Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
6
votes
5answers
495 views
Should a closed source website keep a secret key in its source?
Various APIs (such as Facebook or Amazon S3) require a secret key to authenticate access to the service. Obviously, if source code is public, the key should not be in the source! What about for a ...
2
votes
1answer
195 views
Is 90 day expiration for unique URL too long?
A web application I've been developing has a new use case that has me searching for something easier than username/password authentication.
Current users don't sign up for the service themselves ...
2
votes
1answer
379 views
Token Based Authentication & Pass-the-hash Attacks
Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
6
votes
1answer
384 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
6
votes
2answers
144 views
role based site security - the nuclear missile condition
So I'm in the process of working on part of our new role based site security system and have come up to the "nuclear missile" condition.
The system is based around the idea of grouping, with the ...
6
votes
4answers
2k views
Difference between authentication and identification [Crypto and Security perspective]
I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification.
...
6
votes
3answers
224 views
What is the most secure way to lock a Linux Distros Desktop?
So it's an everyday thing... people don't want to turn off their computer while their going out to the toilet..., etc. So they hit "ALT+CTRL+L", and the GNOME-screensaver locks their Desktop. After ...
1
vote
1answer
458 views
How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?
I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
2
votes
2answers
239 views
Restrict user login to a specific machine
How do you restrict user access to a corporate web site to a particular machine ?
including the following conditions :
Each user is meant to use his credentials ONLY from the assigned machine.
The ...
3
votes
4answers
375 views
Is this non-cookie based session scheme horribly vulnerable to some attack?
I am working on a large web application that runs entirely within a single web-page. For various reasons we do not want to use cookies in this web application, at all, but we need to keep track of ...
3
votes
1answer
215 views
How many authentication factors are there?
The three classes that we all know and love:
Something you know.
Something you have.
Something you are.
I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
8
votes
8answers
849 views
Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
I don't know why do we authenticate by prompting the user to enter both username and password.
In my mental model, prompting password only suffices.
The reason is as follows:
Assume there are x ...
4
votes
1answer
122 views
Should you have full account access when you forget your password?
Imagine the following scenario:
I go to login to MyApp.com, but realized that I forgot my password.
I request a new password sent to my email.
The email arrives with a link to change the password ...
7
votes
4answers
392 views
Is using a flash drive as a base for security a safe thing to do?
I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
9
votes
5answers
823 views
How can I securely authenticate the client application sending me data?
We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
3
votes
1answer
233 views
Security for a low latency online multiplayer game
I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
4
votes
2answers
593 views
P3P HTTP Headers and Session ID's
Is there any chance that Session ID's can be shared between different websites (one in other IFRAME of others) through P3P Headers?
-1
votes
1answer
348 views
IIS won't forward the logged on user credential to webservice request?
Ive enabled Windows authentication in my IIS.
for the sample lets assume my Active directory username is \domain\John
My task flow is like that :
Iis won't forward the loged on user credential ...
1
vote
3answers
288 views
Three Message Authentication Protocol
I have a protocol where "A" initiates communication with "B". "B" then sends a challenge to check if "A" is really "A". "B" does not remember sending the challenge so "A" has to respond by sending the ...
5
votes
2answers
177 views
How should hospitals handle the use of sharing credentials to access sensitive information, especially in critical situations?
Most organizations today hold individuals accountable for their actions on systems and networks by unique user IDs and passwords. However, imagine working in a hospital environment where access to ...
1
vote
1answer
189 views
What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?
I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
8
votes
4answers
345 views
Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?
This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
5
votes
2answers
204 views
System for Mutual authenticaion and confidentiality
I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
3
votes
1answer
223 views
How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?
I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
5
votes
1answer
282 views
OpenPGP Encryption / Decryption Process Using GnuPG
I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
6
votes
2answers
445 views
How do I log everything a certain program is doing?
i have a program which is pretty simple.
Its just a simple login form.
Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
2
votes
1answer
65 views
Is there a drawback for local log in compared to server log in?
For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have ...
4
votes
2answers
365 views
What flaws lie behind HttpContext.Current object i .NET?
I'm into extend a authenticating service and like to ask about the security perspective of HttpContext.Current. Let say you have a authentication serve websites / wcf and such (where http is ...
5
votes
3answers
1k views
Bell-LaPadula imlementation example
I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example.
I understand how the model works, but I have difficulties implementing it in a programming language ...
5
votes
3answers
602 views
Why banking websites always ask me to authenticate my PC even after I'd chosen to “Remember my Computer”?
Why banking websites always ask me to authenticate my PC even after I'd chosen to Remember my PC? This is the case with all banking websites
6
votes
3answers
160 views
Is there any conceivable reason to prevent a password change in an authentication system?
I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
34
votes
4answers
6k views
Is posting from HTTP to HTTPS a bad practice?
Working on the assumption that SSL serves both to encrypt data and to provide assurance as to the identity and legitimacy of the website, should the practice of providing a logon form on a page ...
18
votes
3answers
342 views
Isn't openid with http an issue?
Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com).
Does this pose a threat beside the identity being exposed? The second step of ...
3
votes
1answer
89 views
What are the implications of omitting the username in Secure Remote Password's verifier?
I consider implementing a Secure Remote Password (SRP-6a) verifier that omits the username from the x key hash. The intention is to allow authentication with multiple alternate user identifiers such ...
4
votes
1answer
432 views
Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?
I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
3
votes
0answers
260 views
When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]
I am trying to secure my application which is built using JSF2.0.
I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
5
votes
3answers
163 views
Should we be checking password restraints on log in forms?
We have many restraints we put on users when they set up their password. These restraints include password length, characters they can or cannot use, the use of numbers and letters, capitalization ...
23
votes
5answers
2k views
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case.
When I sign on to my online banking account, I'm prompted ...
11
votes
5answers
638 views
Good session practices
What are some good practices for ensuring logins, session IDs and session content are secure for a website?
3
votes
2answers
843 views
How do Azure ACS 2.0 security features compare to ADFS 2.0?
I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0.
ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...
0
votes
0answers
188 views
Authentication Protocol Survey [closed]
I am researching an appropriate authentication protocol for a system I am working on. While I have found a list of authentication protocols on Wikipedia, the list does not describe ...
31
votes
2answers
3k views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
10
votes
3answers
1k views
Computationally simple, lightweight replacement for SSL/TLS
Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
1
vote
1answer
194 views
What risk can untrusted WS-Federation metadata pose?
I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk.
Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the ...
5
votes
2answers
333 views
How can I authenticate a client connection in a secure way?
Let's say I have a server listening on port 1234. I have some client software that needs to be able to connect to this port. But I want to prevent malicious users from bypassing the client software ...
9
votes
3answers
407 views
Multiple CAs signing a single Cert/CSR?
Just saw this suggested on Slashdot
So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
2
votes
1answer
547 views
“Extended Protection” primer and implementation guide to prevent MITM
Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks.
Does anyone have a primer (or explanation in plain English) what this feature is, ...
3
votes
3answers
311 views
storing the third party credentials in the database/some secure place
This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user.
Our system connect to the third party system using ...
6
votes
3answers
148 views
Requiring Authentication to Exit
I've often wondered why facilities do not require authentication as a default on exit. Beyond the oblivious reasons:
Fire safety policies would require a panic mechanism to override the access ...
8
votes
2answers
480 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
