Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
1answer
112 views

Are there any uses of having a non-deterministic salt value for hashes?

So I've been toying with the idea of having non-deterministic salt values for hashes. Let me explain what I mean: Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
2
votes
4answers
2k views

Is it safe to allow users multiple login at different browsers & computers?

We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
2
votes
1answer
80 views

Authenticating a ciphertext

what can be considered as a downside of authenticating a ciphertext? For example, can we say drawback of authenticating a ciphertext is that we lose repudiation, for example, we can't prove to the ...
3
votes
2answers
183 views

Are there any serious problems with this method for generating single-use tokens?

I need your advice on the security of this design. I have a scenario whereby a server application and a smart card application need to share a value e.g. 52, which has been encoded in a long decimal ...
1
vote
1answer
129 views

What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?

I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible. On ...
4
votes
2answers
418 views

How Secure are Authenticity Token in Rails

I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
0
votes
1answer
264 views

Facebook Login for Intranet

How safe is Facebook Login? I'm currently building an intranet, for my small company. We're 10 employees, and no risk of them messing up from inside. But is using Facebook Login safe for this? How ...
6
votes
3answers
176 views

Is there any sense in using two-step authentication for personal email address?

There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
7
votes
3answers
4k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
5
votes
1answer
125 views

Authentication concept for sites served to another site

We are going to serve content to a Content Management System that embeds it through an iframe (yuck). Some pages that we serve need to be authenticated before – only a valid user should be able to see ...
2
votes
1answer
178 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
7
votes
3answers
800 views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
3
votes
3answers
462 views

Secure login system - using sessions?

I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this: <?php session_start(); if (validPass() || isset($_SESSION['userId'])) { ...
1
vote
1answer
173 views

Best practice for securing user credentials once they reach the server using Basic Auth + SSL

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
2
votes
2answers
103 views

Client code tampering detection

I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
-3
votes
1answer
47 views

What is the notion challenge in authetication? [closed]

Can someone help me what is a challenge in authentication wordbook?
1
vote
1answer
233 views

Basic Authentication with WebAPI and HTML/JS Client?

I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
5
votes
6answers
652 views

What's the most secure technique for authenticating user in a website?

I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
0
votes
1answer
137 views

What rules should be enforced for users to create a strong password?

I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best ...
1
vote
1answer
211 views

How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA

I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
6
votes
3answers
246 views

What is the value in asking for a second password for sensitive operations?

When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions? Does it provide any benefit over ...
5
votes
1answer
2k views

Facebook page receiving improbable amount of likes from unknown users

A bit of an odd problem, but I'm not totally sure where to post this. I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
1
vote
1answer
377 views

What is the origin of the three factors of authentication?

The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
1
vote
3answers
2k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
2
votes
1answer
280 views

When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?

When displaying a page with content only logged in users should see, I simply check if(isset($_SESSION['hasLoggedIn'])) { //show content } else { echo 'you must log in'; } In this article it ...
5
votes
5answers
458 views

Should an invalid user name be logged?

While authenticating, should attempts with invalid user names be logged? OWASP Logging Cheat Sheet says that authentication failures must always be logged. I can observe several programs doing this, ...
2
votes
2answers
356 views

Looking for general guidance on securing web API application for client applications and users

I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization. After a lot of googling ...
6
votes
2answers
304 views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
4
votes
1answer
1k views

Drawbacks of storing an authentication token on the client side?

I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
10
votes
2answers
219 views

Preventing Voter Fraud on a Social Media Contest

I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
4
votes
3answers
181 views

jasypt message integrity

I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are use a high level library. don't use ECB use a HMAC to ...
3
votes
2answers
83 views

Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?

CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service: Service A makes a request to Service B on behalf of a ...
4
votes
1answer
639 views

How secure is Integrated Windows Authentication for IIS SMTP?

I have a Windows SMTP server that is currently allowing the "AUTH LOGIN" method of authenticating. As I now know, this is simply a base-64 encoding of the username and password, which is basically as ...
0
votes
2answers
585 views

How to completely password protect login into Ubuntu 12.10?

I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite ...
6
votes
2answers
185 views

Limiting the root certificate chain

I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
3
votes
2answers
311 views

Is Yahoo SignIn Seal effective at phishing prevention? [duplicate]

Possible Duplicate: Effectiveness of Security Images Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on ...
6
votes
4answers
437 views

Banking application login leaks information

My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows: User visits the homepage of the bank. User ...
26
votes
3answers
780 views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
1
vote
1answer
409 views

Browser cache, cookies, active logins and other data

This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure. I'm seeking to know how secure it is to let the ...
7
votes
1answer
1k views

What possible use does an iFrame have for security?

I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password. But just before the end </table> tag there's a blank iFrame which ...
1
vote
1answer
91 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
3
votes
1answer
5k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
2
votes
4answers
1k views

Why do APIs use API Keys instead of Usernames?

It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
3
votes
2answers
7k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
4
votes
1answer
1k views

Comparing the standard HTML form POST for user authentication vs Javascript/AJAX

Are there any security implications with POSTing a authentication request with the use of javascript/ajax, as opposed to POSTing an HTML element by pressing the submit button? thus <form ...
2
votes
1answer
604 views

Web service HMAC authentication/anti-replay

I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows: ...
5
votes
2answers
501 views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
4
votes
2answers
365 views

user authentication by decrypting a random blob

Normal user authentication is done by comparing "hash"-values. A simple example of this: The user password is hashed with PBKDF2 on the client using a salt (the salt is the hash of the user password ...
3
votes
4answers
548 views

FireFox's restore previous session restores logins authenticated by server's sessions

In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
3
votes
3answers
940 views

How to use USB-Stick instead of passphrase?

I wanted to know if something exists that would allow the following. Whenever I use my RSA key(when using ssh for example) I'm prompted for my passphrase. I would like to, instead of being prompted ...