Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
0
votes
3answers
278 views

Is it secure to return a JWT to an already-logged-in user?

I'm using JWT to handle an SSO scheme where two systems (let's call them A and B) both require authentication, but the user datastore is in one system only (let's say A). Everything I've seen about ...
1
vote
2answers
69 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
1
vote
1answer
95 views

Can Passpoint X.509 certificates be used to MITM SSL connections on Passpoint networks?

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication. Can these certificates be used by the provider to execute man-in-the middle ...
2
votes
3answers
141 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
1
vote
1answer
151 views

securities concerns about calling REST API from multiple servers

There is a master web application that needs to call REST APIs from servers of other applications. I can think of two ways to achieve it: a). call APIs on the front-end of the master application(...
7
votes
2answers
294 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
0
votes
1answer
58 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
1
vote
1answer
1k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
4
votes
2answers
101 views

Time Based Authentication Verification Token

I'm building a long-lived session system which requires that users verify their authentication before performing "dangerous" operations, such as changing critical settings, deleting their account, etc....
0
votes
2answers
88 views

Challenge authentication without roundtrip

Is it possible to have a secure challenge/response authentication protocol, authenticated immediately? Too slow: a client request -> server challenge -> client response -> server response Fast ...
-1
votes
1answer
241 views

Secure login procedure

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the ...
0
votes
1answer
43 views

How to configure SSH public key per user?

I have an OpenSSH server running and different users can log into it with different privileges. I know you can enable public key authentication and place all the allowed public keys in the ...
2
votes
1answer
146 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I ...
2
votes
1answer
34 views

Understanding the security of a federated public key scheme using WebCrypto

I am proposing this scheme for federated authentication and WebCrypto. I am not sure if something like this (or better) exists, please do send me related material. Entities Alice's Browser, BROWSER ...
2
votes
1answer
367 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
-1
votes
5answers
163 views

Is it possible to bypass two step authentication process?

Is it possible for a hacker to bypass two step authentication process if the hacker has no physical access to my phone?
2
votes
2answers
81 views

For 2FA, is one method better (more secure) than another?

There are a variety of options available for 2FA - LastPass, for example, offers all of the following options: LastPass Authenticator Duo Security Authentication Google Authenticator Yubikey ...
2
votes
3answers
2k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
4
votes
1answer
65 views

How can I be sure if a webview in a desktop app shows the real web page?

When installing Postman (on Mac), you can log on using your Google account. For this, the logon view from Google is shown in a window (A kind of Webview I assume). How can I be sure this is the real ...
2
votes
1answer
163 views

Authenticating a ciphertext

What can be considered as a downside of authenticating a ciphertext? For example, can we say a drawback of authenticating a ciphertext is that we lose repudiation, for example, we can't prove to the ...
1
vote
1answer
80 views

TLSv1: Reason for client not sending client certificate

Our BizTalk installation consists of two load balanced nodes B1 (10.137.10.1) and B2 (10.137.10.2) which process and route incoming SOAP messages. The processing is nothing more than: sending the ...
16
votes
3answers
596 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
0
votes
1answer
29 views

Securing application-application communication from devs and admin

Scenario: I have an application A which holds sensitive data. I have an application B which needs to process the data. A will provide a web-interface. B will make calls to get required data from A. ...
0
votes
0answers
34 views

Best practice regarding secure administration on lots of embedded Linux devices [duplicate]

Lets say I've a lot of embedded Linux devices, like 100. How do I access and administer these devices securely? Is it best practice create a key pair and put the put the public key on all the devices?...
-1
votes
0answers
75 views

What is a WAM style session token?

