Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
0answers
54 views

What are the security implications of (not) expiring login screen session? [duplicate]

I manage a single sign on solution (CAS) for a group of related web applications. The CAS specification states that Login Tickets are associated with every login attempt which can only be used once. ...
2
votes
2answers
750 views

Login system using authenticated encryption without storing user password

I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about. First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
3
votes
4answers
4k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username ...
2
votes
0answers
73 views

Stateless REST API and secure server side password storage [duplicate]

RE: Duplicate - Did anyone actually read my question? The question marked as duplicate is in no way, shape, or form what I'm asking. I specifically state that a DB compromise must not allow an ...
5
votes
5answers
2k views

How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?

Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
0
votes
3answers
690 views

Password and username used to connect to database in source code [duplicate]

In PHP scripts that communicate with the database I have the username and password to the database in plain text i.e. mysqli_connect('localhost:3306', 'root', 'PASSWORD!'). From OWASP Do not ...
6
votes
3answers
910 views

Can I spoof IP addresses when attempting to brute force a login?

I am testing my website with hydra brute-force software. But accessing my apache conf remote server file, it seems that an attacker can't log-in more a limited number of times per seconds. Does hydra ...
5
votes
2answers
143 views

Is it common for a One-Time-Password system to become unsynchronized?

One-Time Passwords look like they can play a helpful role in a layered-security system, yet their use, especially paper-based TANs seem like clients could be vulnerable to getting out of sync with the ...
1
vote
1answer
104 views

Secure authentication cookie for web site

Hello i want to know if this auth token is secure enough for a site of millions of logged in users: ...
5
votes
5answers
3k views

How secure are “mobile authenticators” versus traditional key fobs?

Two-factor authentication, password + device, seems to be increasingly mainstream among consumers with products like Activision Blizzard's Battle.NET authenticators. However, I am curious what the ...
6
votes
2answers
303 views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
1
vote
2answers
951 views

Security benefits of Single Sign-On [duplicate]

What are the benefits of a single sign-on implementation from the point of view of security? From my point of view, if the account is compromised the attacker has access to any resource, so ...
2
votes
1answer
410 views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
18
votes
2answers
2k views

Sending temp password when users first registered - is that good for anything?

One of our clients has sent us a list of security requirements. One of them was that registration does not including setting a password - once complete, a temp password is sent to the user, and the ...
2
votes
2answers
194 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
4
votes
3answers
426 views

How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?

Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account. A ...
10
votes
5answers
1k views

CSRF protection with Session Id

To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent? The server would then just ...
3
votes
2answers
312 views

Login with a hash. Is this secure enough?

I need to provide store's clients with a tool to check the status of their repair orders. The clients doesn't have a user or password. They are only a record in the database. Yet I need to give them a ...
2
votes
2answers
1k views

Force SSL/TLS client cert authentication even if server does not request it?

Usually the server specifies in the Server Hello message if a client certificate is needed/wanted. Does anybody know if it is possible to perform an authentication via client cert if the server does ...
4
votes
1answer
401 views

How to verify the authenticity of Facebook users?

While I was not surprised at all by Facebook stating that "8.7 percent of accounts belonging to its 955 million monthly active users are fake"; link is a news story that providers a summary of their ...
-10
votes
1answer
383 views

Can a cracked antivrus software do the job? [closed]

Some of my friends say that their cracked antivirus software updates regularly, and does the job as same as a legitimate software would do. Is this possible? How do they bypass the activation key ...
1
vote
5answers
255 views

Should I enforce a password policy on a web site?

For a commercial web site, is it important to impose some restriction on passwords to access the system? Eg. special $char, Upper and lower case, numbers, at least a minimum length... Can a CAPTCHA ...
5
votes
2answers
516 views

Man in the middle attacks for Out of band Authentication

I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows: "In ...
1
vote
1answer
143 views

Simple and secure remote installation method that accepts input via a web page?

When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner? ...
32
votes
9answers
2k views

Use additional “password” in Referer to hide private site?

I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at example.com, ...
35
votes
1answer
2k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
2
votes
1answer
113 views

Send credentials by sms [duplicate]

If a user forgets his login credentials for a web site, is it secure enough to send users credentials by sms?
2
votes
4answers
736 views

If someone steals my laptop while I'm logged in, how can I protect my browser?

My question has its roots in an xkcd from this week: http://xkcd.com/1200/ Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I ...
2
votes
3answers
235 views

How good is validating source with request.referer than checksum?

I have 2 portals(both are under my control & domain names are different) In 1st portal, there is a link on click of which User can directly get logged into 2nd portal. Link which will be hit in ...
16
votes
4answers
854 views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
0
votes
2answers
152 views

How to allow only the public key owner to submit requests to my site? And what is this type of security called?

This was probably asked many times here, but I'm not finding any because I'm not sure what to look for. I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
10
votes
6answers
2k views

Prevent denial of service attacks against slow hashing functions?

I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
3
votes
1answer
521 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
15
votes
1answer
9k views

Configure SSL Mutual (Two-way) Authentication

A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
3
votes
1answer
133 views

Are there any uses of having a non-deterministic salt value for hashes?

So I've been toying with the idea of having non-deterministic salt values for hashes. Let me explain what I mean: Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
3
votes
4answers
2k views

Is it safe to allow users multiple login at different browsers & computers?

We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
2
votes
1answer
88 views

Authenticating a ciphertext

what can be considered as a downside of authenticating a ciphertext? For example, can we say drawback of authenticating a ciphertext is that we lose repudiation, for example, we can't prove to the ...
3
votes
2answers
195 views

Are there any serious problems with this method for generating single-use tokens?

I need your advice on the security of this design. I have a scenario whereby a server application and a smart card application need to share a value e.g. 52, which has been encoded in a long decimal ...
1
vote
1answer
146 views

What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?

I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible. On ...
4
votes
2answers
481 views

How Secure are Authenticity Token in Rails

I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
0
votes
1answer
317 views

Facebook Login for Intranet

How safe is Facebook Login? I'm currently building an intranet, for my small company. We're 10 employees, and no risk of them messing up from inside. But is using Facebook Login safe for this? How ...
6
votes
3answers
187 views

Is there any sense in using two-step authentication for personal email address?

There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
8
votes
3answers
6k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
5
votes
1answer
156 views

Authentication concept for sites served to another site

We are going to serve content to a Content Management System that embeds it through an iframe (yuck). Some pages that we serve need to be authenticated before – only a valid user should be able to see ...
2
votes
1answer
220 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
8
votes
3answers
967 views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
4
votes
3answers
629 views

Secure login system - using sessions?

I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this: <?php session_start(); if (validPass() || isset($_SESSION['userId'])) { ...
1
vote
1answer
252 views

Best practice for securing user credentials once they reach the server using Basic Auth + SSL

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
2
votes
2answers
130 views

Client code tampering detection

I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
-3
votes
1answer
50 views

What is the notion challenge in authetication? [closed]

Can someone help me what is a challenge in authentication wordbook?