Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

300
votes
20answers
51k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
211
votes
7answers
155k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
181
votes
18answers
13k views

Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
160
votes
7answers
27k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
78
votes
7answers
33k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
77
votes
3answers
11k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Or should ...
76
votes
11answers
9k views

“Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?

Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
67
votes
5answers
7k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
63
votes
3answers
19k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
61
votes
8answers
101k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
56
votes
7answers
40k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
55
votes
6answers
6k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
54
votes
13answers
8k views

Do we really need a long and complicated password for websites?

Most of websites that handle important information (Gmail, for instance) have some kind of brute force protection. Sometimes if you try more than X times it will lock the account or at least give you ...
53
votes
12answers
3k views

How do you log in from an unsecured computer?

Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
52
votes
10answers
13k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
50
votes
7answers
6k views

Are passwordless SSH logins more secure?

I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
47
votes
9answers
6k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
46
votes
4answers
11k views

Is posting from HTTP to HTTPS a bad practice?

Working on the assumption that SSL serves both to encrypt data and to provide assurance as to the identity and legitimacy of the website, should the practice of providing a logon form on a page ...
45
votes
4answers
34k views

What is the difference between an x.509 “client certificate” and a normal SSL certificate?

I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
44
votes
5answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
43
votes
1answer
5k views

How does a SIM card prevent cloning?

I have read a few articles about SIM cards, stating that the chip inside them uses some cryptographic magic to prevent people from cloning your number. This to me seems borderline impossible, given ...
41
votes
9answers
3k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
41
votes
3answers
43k views

Token-based authentication - Securing the token

I have developed a backend REST API for a mobile app and I am now looking to implement token-based authentication for it to avoid having to prompt the user to login on every run of the app. What I ...
41
votes
4answers
13k views

What is the use of a client nonce?

After reading Part I of Ross Anderson's book, Security Engineering, and clarifying some topics on Wikipedia, I came across the idea of Client Nonce (cnonce). Ross never mentions it in his book and I'm ...
40
votes
5answers
7k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
39
votes
6answers
11k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
38
votes
6answers
5k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
38
votes
2answers
5k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
38
votes
5answers
5k views

How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?

I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case. When I sign on to my online banking account, I'm prompted ...
37
votes
6answers
2k views

Is the concept of Authenticated Anonymity possible?

Or is authentication essentially incompatible with anonymity? If we have the idea that authentication is proving that someone is who they say they are and anonymity is essentially having an unknown ...
37
votes
4answers
6k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
37
votes
1answer
2k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
35
votes
11answers
5k views

Sending passwords to someone remotely

As someone who usually works with people in other countries it has always been a problem to send login information to each-other. For development login details like debug databases etc sure I can ...
35
votes
5answers
5k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
33
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
32
votes
9answers
2k views

Use additional “password” in Referer to hide private site?

I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at example.com, ...
32
votes
2answers
2k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
31
votes
7answers
6k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
30
votes
5answers
2k views

What are the security implications of storing password blacklist?

I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
30
votes
3answers
56k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
29
votes
4answers
3k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
29
votes
2answers
10k views

HMAC - Why not HMAC for password storage?

Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. Let's say ...
28
votes
4answers
26k views

How do I secure my REST API?

In Detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
27
votes
3answers
3k views

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. ...
27
votes
3answers
872 views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
27
votes
5answers
4k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
27
votes
7answers
2k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
27
votes
2answers
7k views

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
26
votes
4answers
15k views

How to achieve non-repudiation?

If I have a message that I need to send to another person, how do I achieve non repudiation ? Is digitally signing the message sufficient ?
26
votes
8answers
2k views

Share certain information only after death

After your death, you want to make sure that a special someone gets a vital piece of information (like the password to your bank account), but: You don't want anyone else to be able to get that ...