Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
3answers
46 views

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully ...
26
votes
4answers
22k views

why a client authentication is not commonly performed in the TLS protocol?

Is there any reason for this other than key/certificate management on the client-side?
1
vote
2answers
68 views

Is phone-based authentication more secure than passwords?

Let's say I ask my user to provide email, first and last name, last 4 of ssn, date of birth, and a phone number. On login, I send a 4 digit pin as a text. Considering users tend to reuse passwords ...
0
votes
2answers
65 views

Security of picking unique passwords for users [duplicate]

I am learning more about security in web design so I can build more robust sites. As I see it password security is one of the main concerns, if a database is hacked then chances are passwords will be ...
2
votes
1answer
108 views

In postgres LDAP authentication, are passwords encrypted?

I am wondering if postgres LDAP login is secure? Would passwords be transmitted in clear text potentially if this is not set up properly?
12
votes
1answer
1k views

Is Postgres's uuid_generate_v4 securely random?

I'm using Postgres's uuid_generate_v4 in a uuid primary key column to generate secure one-time authentication tokens. Is this okay? Does Postgres use a secure random number source for generating these ...
1
vote
1answer
146 views

Is simple authentication safe if over HTTPS?

Background For my app I need to know if users have entered the correct email password combo. Pretty common stuff. I'm using HTTPS, and salting and hashing the passwords. Question Now, what I am ...
0
votes
0answers
15 views

Security mitigation vis policy between Android watch and Android smartphone TEE

We are an e-store company and we have native apps for Android and iOS smartphones. We are building a new app for Android/Apple watch and enable authentication between the watch app and native app on ...
0
votes
1answer
20 views

Certificate Verification in openssl

I was going through the openssl server-client program given here---> http://simplestcodings.blogspot.com.br/2010/08/secure-server-client-using-openssl-in-c.html. I can see both the client and server ...
0
votes
2answers
58 views

Is it less secure to require password and phone on sign in?

I'm concerned about the security of a system that requires its users to enter both their "email & password" and also their registered phone number which has to be verified upon each login. To me ...
19
votes
11answers
4k views

2 factor authentication - cost effective solution for a web startup [closed]

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device. I am doing a web startup in the ...
4
votes
2answers
52 views

Verification-less signup when user has been invited?

The typical signup procedure is of course: Alice enters email address and desired password (and possibly other data). A verification email is sent to the address Alice provided. Alice confirms her ...
0
votes
3answers
110 views

Securing a private API that's visible on the public Internet

I'm making an API for my own software. The API currently used for registering users, viewing users information and updating users information. In the future it will be used for billing, support etc .....
0
votes
0answers
42 views

Token authentication storage & encryption/hashing

I'm currently studying token authentication for web and native applications, in order to make users authenticate without using their password all the time via HTTPS. I kind of understand how tokens ...
3
votes
1answer
90 views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
3
votes
1answer
71 views

Understanding NTLM Authentication Step by Step

I was reading this link on ASP.Net Authentication and Authorization and these 5 steps were there explaining NTLM authentication. Client sends the username and password to the server. Server ...
0
votes
2answers
101 views

Anti session-hijacking mechanism using a session variable

Okay, So I'm brainstorming about a security architecture where on a website you have a 'secret' page, where a visitor (not user, just visitor) can enter 'secret' info. The visitor doesn't need to ...
1
vote
1answer
45 views

How can we serve sensitive encryped data without storing the key? Should I use user-defined passwords for keys?

System Background Sensitive data must be stored (i.e. Credit Card number or SSN) in the system for a notable period of time, to serve ongoing operation of the company. Anyone can insert sensitive ...
29
votes
2answers
35k views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
1
vote
2answers
163 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
1
vote
1answer
150 views

Secure HttpOnly Cookie or Header field for auth token securing an API?

I have an API to secure. There will potentially be two types of consumers of this API - our own Single Page Application, and third party services that will integrate with it. I have read that in ...
0
votes
1answer
82 views

Allowing VIP Access Credentials from Mobile Devices (smart-phones/BB) but not Desktops

What could be an explanation for such a decision by a company? Simple oversight, or deliberate choice? It seems like a mobile device is easier to lose/crack. ETA: The company is using it as a 2FA for ...
1
vote
3answers
81 views

Is there more of a security risk by providing an email when creating a new account?

With all of these recent breaches, I have been thinking about security best practices. One thing I was thinking about was the fact that some sites allow you to log into a site using your EMAIL OR ...
-2
votes
2answers
51 views

Two factor authentication + saved logins are safe?

I have two factor authentication. I understand that by using a keylogger an attacker can bypass that authentication. However I think that if I check regularly on saved logins or past logins I will ...
-1
votes
1answer
82 views

What is this type of authentication with device id and token?

