Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
67 views

Steps to create user authentication system between mobile and server

First time doing a secure login from a mobile app to a server (built in java). I want to understand if I got this right. Login in for the first time: 1. On the mobile device hardcode a security ...
1
vote
0answers
45 views

Does Ally Bank's trusted image system actually make login safer? [duplicate]

Ally Bank uses a 'trusted image' system to supposedly make login more secure. I can't find evidence that this is standard practice, so I'll explain it. When creating an account, you choose an image ...
2
votes
1answer
41 views

Are AWS security groups sufficient to authenticate communication between instances? (HIPAA)

Say I have a private service that exposes sensitive information (PHI) via a REST API, and that I want to permit access to it from only one other service. Is it enough to partition these services ...
0
votes
1answer
57 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
3
votes
3answers
103 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
0
votes
0answers
12 views

Prevent Derby SQL User Authentication Change [migrated]

Can someone tell me if there exists SQL code for Derby to change a username or password of a database? How may I reproduce this to prevent it in future in my application? What I'm busy doing, is to ...
2
votes
2answers
67 views

Securing fingerprint templates stored on web authentication server

I have a multi-factor web authentication server, that in addition to regular passwords uses fingerprints for user authentication. Can anyone think of a security flaw in the following scenario: I ...
2
votes
2answers
68 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
0
votes
1answer
119 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
3
votes
9answers
456 views

Where is the identification process when I use a key fob to unlock a door

I can understand that typing my user name on the computer is "identification" and providing the password is "authentication" but when I use a smart card or a key fob I see no identification taking ...
2
votes
1answer
90 views

How to autenticate properly in Java

I have to write some login module for Java EE application. Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the ...
4
votes
4answers
127 views

Which one to ask first in multi-factor authentication?

Let's say I have a system which use something you know, like a password, and something you have, like a code sent to a cell phone, to authenticate. Is there a preferred order to ask for the password ...
0
votes
0answers
36 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
1
vote
0answers
28 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
1
vote
1answer
34 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
2
votes
1answer
75 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
1
vote
1answer
136 views

MySQL Authentication Hash Cracking

I'm currently conducting research regarding MySQL server remote authentication. I've captured unencrypted, not compressed authentication packets between the client and the server, where username is in ...
1
vote
1answer
60 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
1
vote
2answers
97 views

Which encryption technique should be used for cloud computing data transfer?

I want to setup my application for cloud computing for Software as a Service. There is going to be a lot of data transfer between my server and client, to and fro. The technique I have envisaged is: ...
2
votes
1answer
104 views

How can I protect my “try it with one click” service?

I have a service with "try it now" experience that currently offers a "one click" effort. This service has a pool of N resources (lets say 50). Each new resource takes about 1 hour to generate. ...
28
votes
4answers
2k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
1
vote
2answers
45 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
1
vote
1answer
31 views

Secure automatic authentication to samba share

I need to pull some data from network storage to a publicly available laptop that is running Linux. The network storage used to be provided via a server that could be connected to via ssh, but it has ...
1
vote
1answer
111 views

Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used. Some options came to my mind: Store the password ...
1
vote
1answer
79 views

Shared Key vs Pre-Shared Key

Does Shared key and Pre-shared key mean different thing ? Currently reading Text , Security+ Guide to Network Security Fundamentals.
0
votes
1answer
77 views

How can LastPass enforce 2-factor authentication

I've recently started using LastPass and one of the things you can set as a policy for you password vault is Prevent offline access when using Google Authenticator. The local cache can be ...
7
votes
1answer
250 views

Collision attacks on OCB?

I've been looking into the OCB cipher mode and everything I hear sounds good. I was planning on implementing it. Everything except for this lone voice, that is: Collision attacks on OCB: We ...
14
votes
6answers
965 views

Additional security benefits from Multi-Factor Authentication?

Does multi-factor authentication provide any additional security benefits on top of doing a better job at correctly identifying and authenticating users compared to single factor authentication? In ...
1
vote
2answers
527 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
2
votes
3answers
115 views

Example of application that doesn't require “strong authentication”

Does anyone have any examples of real-life applications that doesn't require "strong authentication". I am looking specifically for blog posts or even scientific papers that argue that "strong ...
1
vote
1answer
52 views

Logging in users automatically on a website

I'm making a website that has an extended forum feature, where users can login, post comments, etc. I'm making the feature where the website stores cookies in your computer so the next time you visit ...
0
votes
2answers
72 views

https login iframe 2014

Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages? Is this not a dupe? It is, but I want current trends because ...
0
votes
2answers
72 views

Can a mobile number ring if the person has not inserted their simcard into their phone? [closed]

I dialled a cell phone number and it rang but with no reply. I asked the person later why they did not answer and they said the Sim card was not in the phone. In fact, it was in a purse.... Is this ...
9
votes
3answers
13k views

What is single sign on versus federated login?

What is the difference between Federated Login and Single Sign On authentication methods?
-2
votes
2answers
69 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
1
vote
1answer
155 views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
-1
votes
1answer
80 views

VPN security/compromise

I want to get a VPN with one of the known providers. I don't know much about VPNs but I know they issue certificates which you download and it authenticates the connection and basically gives access. ...
154
votes
7answers
26k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
2
votes
1answer
69 views

Is this a safe way to identify users connecting to a chat server?

Before I start, all information will go over HTTPS. So, my website is basically like a forum with the authentication part finished and working. This forum has a real time chat application that sends ...
0
votes
1answer
40 views

How to maintain validity of user credentials?

In an example scenario consider that; I am a customer of organisation and I have two separate accounts with two different departments X and Y. I can login in to each department's website by using ...
2
votes
1answer
41 views

Possibility of using CA as an attack point by governmental organizations under their pressure

I was always concerned about the model of trust behind CA stuff we use . Well, for most of us, it is OK to trust them, since they are reliable organizations with a bunch of solid experience. ...
1
vote
4answers
163 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
7
votes
6answers
2k views

Is denying login after incorrect attempts ineffective?

Generally denying login attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicious login attempts. Yet, surely doing this is ...
-1
votes
1answer
53 views

How do I force kill an OWA, Activesync, or Outlook session?

A user with a BYOD is still able to access the email system, even after the user account has been disabled and password changed. Since it's clear that a re-authentication event doesn't continually ...
2
votes
2answers
251 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
0
votes
2answers
76 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
-1
votes
1answer
101 views

Strange name on “shared”, was I hacked?

I use a Macbook Air 2013 and I recently noticed a very strange and long line of digits and letters under my "shared" category in finder. When I click on the name, it just says "failed to connect." It ...
0
votes
1answer
49 views

Authentication of temporary worker without a badge (physical security) [closed]

In our company we have a procedure to verify internal worker but we cannot use it for temporary worker. We cannot use badges and because of privacy reasons we cannot use any photos. Is there any other ...
1
vote
1answer
120 views

Certificate validation with 802.1x PEAP

I recently learned about how WPA-PSK works. If I understand correctly, the 4-way handshake enables the protocol to ensure mutual possession of the PMK (and therefor, the PSK) without sending the ...
1
vote
1answer
121 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...