Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

4
votes
1answer
130 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
1
vote
2answers
207 views

LastPass login security

If LastPass does not store your master password, then how can you login to use their web app? Surely you must type it in, it is sent over using SSL, and then salted/hashed on the server-side, and ...
11
votes
2answers
1k views

Does having 2-factor authentication help with HeartBleed?

I was talking with a friend about HeartBleed, and he mentioned that he had 2-factor authentication enabled on all the sites that supported it, so even with his username and passwords, nobody would be ...
1
vote
0answers
152 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
0
votes
1answer
89 views

is there any 100% secure way for form authentication and sending information from client side to server side over internet pages? [closed]

i think for acquiring 100 % secure data transfer between forms on client side and c# code on server side ? my tools : i use IIS as my server and i wonder how can i reach for latest security that ...
9
votes
6answers
1k views

What methods can be used to prevent mistyped usernames?

I wanted to log on to my account on my bank's website. The account is protected by a number of security checks. The first one is what really amounts to a username, a confidential one. It's an 8-digit ...
2
votes
4answers
3k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
-4
votes
1answer
119 views

Using same CSRF Token for Multiple account creation [closed]

While Pentesting through some sites i found that an Multiple account's can be created using same CSRF token which should not allowed.I want to place two scenario's to describe my question. Scenario ...
8
votes
3answers
13k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
1
vote
2answers
132 views

How can I analyze password recovery tokens?

All websites that support authenticated user interactions have a password recovery feature. Usually they will email the password reset link through which you can easily recover your account by typing ...
1
vote
1answer
517 views

Hashing the cookie token for persistent login

In a login system I'm doing, I'm using a per-user, per-device randomly generated cookie token. A part of the script looks like this: // Generate current device's token $token = ...
1
vote
0answers
325 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
27
votes
3answers
3k views

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. ...
0
votes
1answer
215 views

Can I use 2 factor authentication for shared accounts?

Is it possible to use SecurID 2FA for Highly Privileged shared accounts? I am currently using CyberArk to vault passwords for privileged accounts. when I checkout a password, I would like to make sure ...
2
votes
1answer
300 views

How to use TPM to perform platform authentication?

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the ...
1
vote
0answers
214 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
4answers
389 views

Is there a way to keep sudoers from editing stuff in /etc/ssh/sshd_config?

I have root login disabled in SSH and I want to be able to eliminate the possibility of a sudo user editing the /etc/ssh/sshd_config file and enabling root ssh login. Is this possible?
1
vote
2answers
93 views

Hardware-restricted root login

I was thinking about how security on my Linux server can be increased and came up with this question: If most intrusions are performed by gaining remote access to machines, would it be possible and ...
3
votes
1answer
495 views

Securing mobile app rest requests

I am using Facebook login in a mobile native app, and I'm trying to figure out if my approach is secure enough. This is the flow (all communication is made over SSL): User logins to Facebook ...
1
vote
1answer
294 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...
1
vote
0answers
54 views

How exactly are physically unclonable functions used in authenticaton if they are unclonable?

There is ongoing and quite promising research with prototypes presented about using physically unclonable functions (PUFs) in authentication. If they are practically unclonable, how is a PUF-based ...
2
votes
4answers
424 views

How does a system authenticate a user using a hash function, after it has been salted?

I don't really understand how salting works. I read the Wikipedia article, but I still don't understand how can a system authenticate a salted hash? Let's say a user chooses a password. It's randomly ...
1
vote
1answer
94 views

MySQL authentication, how to pad the 20-byte salt

Im authenticating with a mysql server with the authentication method listed here. I observed the salt and hash using wireshark, and I know the password, but I am having trouble reproducing the hash I ...
1
vote
2answers
369 views

SSL/TLS : Authentication mechanism

I have these doubts regarding authentication in SSL/TLS : Will there be an authentication involved for all SSL connections ? For eg. when I browse the internet, using the most up-to-date browser, ...
9
votes
3answers
1k views

Length of CSRF Token

Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
3
votes
4answers
2k views

Can one connect to wireless router without cracking WPA2 handshake?

Is it possible to re-broadcast the appropriate parts of a captured four way handshake and connect to the router? If not why so?
1
vote
2answers
107 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
4
votes
3answers
203 views

Kerberos for sending secrets

I understand that Kerberos is used as an authentication protocol. However, would it be possible to achieve a similar effect as Diffie-Hellman with Kerberos i.e. establish a session key which can be ...
4
votes
3answers
219 views

Alternative to security questions for account recovery when email isn't an option

I'm working on a project whereby a certain level of anonymity is required for users. One of stipulations is that no email is used at all, as it makes the barrier to entry too high for people who want ...
-1
votes
2answers
70 views

Log in security - saving a session [closed]

I am creating a log in system. The easiest system would simply check a database for a log in and password, then same a session var which states login=true I am interested in other things that I can ...
1
vote
1answer
627 views

Is this API Token scheme secure enough

I am designing a REST Api for a mobile application and have some worries over properly securing access to accounts. I am writing the API server in nodeJS and it will primarily be consumed by a mobile ...
2
votes
4answers
696 views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesnt even have support for SHA or other algorithms. But I can think of quite a few advantages, ...
0
votes
3answers
234 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
1
vote
2answers
71 views

How to setup cronjobs that do scp without saving the .pem file on either of the machines

I have the following situation and want to know what are the best practices to do such things without exposing myself to security issues I have two servers both use the same private key for login. ...
11
votes
4answers
12k views

What is the difference between authenticity and non-repudiation

I'm new to infosec and doing some reading. Not surprisingly one starting point was wikipedia. In this article, authenticity and non-repudiation are listed as 2 separate 'Basic concepts'. My ...
1
vote
0answers
148 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
7
votes
2answers
2k views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
1
vote
0answers
55 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...
2
votes
1answer
267 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
0
votes
2answers
87 views

Logging in after password reset email sent (but not acted on)

Should a user be allowed to request a password reset email and then log in (i.e. disregarding the reset email and using their existing password) or should the current account be locked until the ...
1
vote
0answers
103 views

Yet another newbie security paranoid user authentication [closed]

I am building yet another website which requires user and session authentication. This time I want to be complete security paranoid and actually care if the passwords or sessions are stolen. I have ...
0
votes
2answers
106 views

Protecting against/detecting a specific Man in the Middle attack

I'm working on a specific (hypothetical) situation, where I have two client machines attempting to perform a public key exchange, via a server. There's no possibility for a direct connection between ...
1
vote
1answer
126 views

Is there any way to restrict multiple access to my server at the same time using one client certificate?

My Server is Windows 2008. Mr. X is accessing my web server using Mr. X's certificate. In that time, an outsider is also trying to access my server using Mr. X's certificate (somehow he got it). Is ...
3
votes
2answers
257 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
3
votes
2answers
184 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
-6
votes
4answers
244 views

user authentication my method (reinventing the wheel) is this secure?

I have read many articles advising to use OpenID, including Stack Overflow Q&A, for authentication. Unfortunately I can't use openid because my auth is not based on an email id - it is based on ...
4
votes
3answers
1k views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry ...
0
votes
1answer
41 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
1
vote
1answer
1k views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
3
votes
1answer
358 views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...