Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
6
votes
3answers
135 views
Is there any sense in using two-step authentication for personal email address?
There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
3
votes
3answers
625 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
4
votes
1answer
80 views
Authentication concept for sites served to another site
We are going to serve content to a Content Management System that embeds it through an iframe (yuck). Some pages that we serve need to be authenticated before – only a valid user should be able to see ...
2
votes
1answer
99 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
4
votes
4answers
333 views
What are the ways to implement two factor authentication?
We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
5
votes
3answers
335 views
Verify Login and Encrypt with PBKDF2
I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
2
votes
3answers
155 views
Secure login system - using sessions?
I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this:
<?php
session_start();
if (validPass() || isset($_SESSION['userId'])) {
...
0
votes
1answer
59 views
Best practice for securing user credentials once they reach the server using Basic Auth + SSL
I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
2
votes
2answers
48 views
Client code tampering detection
I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
-2
votes
1answer
32 views
What is the notion challenge in authetication?
Can someone help me what is a challenge in authentication wordbook?
1
vote
1answer
140 views
Basic Authentication with WebAPI and HTML/JS Client?
I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
5
votes
6answers
284 views
What's the most secure technique for authenticating user in a website?
I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
0
votes
1answer
65 views
What rules should be enforced for users to create a strong password?
I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best ...
1
vote
1answer
60 views
How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA
I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
6
votes
3answers
194 views
What is the value in asking for a second password for sensitive operations?
When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions?
Does it provide any benefit over ...
4
votes
1answer
1k views
Facebook page receiving improbable amount of likes from unknown users
A bit of an odd problem, but I'm not totally sure where to post this.
I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
1
vote
1answer
232 views
What is the origin of the three factors of authentication?
The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
0
votes
3answers
248 views
What do I need to do to secure log-in and registration for my website?
What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
2
votes
1answer
124 views
When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?
When displaying a page with content only logged in users should see, I simply check
if(isset($_SESSION['hasLoggedIn']))
{
//show content
}
else
{
echo 'you must log in';
}
In this article it ...
4
votes
5answers
360 views
Should an invalid user name be logged?
While authenticating, should attempts with invalid user names be logged? OWASP Logging Cheat Sheet says that authentication failures must always be logged. I can observe several programs doing this, ...
2
votes
2answers
92 views
Looking for general guidance on securing web API application for client applications and users
I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization.
After a lot of googling ...
6
votes
2answers
104 views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
4
votes
1answer
134 views
Drawbacks of storing an authentication token on the client side?
I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
10
votes
2answers
139 views
Preventing Voter Fraud on a Social Media Contest
I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
3
votes
3answers
97 views
jasypt message integrity
I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are
use a high level library.
don't use ECB
use a HMAC to ...
13
votes
2answers
527 views
Password and Generated number - How does it work?
In my company, they don't allow accessing the company email or servers from outside the company network.
To access the email from outside the network, you have to use: Username, password and a number ...
3
votes
2answers
55 views
Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?
CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service:
Service A makes a request to Service B on behalf of a ...
4
votes
1answer
106 views
How secure is Integrated Windows Authentication for IIS SMTP?
I have a Windows SMTP server that is currently allowing the "AUTH LOGIN" method of authenticating. As I now know, this is simply a base-64 encoding of the username and password, which is basically as ...
3
votes
1answer
133 views
Will using external OAuth providers for authentication protect users better than custom authentication?
On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
3
votes
2answers
145 views
BOTs C&C channels
Can someone please explain the C&C for bots ?
im reading a paper about Android bot , and its explaining something called URL flux
as method of C&C . however i couldn't really get it , so ...
0
votes
2answers
277 views
How to completely password protect login into Ubuntu 12.10?
I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite ...
6
votes
2answers
151 views
Limiting the root certificate chain
I'm playing around with the idea of running a mini-CA with my (hobby) website, likely only used internally with a few select developers for internal emails, client authentication, staging/development ...
3
votes
2answers
149 views
Is Yahoo SignIn Seal effective at phishing prevention? [duplicate]
Possible Duplicate:
Effectiveness of Security Images
Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on ...
6
votes
4answers
356 views
Banking application login leaks information
My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows:
User visits the homepage of the bank.
User ...
26
votes
3answers
661 views
What is this authentication method/approach called?
Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
4
votes
3answers
218 views
Is SiteKey a valid defense against Phishing?
As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. The comments and answers indicate some issues with this approach, but that question wasn't ...
1
vote
1answer
84 views
Browser cache, cookies, active logins and other data
This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure.
I'm seeking to know how secure it is to let the ...
7
votes
1answer
361 views
What possible use does an iFrame have for security?
I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password.
But just before the end </table> tag there's a blank iFrame which ...
1
vote
1answer
51 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
4
votes
1answer
197 views
Setting up Windows laptops to require a smartcard for unlocking
I am looking for details on how to secure a windows laptop using smart cards.
The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
2
votes
4answers
261 views
Why do APIs use API Keys instead of Usernames?
It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
2
votes
2answers
3k views
How to use OAuth with Active Directory
I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
4
votes
1answer
981 views
Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Are there any security implications with POSTing a authentication request with the use of javascript/ajax, as opposed to POSTing an HTML element by pressing the submit button?
thus
<form ...
2
votes
1answer
122 views
Web service HMAC authentication/anti-replay
I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows:
...
5
votes
2answers
340 views
Email instead of username
I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
2
votes
2answers
156 views
user authentication by decrypting a random blob
Normal user authentication is done by comparing "hash"-values. A simple example of this:
The user password is hashed with PBKDF2 on the client using a salt (the salt is the hash of the user password ...
3
votes
4answers
213 views
FireFox's restore previous session restores logins authenticated by server's sessions
In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
3
votes
3answers
264 views
How to use USB-Stick instead of passphrase?
I wanted to know if something exists that would allow the following.
Whenever I use my RSA key(when using ssh for example) I'm prompted for my passphrase. I would like to, instead of being prompted ...
1
vote
2answers
59 views
Where are the private keys stored in Persona/Browser ID?
I'm trying to understand where the private keys are stored in the Persona system, and how they are protected.
Can anyone elaborate on where the crypto material is created, stored, and what is ...
7
votes
4answers
819 views
Why does getting a password wrong takes more time than not
I type my password to login to Win or Linux.
Case 1: I get it right. Almost instant reaction.
Case 2: I misspelled it. It takes a while, and then rebounds.
Why does it takes longer to identify a ...
