Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
45 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
0
votes
0answers
25 views

Should universal delete, or “the right to be forgotten”, be an extension to OpenID Connect “signout” or authentication in general?

There are different levels of maturity various OpenID connect implementations may have. One of the optional features is the session management and sign out feature. Now that this has finally ...
2
votes
1answer
58 views

Token based approach to authentication over SSL Rest API - refresh tokens

I'm quite a newbie at security. I'm developing an android app with a token based approach to authentication. I'm not using Oauth as the OAuth 2.0 is not an authentication protocol but rather used to ...
1
vote
1answer
476 views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
1
vote
1answer
920 views

Improving stateless REST API authentication token - or ditch it for database persistence?

I'm looking to implement stateless REST authentication into an API. I've been reading up on articles here, and have implemented an idea that works, but I was hoping to get some feedback on its ...
5
votes
2answers
85 views

Limiting Concurrent Login For System Admins On Windows Domain

Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our ...
0
votes
0answers
23 views

Multiple user type management - token based authentication

I am currently working on an e-commerce application. The application has different users: Customers Merchants Logistics Admin The current db structure has a different table for each of these user ...
0
votes
1answer
33 views

Should I use the certificate serial number or the subject key identifier to look up public key?

I'm designing an API authentication mechanism similar to the one AWS use. As part of that, I need to look up which public key belongs to which user to verify. The public keys come from x509 ...
22
votes
2answers
136k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
25
votes
2answers
1k views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
9
votes
5answers
11k views

Difference between authentication and identification [Crypto and Security perspective]

I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification. ...
5
votes
2answers
233 views

How to ensure that a person whose identity has been verified from an I.D. is the author of their exam answers?

Background We are designing a computer based test system where the examinees use their own computers to write their answers. The examinees' computers are booted to a custom Linux OS from USB drives ...
357
votes
21answers
68k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
0
votes
0answers
17 views

Does OAUth 2 allow authentication without UI (to an account with hard coded credentials)? [migrated]

Note: this question is not about authenticating to an account after receiving a valid access token. This is about the first leg in the authentication process that would obtain the valid access token. ...
1
vote
0answers
47 views

Failure analysis to avoid locking permanently online accounts [closed]

(I reposted here a question I previously asked in SuperUser, I think this section is more appropriate) Back in the days defining a path leading to loss of data or loss of online accounts was easy: ...
2
votes
0answers
24 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
-1
votes
0answers
16 views

is there a signature scheme for cramer-shoup cryptosystem? [migrated]

I have a project that I have to use cryptosystem and signature scheme for it, so I've read about cramer-shoup cryptosystem and I want to use it since it is more secure the elgamal cryptosystem, but, I ...
2
votes
1answer
58 views

Two factor authentication: SMS/TOTP, but what if you only use your phone

I found a code by SMS or TOTP on a phone as a second factor of authentication to be a good solution for when you're using your computer to login to a website. Most people have a phone which can either ...
1
vote
1answer
82 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
3
votes
2answers
272 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires authentication and authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
4
votes
1answer
213 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
1
vote
1answer
41 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
5
votes
1answer
162 views

Securing REST API via Hawk

I'm currently using Hawk as the auth scheme for an API. Basically, the current flow (forced SSL) involves: User types in email/passwd on app App performs 1000 rounds of PBKDF2 using the email as ...
1
vote
0answers
32 views

Is it possible to secure an Android Intent from other calls from apps?

I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a ...
1
vote
2answers
101 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
3
votes
1answer
211 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
2
votes
1answer
47 views

Using RSA for Web Application Authentication

I have a network that is only accessible through bastion servers over ssh. In it, I am developing web applications that are exposed to end users via GUI's served up over websockets. All traffic into ...
60
votes
7answers
17k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
1
vote
2answers
81 views

Token-based authentication - what's a good token length?

What's a good token character length for a token-based login? Currently I'm using the following code: <?php $token = bin2hex(openssl_random_pseudo_bytes(16)); Is 16 sufficient or should ...
3
votes
2answers
103 views

Comparing the 2FA Vendors

If we need to choose a vendor for the 2FA in our environment, what are the features that we should look for? Our selection process depends on the functionality and usability they provide. But when I ...
3
votes
2answers
53 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
3
votes
1answer
77 views

What's the weakness of keyed-MD5 for message authentication?

I've seen public web API's using keyed-MD5 to generate message authentication code rather than adopting the HMAC algorithm. People wouldn't just invent HMAC for fun, so it must have some advantages ...
1
vote
2answers
161 views

Why do I have to use multiple keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
22
votes
9answers
4k views

Is it helpful to have a captcha on a login screen?

I introduced recaptcha to the login screen of a system. My goal was all about security things like dictionary/bots attacks or other thing of that type. The users now hate it, Some did not even ...
2
votes
1answer
176 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
0
votes
2answers
104 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
4
votes
2answers
81 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
18
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
3
votes
1answer
132 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
0
votes
2answers
171 views

Are the Microsoft Windows images found on the internet safe?

Microsoft has stopped offering the Windows images for download. It is now only possible to get the image if one has a key of a retail version of the corresponding OS. The question is now, whether the ...
22
votes
2answers
21k views

Why does HTTP Basic authentication encode the username and password with base64?

RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64. To receive authorization, the client sends the userid and password, separated by a ...
0
votes
3answers
201 views

What is the most secure way to save user authentication: Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application. All of them will use really confidential ...
10
votes
4answers
2k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
7
votes
1answer
157 views

Using RSA-SHA as/instead HMAC in OpenVPN?

While reading the manual of OpenVPN 2.3, I came across the --auth alg option. The manual says: Authenticate packets with HMAC using message digest algorithm alg. (The default is SHA1 ). HMAC is a ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
1
vote
1answer
37 views

How to migrate users? (Changing the login system)

Let's say that you are about to change your log in system and you have a few millions of users that you want to switch to the new system. Specification Old System Username : email address Password ...
3
votes
5answers
111 views

Any security risks for the login authentication and change password on the same page?

I want to ask if there are any security risks for the login authentication and change password on the same page? Normally the user needs to authenticate first in order to see the password change ...
1
vote
1answer
123 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
1
vote
1answer
61 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
2
votes
2answers
59 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...