Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

16
votes
4answers
8k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
4
votes
1answer
483 views

How is JWT implemented?

I'm using django-rest-framework-jwt in one of my APIs. As you might know, the concept is simple: you send username and password and you get a token back. The token is not stored anywhere on the ...
4
votes
1answer
984 views

Randomly generated token vs JSON web token

I'm trying to secure access to my web server. I have been implementing a JSON web token authentication where I randomly generate a secretkey and associate it with that user. The secretkey will then ...
1
vote
0answers
146 views

Peer Entity Authentication and Data Origin Authentication services in OSI layers

What kind of Peer Entity Authentication and Data Origin Authentication services are provided in network layer(L3), Transport layer(L4) and application layer(L7) ?
2
votes
4answers
138 views

What is the risk of different responses when a login username matches or not?

I am responsible for a website that allows a user to reset the password, as usual. However, the response of the website is different whether the entered username matches or not. This would allow an ...
4
votes
2answers
128 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
2
votes
1answer
98 views

Why is the 2nd step in two-step authentication not a single click? [closed]

The case I'm using Google 2-Step Verification. The question Why does Google use a code as second step? Why not just an android app where you can click "It's me"?
3
votes
2answers
169 views

How to 'pair' a client/server application securely?

Please forgive me if my question is a rephrasing of a common problem, but I am not sure what to search for! My use-case is a client-server program. The server runs on a user's PC and the client runs ...
7
votes
1answer
217 views

“Fix” man in the middle

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good ...
1
vote
4answers
2k views

Log in with email is more secure than a username?

Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
6
votes
7answers
1k views

How do I secure my login page?

The login page is the starting point to any web site and the most important thing to authenticate the user. When I begin to build any web application, I take a lot of time to think about how to ...
2
votes
0answers
50 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
1
vote
0answers
42 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
1
vote
1answer
99 views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
3
votes
1answer
261 views

Would this work to protect a cookie with an OAuth token?

I'm currently trying to set up an OAuth 2.0 authentication scheme to protect some stateless REST webservices. These services deal with sensitive information, and the OAuth support is a requirement. ...
1
vote
0answers
25 views

Authenticating requests across a two tier application architecture

Consider the following architecture: Users log into a website and issue commands to the website. In parallel, separate software processes ("agents") on different computers connect to the website ...
2
votes
3answers
329 views

Someone shared their google account with me, am I vulnerable?

Recently a friend gave me the credentials to his Google account (GMail and password), so I could check his email while he was on a trip (with no cell signal). He is a trusted friend and not ...
0
votes
1answer
7k views

3 or 4 characters long username from security point of view

I have on my site the ability for the user to choose his/her username that is 4-20 characters long. But some users could have names like "Amy" "Eva", "Ian" etc. Should I stick with 4 letters or go ...
3
votes
3answers
467 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
6
votes
1answer
118 views

Do any systems implement a Duress Code?

We've seen it in the movies. A spy or important government agent uses a pre-determined authentication word to not only prove who they are, but also that they are in danger. I have not seen it ...
6
votes
0answers
83 views

How the AWS signature works in depth

I'm trying to understand how the AWS signature 4 works. I read the docs and I found the Python example where a signature is computed ...
1
vote
1answer
467 views

What are WiFi certificates used for? What are they?

Recently my university updated the certificates for authenticating on their WiFi network. I was hesitant to accept it because I wasn't sure what accepting it entailed or even what it was and what ...
3
votes
1answer
100 views

Challenge Response with a Tan Book?

i am trying to secure a connection between a Mobile Device (Client) using a webApp and a Home Device (Server) in a potentially unsafe Wifi Network. The communication is asynchronous and i am trying ...
2
votes
2answers
100 views

my bruteforce prevention has major downsides - any ideas?

I'm currently searching for the best way to prevent my software's webportal from bruteforce attacks and came up with the following idea: 3 login attempts without any visual challenge after 3 failed ...
3
votes
1answer
51 views

secure user authertication

Here : Help understanding basic user authentication with salts and hashing They explain it pretty well, but i'm still struggling to understand this one part... Now, when a user comes to log in ...
1
vote
0answers
43 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
5
votes
3answers
170 views

How to prevent a prophecy from becoming self-fulfilling or self-defeating

Let's assume that I have deduced with a high probability what a certain famous person or organization will choose to do at a near-future date. How can I publish any proof of me having deduced this? ...
2
votes
0answers
258 views

NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?

Hi i saw a few threads about NFC NTAG against cloning and NTAG Desfire , i just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
1
vote
2answers
65 views

Authentication without registration

Let S be a server and C be a mobile client (iOS/Android App). Assume that the communication between S and C is ciphered with SSL (or any other standard protocol). The system is a voting application, ...
0
votes
0answers
28 views

Persona combined with stateless token authentication

My REST-Backend is using Mozilla Persona to authenticate users. Normally you would just use cookies to authenticate any further requests but I want to use token based authentication (out of personal ...
0
votes
2answers
96 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
34
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
0
votes
1answer
100 views

Pros and cons of security images [duplicate]

Over the past year or so, I've noticed that all of the banking organizations I work with that have or had "security images" as part of their login process have removed or are planning to remove that ...
2
votes
2answers
136 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
2
votes
1answer
97 views

What reasons are there to not just send the API key as an HTTP header over HTTPS?

I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
1
vote
1answer
64 views

Encryption strategies for multi users access revisited

This is a follow up to this post: Encryption strategies for multi users access in production systems I don't see how this can work given the second bullet point: Kc is stored on the computer n ...
0
votes
2answers
3k views

Security benefits of Single Sign-On [duplicate]

What are the benefits of a single sign-on implementation from the point of view of security? From my point of view, if the account is compromised the attacker has access to any resource, so ...
0
votes
0answers
57 views

Bluetooth LE 4.0 security issues [duplicate]

How does BLE secure communications between devices? BLE 4.0 supports AES128, and the key exchange is done using DH. However, it is often reported that BLE 4.0 has security issues. What specifically ...
0
votes
1answer
65 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
8
votes
3answers
286 views

What advantage does the Bloomberg authentication system have over traditional 2 factor?

Bloomberg clients have an interesting way to authenticate to the server. This seems involve some of the following: Logging into a secure website, that displays a flashing square Swiping your finger ...
3
votes
3answers
432 views

Message Authentication Codes (MACs)

What is the main difference between Message Authentication Codes (MACs) and hash function? Is there any difference regarding their usage domains?
1
vote
2answers
433 views

Storing Seed for TOTP

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
2
votes
0answers
71 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
5answers
6k views

Does using WPA2-Enterprise just change the attack model vs WPA2-PSK?

As far as I can tell based on the reading I've done so far, WPA2-Enterprise uses the same encryption and security algorithms and methods as WPA2-PSK, with the addition of using another service for ...
7
votes
5answers
5k views

Is there a reason to protect SIM with PIN?

If the phone would be stolen then the SIM card will be thrown out by thieves just after the theft so that they can't be found. If the phone would be lost then it will be harder to find an owner for ...
20
votes
8answers
9k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
4
votes
3answers
212 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
1
vote
2answers
171 views

Questions about user authentication over REST API

I'm now trying to implement user authentication on my android app. I, however, have a few questions. I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
0
votes
1answer
198 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
2
votes
0answers
74 views

Zero Knowledge Proof Password Systems

I am wondering if there is a practical zero-knowledge proof system that can be used by humans to authenticate themselves to a server. Note that even the computer can not be trusted (at least with the ...