Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
1answer
85 views

Email code authentication

I'd like to replace passwords with a temporary code that's emailed to the user. The login flow would go like this: User enters their email address. "If that email belongs to a user, a code will be ...
3
votes
1answer
3k views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
3
votes
1answer
51 views

Security requirements for one time access code/token in the url

I have an application that will send an SMS reminder for user containing a URL to log on. I would like to avoid user typing in username/password and log him in directly. For that I plan to use an ...
46
votes
6answers
9k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
0
votes
0answers
27 views

What is attribute-based authentication?

I found the following definition here : From a privacy perspective a better solution would be the use of attribute-based authentication (Goyal et al. 2006) which allows access of online ...
1
vote
1answer
54 views

Secure login form from unsecure site

We have two sites, app.company.com and www.company.com. Right now, users are trained only to enter their login credentials on app.company.com. Both sites use SSL. The app.company.com uses CSRF and we ...
1
vote
0answers
27 views

Migration problem between different machines using TrouSerS TPM library

My question coincides with the question posted by Maximiliano Ezequiel. Below is a question. I could make migration process work in one single machine. I can: Export SRK public key. ...
2
votes
3answers
302 views

Does HTTPS allow replay attack on authentication request? [duplicate]

If I sent a username and the password to a website over HTTPS, is it possible that someone on the net would save this request and re-send it later to authenticate on the website?
4
votes
1answer
93 views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
2
votes
1answer
94 views

How to verify if a phone number is an online SMS account as opposed to a genuine SIM card

We are using Authy for phone number verification on our website. It is very easy to create a free online SMS account through Twilio or other providers. Is there any way to determine whether the phone ...
1
vote
0answers
98 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
6
votes
1answer
175 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
5
votes
2answers
1k views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
0
votes
2answers
98 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
7
votes
2answers
248 views

mobile number authorization strategy using SMS, best pattern and practices

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
2
votes
2answers
1k views

Recovery plan in case of lost Android smartphone with Google Authenticator?

So I am using Google Authenticator as my two factor authentication. I'm not a security expert, but I was thinking late last night as I was about to fall asleep: How can I login to my favourite ...
1
vote
1answer
78 views

Secure HttpOnly Cookie or Header field for auth token securing an API?

I have an API to secure. There will potentially be two types of consumers of this API - our own Single Page Application, and third party services that will integrate with it. I have read that in ...
1
vote
1answer
50 views

Allowing VIP Access Credentials from Mobile Devices (smart-phones/BB) but not Desktops

What could be an explanation for such a decision by a company? Simple oversight, or deliberate choice? It seems like a mobile device is easier to lose/crack. ETA: The company is using it as a 2FA for ...
0
votes
1answer
1k views

How to avoid storing plaintext during CHAP authentication

When using CHAP authentication, passwords are stored in plaintext, then I used reversible encryption to store password. However, I recently found Citrix states " storing passwords using reversible ...
1
vote
0answers
64 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels ...
1
vote
0answers
24 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
0
votes
0answers
11 views

Change ntlm hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass windows login? For example, I have the ntlm hash of a windows machine and I have physical access. Is possible to write the ntlm hash in ...
5
votes
1answer
98 views

How does Google store passwords for remote IMAP/POP services?

It is possible to add non-Google accounts to Gmail and retrieve their mail messages via POP or IMAP. As part of the setup process, one has to provide the login username and password for these ...
0
votes
0answers
24 views

Integrated Windows Authentication and Java/Unix

I have a specific scenario where we have existing ASP.NET Web applications/services hosted in IIS and accessible via Integrated Windows Authentication. The challenge is to have a new web application ...
3
votes
1answer
62 views

Revoke access from intranet if an employee leaves the organization

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed. This organization has offices in maybe 50+ countries, ...
26
votes
7answers
4k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries ...
1
vote
1answer
19 views

Extract X509 client certificates from TCPdump files

I have the following question: assuming I have a TCPDump file containing a number of HTTPS connections using TLS mutual authentication, is there a way to extract all client certificates sent to the ...
39
votes
6answers
15k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
0
votes
0answers
22 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
2
votes
1answer
102 views

Why refresh tokens are used

Reading about JWT I see it is common practice to include a refresh token along with the short lived token. So commonly it seems you have a short lived token which lasts for a short time such as 15 ...
2
votes
2answers
45 views

IP Restricted OTP like Web Admin Authentication Safe or Not

I created a web admin panel with the following security implementation. It is located on a sub directory of the web, which will trigger a 404 Error when tried to access (just like the link is ...
2
votes
1answer
116 views

SQL injection vulnerability when using prepared statements in PHP

I've been studying prepared statements and implemented it in my first login. I used a prepared statement for the SQL query and am wondering if this is enough to ward off most SQL injections? Since ...
31
votes
5answers
2k views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
1
vote
1answer
205 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
-7
votes
1answer
85 views

Is webkey a reasonably secure authentication system?

I just created Webkey in the last couple days. It's built to do client-certificate auth without using the (in my opinion unusable) client-cert functionality built into browsers. It would allow ...
2
votes
2answers
49 views

Does having multiple 'memorable info' answers reduce secuity?

I use a website that on top of requiring a username and password also requires 'memorable information'. When signing up I provided multiple pieces of memorable info as answers to multiple questions ...
32
votes
4answers
2k views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
5
votes
1answer
81 views

Simple, Secure PHP API Design

I'm trying to design a secure RESTful API web service with as few moving parts as possible. I have some questions, and want to make sure my design is secure. For the data transmission level of ...
6
votes
1answer
244 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
5
votes
2answers
114 views

OAuth2 and Authentication

I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points : What is the difference ...
0
votes
1answer
31 views

Why is calculating the checksum of an IP Datagram header and then encrypting it not appropriate to provide Data Origin Authentication?

So assuming Alice and Bob have agreed to use a particular symmetric cryptosystem and share an appropriate key, they want to achieve data origin authentication by computing the header checksum of an IP ...
-2
votes
1answer
83 views

Public key encryption for initial challenge-repsonse

I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
2
votes
0answers
262 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
0
votes
0answers
19 views

Cyrus-Imap (v2.3.16) local logon attack

CentOS-6.7 Cyrus-IMAP-2.3.16 The host inet07.hamilton.harte-lyne.ca is our IMAP server host. It offers imap and pop3 publicly. I uses local accounts (/etc/passwd) for imap/pop3 authentication ...
1
vote
3answers
67 views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
1
vote
0answers
21 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
3
votes
1answer
85 views

VPN Authentication and Network Administrators

Is it possible for a network admin (or attacker) to monitor traffic sent to a VPN server during authentication and end up being able to decrypt the data as if they were the legitimate user? I don't ...
6
votes
3answers
185 views

Authenticating a user via SMS

I'm involved in a project that's building a chat-bot that users can communicate with via SMS from their mobile phones. We'd like the users to be able to use the bot to do some basic account-management ...
1
vote
1answer
82 views

Why is CertificateVerify message necessary? (Why isn't client authentication done through the KeyExchange)

Why is client authentication not done throught the KeyExchange like with the server, but through a CertificateVerify message? EDIT: To be more clear: When using RSA key exchange the client encrypts ...