Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
20
votes
4answers
1k views
How is “something you have” typically defined for “two-factor” authentication?
A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
198
votes
16answers
19k views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
31
votes
2answers
3k views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
26
votes
5answers
4k views
How hard is it to intercept SMS (two-factor authentication)?
A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
20
votes
9answers
1k views
How can I ensure that I connect to the right wireless Access Point?
Under Windows/Linux, client side. How can I ensure that I'm not connecting to a rogue AP?
Thank you!
15
votes
3answers
2k views
Should I have a maximum password length?
I'm creating a webapp, and part of my authentication method is password length.
Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6).
Are there ...
13
votes
4answers
400 views
Effectiveness of Security Images
Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater?
Per my understanding, if somebody is phishing your users, it's ...
30
votes
7answers
20k views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
34
votes
7answers
9k views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
35
votes
5answers
2k views
Do security questions subvert passwords?
Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
23
votes
5answers
2k views
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case.
When I sign on to my online banking account, I'm prompted ...
21
votes
4answers
5k views
How to achieve non-repudiation?
If I have a message that I need to send to another person, how do I achieve non repudiation ?
Is digitally signing the message sufficient ?
7
votes
2answers
444 views
Any advantage to securing WiFi with a PSK, other than to keep out unauthorized
As I understand WiFi with a PSK, such as WPA(2)-PSK or WEP, anyone on the same network can decrypt anyone elses packets because everybody has the same key.
In which case, if you are not going to ...
10
votes
2answers
367 views
Is it a bad idea for an information holder to e-mail a user their password?
A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
24
votes
5answers
2k views
How to Securely Implement a “Remember Me” Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
22
votes
2answers
3k views
I just send username and password over https. Is this ok?
When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
11
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
17
votes
8answers
739 views
How to protect against brute forcing
How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...
12
votes
9answers
656 views
Anybody have additional information on the EMC RSA SecurID compromise?
The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
12
votes
5answers
976 views
How should passwords be stored if they must be recoverable?
By "encrypting" passwords you are violating CWE-257: Storing Passwords in a Recoverable Format. But this is exactly what the French government wants. They want to be able to obtain the passwords of ...
5
votes
3answers
243 views
How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?
I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.)
I have a 20+ digit password, however there's apparently a new requirement for Microsoft ...
11
votes
4answers
2k views
Google Account: implications of using application-specific passwords
In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
4
votes
2answers
1k views
Reference implementation of C# password hashing and verification
Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java?
Ideally,I'd like to see something that includes a ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
3
votes
5answers
235 views
Preventing online voter fraud
As part of a promotional campaign, my company wants to launch a site where users (and potential users) of our product will be required to register and vote for certain choices. Depending on how ...
41
votes
5answers
10k views
Certificate based authentication vs Username and Password authentication
What are the advantages and drawbacks of the certificate based authentication over username and password authentication?
I know some, but I would appreciate a structured and detailed answer.
UPDATE
...
72
votes
3answers
43k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
27
votes
4answers
5k views
What is the use of a client nonce?
After reading Part I of Ross Anderson's book, Security Engineering, and clarifying some topics on Wikipedia, I came across the idea of Client Nonce (cnonce). Ross never mentions it in his book and I'm ...
28
votes
4answers
13k views
What is the difference between an x.509 “client certificate” and a normal SSL certificate?
I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
26
votes
9answers
2k views
Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
19
votes
7answers
2k views
How to prevent cheating (extra votes) in online contests?
Mitigating Cheating & Voter Fraud in Online Contests…
We run online contests of various sorts that involve users voting on entries (usually one vote per user per day). The prizes range from ...
12
votes
3answers
1k views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
18
votes
6answers
793 views
How to secure a WiFi network?
What do I have to do to secure a WiFi network? Is there any best practices?
I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
21
votes
9answers
1k views
Why do some people really hate security via client-side?
For instance, lets look at a common login system for a website
HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
...
14
votes
7answers
688 views
If I include a Forgot Password service, then what's the point of using a password?
I've implemented a Forgot Password service in the following way:
User goes to login page, clicks on "Forgot password?"
User is presented with a form that asks for their email address.
Email is sent ...
7
votes
6answers
1k views
Is denying login after incorrect attempts ineffective?
Generally denying logon attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicous logon attempts.
Yet, surely doing this is ...
6
votes
4answers
2k views
Difference between authentication and identification [Crypto and Security perspective]
I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification.
...
4
votes
1answer
469 views
Blackberry + RIM Bluetooth-based Smart Card Reader
Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it?
Can you tell me if it's possible to require only the presence of the card + card ...
24
votes
1answer
965 views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
13
votes
6answers
674 views
Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements).
Currently, password requirements are:
Must contain 3 of: lower case ...
11
votes
2answers
925 views
Encryption strategies for multi users access in production systems
I am pretty unknown to encryption strategies in production environments. So my concern is to find a solution how to strongly encrypt data, but make it available to multiple users with different keys.
...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
7
votes
2answers
6k views
What is the difference between authorized_key and known_host file for SSH?
I am learning basics of SSH protocol. I am confused between the contents of the following 2 files:
~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
6
votes
1answer
382 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
5
votes
1answer
1k views
Does NIST really recommend PBKDF2 for password hashing?
We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
5
votes
6answers
799 views
Prevent denial of service attacks against slow hashing functions?
I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
5
votes
2answers
484 views
ssh public/private key pair
I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
3
votes
6answers
444 views
Sharing passwords and credentials between founders and employees
What's the best way to share passwords and credentials from the business's various accounts in a secure manner?
For example, email doesn't work because if someone gets into one of your employee's ...
19
votes
3answers
811 views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
