Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
25 views

Is this really 2-factor authentication?

We have a requirement for 2-factor authentication for our internal WiFi SSID's. Currently we use PEAP w/ MS-CHAPv2 to pass windows creds through the AP to a RADIUS server (A Domain Controller running ...
7
votes
3answers
373 views
+50

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
0
votes
3answers
50 views

User Account Guessing

i'm doing some research on user account guessing and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and security. ...
0
votes
1answer
13 views

Secure automatic authentication to samba share

I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has ...
178
votes
18answers
11k views

Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
1
vote
1answer
77 views

Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used. Some options came to my mind: Store the password ...
36
votes
1answer
3k views

How does a SIM card prevent cloning?

I have read a few articles about SIM cards, stating that the chip inside them uses some cryptographic magic to prevent people from cloning your number. This to me seems borderline impossible, given ...
1
vote
0answers
20 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
1
vote
1answer
28 views

Server + Client certificate vs Server certificate + Client password

There are three different ways how TLS (1.2) can be used: server and client authenticate, only the server authenticates or neither authenticates. If neither server nor client authenticates using a ...
1
vote
1answer
38 views

Auth / Login token schema

According to this answer, a valid login token schema would consist of the username (U) the time of issuance (T) and secret key K owned by the server only The suggestion then is to concatenate the ...
-2
votes
0answers
31 views

Restrict a user to SSH authentication with a key [migrated]

Is there any possibility to restrict the password based authentication to a particular user in Solaris 10? The particular user should not log in with a password. Instead he should be able to log in ...
0
votes
1answer
48 views

How can LastPass enforce 2-factor authentication

I've recently started using LastPass and one of the things you can set as a policy for you password vault is Prevent offline access when using Google Authenticator. The local cache can be ...
0
votes
1answer
31 views

Better way to store user authentication on phone app

We are creating an app and registration of user happens in following way. User sends via app: email-id/phone and username. Server sends a pin to enter in app via phone/email. User enters the pin in ...
3
votes
3answers
594 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
3
votes
3answers
136 views

What are the (practical) dangers of writing your own login method?

I have always been told that writing your own login method (e.g. validate user given the username and password) is bad practice, and that one should reuse existing libraries for that. I have always ...
5
votes
2answers
656 views

Website: Pre-Shared-Key Authentication

We have this web-application with high valuable (business) data. All communication is encrypted through TLS/SSL. While I consider this a really safe protocol, it can still be compromised if someone ...
6
votes
1answer
80 views

4 bytes authentication problem

I have a classic security problem where Alice needs to prove its identity to Bob but with quite unusual requirements and constraints due to a M2M context. EDITs in bold The communication channel ...
0
votes
1answer
83 views

security in banking app with 4 digit pin code and social security number

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
2
votes
0answers
34 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
0
votes
2answers
43 views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
0
votes
2answers
69 views

Encryption mechanism

I want to send data over the Internet securely. For that, I am using an public key of the receiver to encrypt the data. In this case, if an intruder in the network modifies the data, like placing the ...
0
votes
0answers
21 views

OAuth2 - Resource Owner Password Credentials grant

The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
1
vote
5answers
242 views

Secure login feature with low CPU power

I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
0
votes
0answers
23 views

Secure access of web application on a newly created AWS instance using the associated keypair

I create an AWS instance using a private AMI (Linux) with an embedded web application (Jetty) which is activated on instance start. As soon as the instance is launched first time, I want the ...
3
votes
1answer
183 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
0
votes
1answer
73 views

Single sign on - is this a secure way to log in?

I am fiddling about with a sort of single sign on procedure. Let's say there is site1 and site2 and both use an SSL certificate. Users are signed in on site1. I was wondering what the experts think ...
21
votes
3answers
2k views

How is Google Chrome managing authentication to sites?

In Chrome, every tab is its own process. Yet, logging in to a site, say, Facebook, persists across tabs. For that matter, in many cases, it persists across OS reboots. This seems inherently very very ...
2
votes
1answer
111 views

Is it legal to “use” security vulnerabilities [closed]

I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are. Heres the case: I found a security hole in one of ...
4
votes
2answers
118 views

Safety of using online proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a php webpage controlled by me containing sensitive data over https. How would i make sure that the proxy ...
-3
votes
0answers
22 views

IBM TAM and Webseal for securing web applications [closed]

I have to evaluate which are the best Products to secure numerous web applications that are running in an Organization. I also need to enable SSO for them. The two products that I am considering are ...
0
votes
2answers
312 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
1
vote
1answer
53 views

Web app with iframe and user - how to deal with session?

We have application which will be in iframe. Partner sites can use our application - put iframe in their sites. Partner site has users with money, who will use our application in iframe to buy items. ...
-1
votes
0answers
21 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
26
votes
4answers
19k views

How do I secure my REST API?

In Detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
2
votes
0answers
27 views

WiFi deauthentication issue [migrated]

I would like to find a root of the WiFi issue we've got in our working environment. Few words about WiFi infrastructure We are using now Apple solution. Three brand-new access points from Apple ...
177
votes
7answers
126k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
3
votes
2answers
134 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
2
votes
1answer
245 views

How authentication using md5 works in this ospf example?

I am trying to understand how md5 authentication works between this 2 cisco routers. The password is cisco in both routers. In the output in the field Auth Data: the hash is different in every packet. ...
2
votes
1answer
71 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
5
votes
2answers
127 views

How can I enable opportunistic encryption for my web-site?

As per an honourable mention in an answer for « Why self-signed https is less trustworthy than unencrypted http? », it appears that there are already two post-Snowden drafts that have to ...
2
votes
1answer
117 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
1
vote
2answers
330 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
5
votes
2answers
391 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
0
votes
1answer
78 views

What is a AUTH-KEY in the security of the computers?

I don't know if this is the right section to post my question and if it is not I apologize. I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL ...
1
vote
2answers
41 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
65
votes
5answers
6k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
1
vote
1answer
117 views

Why use an authentication token instead of the username/password per request?

The author of http://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
1
vote
3answers
238 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Several systems rely on using UID of smart card for identification/authorization. For example database stores list of smart card UIDs and corresponding privileges. Given that today there exist cards ...
2
votes
1answer
114 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
3
votes
2answers
139 views

How to prove flyer was (not) authored by specific person?

Let's say we create a flyer in some desktop publishing software (e.g., InDesign, Illustrator), physically print it and post it somewhere. We don't want inauthentic claims of authorship. Is there a ...