Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
1answer
156 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
0
votes
0answers
62 views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
11
votes
1answer
970 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
1
vote
3answers
120 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
0
votes
0answers
29 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
0
votes
1answer
43 views

Use PIN or Password [duplicate]

Which one is better, using PIN or password ? I want my app using PIN number to user login and register. Does not matter if I use PIN number only for user login and registration in my web application ? ...
-2
votes
0answers
59 views

implementing a secure client-server system

I am creating an Android app that communicates with a server. I need a safe way to transmit sensitive data so this is what I planed to do: Use ssl pinned to the app, so the app knows the server. Use ...
2
votes
1answer
52 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
5
votes
1answer
174 views

How secure is docker container-to-container traffic?

I'm working on building a web application using the microservice architecture pattern in a set of docker containers and I'm wondering about the importance of securing the communication between the ...
2
votes
2answers
76 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
2
votes
1answer
135 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
2
votes
2answers
57 views

Verification code within mobile phone applications

In most phone applications with two factor authentication I noticed that the verification code is usually 6 digits long. I wonder why 6 digits are needed - we already know that the user is associated ...
4
votes
3answers
84 views

2-Factor Authentication vs Security Questions

I have an account with a bank that has additional security option. When it does not recognize a device being used to access the account, it will either: Prompt with 1 of 3 security questions Send a ...
2
votes
2answers
69 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
5
votes
5answers
2k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
3
votes
2answers
368 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
5
votes
2answers
191 views

How secure is PIN login to Windows?

I've just noticed that Windows 10 allow me to change my login method to PIN which is obviously much more convenient than entering my long and secure password after every startup / wake. I am just ...
0
votes
0answers
7 views

change login time/date on Linux [migrated]

Is it possible to 'backdate' a login time on a Linux server by changing the date? For example, I just ran lastlog on one of my servers and included in the expected records was this: root ...
5
votes
1answer
137 views

Why require root to be the first entry in /etc/passwd?

Security policies sometimes demand that root be the first entry in the /etc/passwd file. Is there a valid reason for requiring this, or is it just conventional to do so since the root account is the ...
2
votes
1answer
58 views

Logout tied to cookie expiry

I am looking for an event to automatically logout a user from the application. Typically I would do it when an inactive session expires. I was wondering if it is secure to do so using cookies. So here ...
1
vote
1answer
43 views

Authentication on client server

I have following requirements for system: My admins authenticate on client servers Over http Central authorization server My solution is based on O-Auth: user is redirected to authentication ...
6
votes
7answers
3k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
-5
votes
1answer
50 views

How to authenticate a user account from a website over the phone?

A support team is answering calls and providing well support. It would be conceivable for someone to impersonate or ask for something which should be authenticated first. Which are the best methods ...
4
votes
1answer
64 views

“MAC function must resist existential forgery under chosen-plaintext attacks”, what does that mean?

While reading about MAC (Message Authentication Code) I have faced this sentence: MAC function must resist existential forgery under chosen-plaintext attacks but I got confused. What does ...
11
votes
3answers
8k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
1
vote
0answers
21 views

Relationship between the validity of license of an accredited CA (certificate authority and the validity of it's certificate? [duplicate]

To more clear, let's see my example: As I know, in Korea, the validity of a CA's license is only 2 years, but the validity of this CA's certificate is 10 years. Why is the valid time of the license ...
0
votes
0answers
9 views

Is it possible to UI automate testing involving Two-factor Authentication for an iOS app? [migrated]

I have an iOS app that uses 2FA for certain account related features. I'd like to create some UI automation tests for those features, but they require receiving either SMS messages or email. On a ...
3
votes
2answers
102 views

Can I prevent timing attacks with random delays?

I read recently about profiling for valid user accounts with timing attacks, IE the application-under-attack takes a predictably different amount of time to process say a login on a non-existent user ...
2
votes
1answer
76 views

Randomly generated token vs JSON web token

I'm trying to secure access to my web server. I have been implementing a JSON web token authentication where I randomly generate a secretkey and associate it with that user. The secretkey will then ...
1
vote
2answers
50 views

Can a “client-initiated” session cookie provide more privacy and security than existing session alternatives?

There are several uses for a cookie, and I would like to offer some kind of guarantee that a cookie is being used for a specific, limited purpose and scope. In my case, I want to prove that a cookie ...
0
votes
1answer
39 views

Will Wordpress nonces protect against Login CSRF?

Can Wordpress Nonces be used to protect against Login CSRF? https://codex.wordpress.org/WordPress_Nonces I glanced through the code for the function and it seems to only be using the User ID for ...
0
votes
1answer
284 views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
2
votes
1answer
508 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
1
vote
1answer
167 views

Is it possible to secure an Android Intent from other calls from apps?

I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a ...
0
votes
0answers
24 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...
0
votes
1answer
68 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H but only if it is authorized to do so. Permissions are stored on server. Technically I could ...
1
vote
0answers
12 views

Passwordless ssh with paramiko fails to authorize [migrated]

I am having trouble getting authentication working with paramiko SSHClient. Trying to go from one virtual machine out to another box on the network. The general idea is that I create a public/private ...
3
votes
1answer
120 views

How to implement application-specific passwords using strong hashes?

I am implementing a service where application-specific passwords seem a good choice to improve security. A question on why and when they might make sense has already been discussed here Google ...
5
votes
1answer
116 views

How long does 2-factor authentication codes have to be?

I've noticed that from a (personal) UX point of view, 4 numbers which my online banking uses seems to be a sweet spot in terms of holding it in my head from looking at my phone to typing it it. But ...
9
votes
2answers
187 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
1
vote
1answer
49 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
0
votes
0answers
29 views

Should universal delete, or “the right to be forgotten”, be an extension to OpenID Connect “signout” or authentication in general?

There are different levels of maturity various OpenID connect implementations may have. One of the optional features is the session management and sign out feature. Now that this has finally ...
5
votes
2answers
113 views

Limiting Concurrent Login For System Admins On Windows Domain

Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our ...
0
votes
0answers
76 views

Multiple user type management - token based authentication

I am currently working on an e-commerce application. The application has different users: Customers Merchants Logistics Admin The current db structure has a different table for each of these user ...
0
votes
1answer
48 views

Should I use the certificate serial number or the subject key identifier to look up public key?

I'm designing an API authentication mechanism similar to the one AWS use. As part of that, I need to look up which public key belongs to which user to verify. The public keys come from x509 ...
22
votes
2answers
141k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
9
votes
5answers
11k views

Difference between authentication and identification [Crypto and Security perspective]

I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification. ...
5
votes
2answers
270 views

How to ensure that a person whose identity has been verified from an I.D. is the author of their exam answers?

Background We are designing a computer based test system where the examinees use their own computers to write their answers. The examinees' computers are booted to a custom Linux OS from USB drives ...
363
votes
21answers
70k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
1
vote
0answers
52 views

Failure analysis to avoid locking permanently online accounts [closed]

(I reposted here a question I previously asked in SuperUser, I think this section is more appropriate) Back in the days defining a path leading to loss of data or loss of online accounts was easy: ...