Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
8
votes
2answers
479 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
8
votes
8answers
849 views
Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
I don't know why do we authenticate by prompting the user to enter both username and password.
In my mental model, prompting password only suffices.
The reason is as follows:
Assume there are x ...
6
votes
5answers
495 views
Should a closed source website keep a secret key in its source?
Various APIs (such as Facebook or Amazon S3) require a secret key to authenticate access to the service. Obviously, if source code is public, the key should not be in the source! What about for a ...
6
votes
3answers
3k views
What is the difference between authenticity and non-repudiation
I'm new to infosec and doing some reading. Not surprisingly one starting point was wikipedia. In this article, authenticity and non-repudiation are listed as 2 separate 'Basic concepts'. My ...
4
votes
3answers
218 views
Is SiteKey a valid defense against Phishing?
As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. The comments and answers indicate some issues with this approach, but that question wasn't ...
3
votes
1answer
215 views
How many authentication factors are there?
The three classes that we all know and love:
Something you know.
Something you have.
Something you are.
I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
2
votes
3answers
228 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
2answers
104 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
0
votes
2answers
144 views
Security concern to implement a web based remote desktop
I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.
I can configure the ...
139
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
31
votes
5answers
5k views
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage ...
16
votes
3answers
4k views
What are the main advantages and disadvantages of webid compared to browserid?
What are the main advantages and disadvantages of webid compared to browserid?
This question is inspired by this answer which got a number of upvotes despite being very vague on the topic of that ...
34
votes
4answers
6k views
Is posting from HTTP to HTTPS a bad practice?
Working on the assumption that SSL serves both to encrypt data and to provide assurance as to the identity and legitimacy of the website, should the practice of providing a logon form on a page ...
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
34
votes
7answers
3k views
Are passwordless SSH logins more secure?
I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
23
votes
6answers
1k views
Is using a public-key for logging in to SSH any better than saving a password?
Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
12
votes
6answers
527 views
Is This Login Security Enough?
I'm coming up with my next login system for admins of an ecommerce website to have
login form is SSL secured
password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
11
votes
5answers
638 views
Good session practices
What are some good practices for ensuring logins, session IDs and session content are secure for a website?
19
votes
4answers
428 views
How does using OpenID affect webapp security?
Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use.
But what are the security considerations one should bear in mind when deciding whether to ...
5
votes
6answers
527 views
How do I secure my login page?
The login page is the starting point to any web site and the most important thing to authenticate the user.
When I begin to build any web application, I take a lot of time to think about how to ...
62
votes
11answers
5k views
“Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?
Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
18
votes
5answers
1k views
Should usernames be kept secret?
Help me settle an discussion among colleagues and guide future design:
Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
17
votes
6answers
1k views
How to verify that someone is who they say they are online?
I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are.
For example, we don't want ...
11
votes
5answers
991 views
How to implement non-password authentication in a web site
In an answer to this question about pw reset, D.W. says:
Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
7
votes
3answers
1k views
Any flaws in this security model for a REST web service?
I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
0
votes
3answers
248 views
What do I need to do to secure log-in and registration for my website?
What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
26
votes
3answers
661 views
What is this authentication method/approach called?
Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
15
votes
12answers
2k views
Why do we even use passwords / passphrases next to biometrics?
In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
10
votes
8answers
1k views
Can IP address be a component of 2-factor authentication?
I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
8
votes
3answers
263 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
6
votes
1answer
679 views
How will security need to be changed if P=NP?
If we suppose that it is found that P=NP, how will security measures need to be changed?
I'd like to know the major security measures that are affected, and how they would need to be changed. We can ...
5
votes
2answers
1k views
Dealing with expired or revoked signing certificates with Infopath documents
Suppose I have an Infopath form that is digitally signed today by a valid, and active user.
When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
15
votes
5answers
506 views
Safe way to authenticate (multi-factor authentication?) while being monitored?
(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.)
...
12
votes
5answers
28k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
11
votes
3answers
2k views
Three-Factor Authentication for Windows
This HowToGeek article...
http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/
...got me thinking.
Is there any software (or combination of software) that ...
11
votes
3answers
249 views
Verifying server software integrity?
I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
11
votes
2answers
610 views
Biometric versus other Two Factor Authentication Mechanisms
Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
10
votes
4answers
509 views
What is the key when facial recognition is used as a password?
I get the basics of what face recognition is and the fact that it is used to protect PC's and as a login replacement.
However, if it was to be used for encryption, where the role of the key is played ...
7
votes
4answers
209 views
Candidate authentication in large scale assessment
First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes.
We're ...
7
votes
3answers
155 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
6
votes
3answers
2k views
How can i find what hashing algorithm was used?
One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
6
votes
2answers
2k views
How does deauthing work in aireplay-ng?
I have a question of how aireplay-ng works when it deauths. I mean, it is really easy to disconnect another client from an AP: you just need to run the deauth command (in aireplay-ng) once, specifying ...
6
votes
2answers
445 views
How do I log everything a certain program is doing?
i have a program which is pretty simple.
Its just a simple login form.
Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
4
votes
1answer
473 views
Is this admin area secure enough? V2
This is a response to my previous question, Is this admin area secure enough?.
There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
6
votes
2answers
2k views
How does ssh public key authentication work?
My basic understanding is this:
The (connected to) server's sshd uses the public key to encrypt some message
The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
5
votes
2answers
126 views
What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?
In many organizations these days, employee IDs are very mutli-functional. They can serve as:
Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
5
votes
3answers
650 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
4
votes
3answers
1k views
What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?
I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional.
My intent is to gracefully ...