I'm trying to understand this strategy of authentication that I'm using to access resources of an enterprise. Basically, they have given me clientId and clientSecret, which I use to generate deviceId ...
0
votes
1answer
171 views

Is this a good scheme for storing encrypted user credentials?

We are building a service that manages multiple user accounts. For that reason, we need to store the credentials to a user's accounts using a symmetrical algorithm so they can be retrieved for the ...
23
votes
14answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this world)....
3
votes
2answers
250 views

Is using JWT token for “remember me” less secure than random session token?

I am after reading "https://stormpath.com/blog/token-auth-spa" and "https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence" (among others :-) ) and thing I would like ...
0
votes
1answer
82 views

SQL queries using SQL Injections do not work as I think they should

I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL ...
0
votes
1answer
326 views

Could other people steal my Internet connection if they had my PPPoE data?

Would it be possible for other people to use my PPPoE data to get Internet access or is it somehow restricted to my house? Then what about my neighbors downstairs, could they do it? And what about ...
3
votes
2answers
79 views

Choice of authentication when both HTTP and HTTPS are supported

I am looking at a system where you are able to choose if you are going to connect to the web application via HTTP and/or HTTPS. You have to authenticate on either one. I know that the best option is ...
0
votes
0answers
66 views

Generally speaking, how does the Facebook JavaScript SDK provide authentication?

I'm looking for a high level overview of how the Facebook JavaScript SDK authenticates users, and the techniques involved. All JavaScript apps use this standard code to import the Facebook Single ...
0
votes
0answers
17 views

Do OpenAttestation and OpenCIT have Intel hardware dependence?

These technologies have been developed by Intel - what looks like for Intel TXT machines, but curious if it will work for any machine equipped with a TPM chip?
0
votes
0answers
35 views

Securing a Web API Service Layer

We've created a website and am using a service layer to expose common functions so that other applications will be able to call via REST API. The main website will have users that will add/edit ...
0
votes
1answer
35 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
1
vote
0answers
26 views

What's the best way to implement phone-based 2FA

Some websites (for ex. Google) call you and you hear an recorded number, which you have to type in your computer. Some websites (for ex. Amazon) display a number on your computer which you have to ...
21
votes
5answers
2k views

Why do some websites and programs restrict password characteristics?

There are some websites and even programs that I use that have ridiculous password restrictions. Lots of forums for instance restrict passwords to ~32 characters. Others enforce a restricted charset. ...
0
votes
0answers
7 views

FID on iPad app on non company network

I am planning to implement SSO for one of company iPad apps. The app will never be on an App Store but instead loaded with third party authentication. The users on iPad will rarely be on the company ...
0
votes
1answer
19 views

Metasploitable: Change/Location of login page file?

I have been messing around with Metasploitable 2 and changed the default login credentials. The login page looks like this: I want to change where it says "Login with msfadmin/msfadmin to get ...
0
votes
1answer
36 views

Security issues with concurrent sessions in iOS app and Safari browser

We have two ways a user can buy products on our e-store. We have a mobile native app for iPhones and a mobile optimized browser experience from an iPhone default browser (i.e. Safari). The iOS (...
-1
votes
2answers
60 views

Google Authenticator, one QR Code, many devices (users)

I have a commercial website where people pay to use the services on it. The services I offer on it is of a word games-nature so it really doesn't need serious banking "Ford Knox" type encryption, and ...
1
vote
2answers
304 views

Device authentication mechanism

I am doing a project that needs device authentication with a gateway. What are some of the best ways of doing that ? Whether a certificate based mechanism is feasible in this case ?
3
votes
1answer
301 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
7
votes
4answers
1k views

Adding “Email or Username” in login page, is safe?

Suppose a website has a login page with "Email or Username", and shows the username publicly to every user on that site. Does that make it easy for an attacker to hack other someone's account?
3
votes
1answer
53 views

Is “Windows” mode inherently more secure than Forms authentication for .NET web apps?

We have a web application being reviewed and I see the usual section in Web.Config: <authentication mode="Windows"> <forms loginUrl="~/Account/Login" timeout="10800" defaultUrl="~/"/> &...
0
votes
0answers
35 views

Basic authentication issue in IE [migrated]

Problem I have an AngularJS application hosted in IIS 7.5 that requires Windows authentication and then Basic authentication. We're only running this on IE 10/11. It works fine but only after ...
0
votes
1answer
70 views

Why CDNs don't require authentication to access static files?

Why companies like Facebook do not require authenticated HTTP/HTTPS requests to access content (like images) using CDNs? In a way, once one "friend" can access the image URL, he/she can effectively ...
436
votes
22answers
93k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
0
votes
1answer
39 views

Remote Biometric Authentication using mobile phones

As Google endeavours to do away with passwords, biometrics authentication as a method of proving identity has gained popularity. Logging into a system using a fingerprint or other biometric data would ...
4
votes
2answers
120 views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...