Does anybody know what a WAM session token is? This appears to be something related to ping-identity; but I am just wondering whether this is a standard or not. If you know about this, please do also ...
3
votes
3answers
96 views

How does Single Sign On limit phishing risk

I was reading this article about SSO benefits and this sentence intrigues me : Can reduce phishing – Phishing, a fraudulent process where victims are tricked into giving away sensitive user ...
3
votes
2answers
78 views

Useless 2FA in case of inside attacker

Suppose a server-side signing scenario, where user keys are generated in a HSM and exported to a database, encrypted with a symmetric key derived from a user password and HSM's master key. To sign, ...
3
votes
2answers
122 views

Is it secure: unsecured Wi-Fi + social network authentication to access the web?

Recently I visited my dental office and noticed a Wi-Fi configuration I haven't seen before. First, there is unsecured (no password) Wi-Fi, but I cannot surf the web yet. I am redirected to a webpage ...
2
votes
0answers
17 views

Secure userserver authentication with authserver

So, lets say we have Bob, Alice and Peter. Peter is trusted by Bob and Peter has an authserver. Bob hosts a userserver and Alice wants to connect to Bob over an insecure channel. But Bob needs to know ...
1
vote
1answer
40 views

Secure multiserver authentication

I was reading answers in How to split login and game logic when writing servers?. Read that first. Now, I want to know whenever this method will work and how can it be broken. I think there might be ...
5
votes
2answers
882 views

Why is whatsapp using 6 digit codes for verification?

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters. Are there any reasons they chose exactly 6?
1
vote
2answers
145 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
1
vote
1answer
136 views

Secure HttpOnly Cookie or Header field for auth token securing an API?

I have an API to secure. There will potentially be two types of consumers of this API - our own Single Page Application, and third party services that will integrate with it. I have read that in ...
3
votes
1answer
39 views

Smartcard authentication SSH remote client

I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation: My desktop computer with smartcard has a ssh session to ...
0
votes
1answer
75 views

Allowing VIP Access Credentials from Mobile Devices (smart-phones/BB) but not Desktops

What could be an explanation for such a decision by a company? Simple oversight, or deliberate choice? It seems like a mobile device is easier to lose/crack. ETA: The company is using it as a 2FA for ...
-2
votes
3answers
72 views

What safeguards are taken when a login system only requires a PIN and no username? [closed]

The gym I go to gives its customers access to the building by giving them a 6 digit PIN code which they must type in on a keypad when they want to enter/exit the gym. Does the person who was added ...
1
vote
1answer
57 views

Why mobile phone app sessoins are never timed out?

This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login. These mobile apps call web ...
-3
votes
0answers
72 views

Alternate SSH authenticate

I was doing a little bit of research on how SSH actually authenticates a user and different things. And I came across a document which nicely explains how SSH authentication works which is something ...
-1
votes
1answer
28 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
7
votes
2answers
126 views

Why not make the second factor the only factor? [duplicate]

Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the ...
6
votes
1answer
146 views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, not authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
0
votes
1answer
33 views

How to connect to Windows RDP and delegate authentication to a (reverse) proxy?

Looking for the following setup: Client connects to Windows RDP server through proxy server. The client is in public network hence can't send username/password for logon. The proxy server in between ...
0
votes
1answer
153 views

Is this a good scheme for storing encrypted user credentials?

We are building a service that manages multiple user accounts. For that reason, we need to store the credentials to a user's accounts using a symmetrical algorithm so they can be retrieved for the ...
29
votes
4answers
199k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
0
votes
0answers
25 views

bundling session information in a binary

We are in the process of developing a desktop app. When a user is logged into the website we create a dynamic binary(.exe) and add session information to that binary which is valid for one time login. ...
1
vote
1answer
19 views

What should I watch out for when using pam_ssh_agent_auth?

I got tired remembering passphrases for my SSH logins and heard about pam_ssh_agent_auth. Unfortunately I hadn't found any security audit of it and I don't know enough low-level details about SSH to ...
0
votes
0answers
10 views

Does PKCS 1.5 padding make it possible for an attacker to extract the private key or not? Is PKCS 1.5 safe to use in authentication context?

Im currently writing a authentication app based on RSA, for Android that should be impossible to copy, even if you have physical access to a phone without lockscreen/PIN. However, the HSM inside the ...