
votes
2answers
90 views
Does providing OAuth for mobile apps pose a security threat?
Let's take a look at the basic OAuth workflow:
The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
