Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
0
votes
0answers
9 views
Is TextKey SMS 2 factor authentication secure against cell phone cloning?
I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods.
In typical SMS authentication, the provider sends you an access code ...
2
votes
2answers
64 views
Does providing OAuth for mobile apps pose a security threat?
Let's take a look at the basic OAuth workflow:
The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
5
votes
5answers
110 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
4
votes
3answers
131 views
How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?
Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account.
A ...
7
votes
4answers
209 views
Candidate authentication in large scale assessment
First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes.
We're ...
10
votes
5answers
414 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
3
votes
2answers
134 views
Login with a hash. Is this secure enough?
I need to provide store's clients with a tool to check the status of their repair orders.
The clients doesn't have a user or password. They are only a record in the database. Yet I need to give them a ...
1
vote
2answers
51 views
Force SSL/TLS client cert authentication even if server does not request it?
Usually the server specifies in the Server Hello message if a client certificate is needed/wanted.
Does anybody know if it is possible to perform an authentication via client cert if the server does ...
-1
votes
0answers
51 views
Which is the most popular one time password based authentication scheme? [closed]
Which is the most commonly used (popular) one time password based authentication scheme?
15
votes
6answers
847 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
3
votes
0answers
121 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
-3
votes
0answers
47 views
How to determine the sequence of ordering certificates by browser? [closed]
I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram:
----------
| ...
-4
votes
0answers
33 views
missing configuration in apache to achive mutual SSL authentcaion [closed]
After implementing a Mutual Certificate Authentication with OpenSSL and Apache Web Server on CentOS platform. I tried this scenario ( see this diagram ):
----------
...
139
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
4
votes
1answer
260 views
How to verify the authenticity of Facebook users?
While I was not surprised at all by Facebook stating that "8.7 percent of accounts belonging to its 955 million monthly active users are fake"; link is a news story that providers a summary of their ...
6
votes
2answers
172 views
Does prompting for security questions on new computers add any security on banking websites?
When you sign into Bank of America on a computer you haven't used with them before, the site prompts you to answer one of your security questions.
How exactly does this make the site more secure?
...
-9
votes
1answer
76 views
Can a cracked antivrus software do the job?
Some of my friends say that their cracked antivirus software updates regularly, and does the job as same as a legitimate software would do. Is this possible? How do they bypass the activation key ...
4
votes
3answers
196 views
Is it okay to sign a PGP key without an IRL meeting?
[PGP] can get paralyzed by excessive analness.
— Phil Zimmermann
Preamble
I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
0
votes
5answers
100 views
Should I enforce a password policy on a web site?
For a commercial web site, is it important to impose some restriction on passwords to access the system?
Eg. special $char, Upper and lower case, numbers, at least a minimum length...
Can a CAPTCHA ...
1
vote
0answers
76 views
How can I implement authentication in my proxy server?
I have a proxy server, it will have a captive portal page. Users will be required to sign in before gaining access to the internet.
So far I am aware of IP and/or MAC address based authentication.
...
4
votes
3answers
93 views
Man in the middle attacks for Out of band Authentication
I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows:
"In ...
1
vote
1answer
60 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
3
votes
1answer
152 views
How can Bank of America tell that I'm logging in on a computer I haven't used with them before?
When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
1
vote
1answer
114 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
24
votes
1answer
968 views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
-3
votes
1answer
33 views
NTP Autokey Authenticated Timeserver - Free and Public [closed]
I would like to use authenticated NTP. Are there any free autokey supported NTP servers available to the public?
5
votes
3answers
246 views
Why would a website allow answers to security questions to be used interchangeably?
I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are:
...
2
votes
1answer
67 views
Send credentials by sms [duplicate]
If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?
1
vote
0answers
36 views
How do you evaluate and audit Central Authentication Service (CAS)?
This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
2
votes
4answers
298 views
If someone steals my laptop while I'm logged in, how can I protect my browser?
My question has its roots in an xkcd from this week:
http://xkcd.com/1200/
Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I ...
2
votes
3answers
80 views
How good is validating source with request.referer than checksum?
I have 2 portals(both are under my control & domain names are different)
In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.
Link which will be hit in ...
13
votes
4answers
400 views
Effectiveness of Security Images
Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater?
Per my understanding, if somebody is phishing your users, it's ...
20
votes
2answers
602 views
How does Google Authenticator work?
Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent.
It works without any connectivity; it even works on plane mode. This ...
114
votes
7answers
18k views
CTRL+ALT+DEL Login - Rationale behind it?
Maybe a rather noobish question: Why is CTRL+ALT+DEL required at login on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a ...
0
votes
2answers
93 views
How to allow only the public key owner to submit requests to my site? And what is this type of security called?
This was probably asked many times here, but I'm not finding any because I'm not sure what to look for.
I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
5
votes
6answers
810 views
Prevent denial of service attacks against slow hashing functions?
I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
3
votes
1answer
299 views
Apple Developer Account Hacked?
I just did a fresh install of Snow Leopard on a newly-formatted hard drive.
Logged into the iPhone Developer Page with Google Chrome (latest build) here:
...
8
votes
1answer
177 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
3
votes
1answer
75 views
Are there any uses of having a non-deterministic salt value for hashes?
So I've been toying with the idea of having non-deterministic salt values for hashes.
Let me explain what I mean:
Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
10
votes
7answers
8k views
Can my email account be accessed without the password? How secure is it?
Can my email account be accessed without the password, and how secure is email if I store my personal documents on it?
And how come Yahoo Mail asks me to tell them my friends and folders names to ...
2
votes
4answers
233 views
Is it safe to allow users multiple login at different browsers & computers?
We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
6
votes
3answers
550 views
Is there any SQL injection for this PHP login example?
I want to write a login form, and I got one example from the web.
I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like?
This is ...
2
votes
1answer
54 views
Authenticating a ciphertext
what can be considered as a downside of authenticating a ciphertext?
For example, can we say drawback of authenticating a ciphertext is that we lose
repudiation, for example, we can't prove to the ...
7
votes
2answers
6k views
What is the difference between authorized_key and known_host file for SSH?
I am learning basics of SSH protocol. I am confused between the contents of the following 2 files:
~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
3
votes
2answers
124 views
Are there any serious problems with this method for generating single-use tokens?
I need your advice on the security of this design.
I have a scenario whereby a server application and a smart card application need to share a value e.g. 52, which has been encoded in a long decimal ...
1
vote
1answer
56 views
What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?
I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible.
On ...
4
votes
2answers
83 views
How Secure are Authenticity Token in Rails
I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
0
votes
1answer
120 views
Facebook Login for Intranet
How safe is Facebook Login? I'm currently building an intranet, for my small company. We're 10 employees, and no risk of them messing up from inside.
But is using Facebook Login safe for this? How ...
1
vote
0answers
73 views
Two-way authentication with google authentication app [migrated]
Can someone guide me on what I've done wrong with implementing Google authentication app?
Here is what I've tried without success:
1# Create secret key
$chars = ...
