Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
72 views

Is using dynamic obfuscation and peppers for password hashing a good idea?

I've read now the whole day about password hashing and secure authentication and though I read very often that mostly every own algorithm makes the proven hashing methods just less secure, I just got ...
6
votes
1answer
139 views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, not authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
1
vote
1answer
73 views

Does SAML 2.0 define how to pass username and password for authentication?

I'm aware of how SAML is used for single sign on (SSO). That is, redirection to IDP from SP and getting the user's identity from the SAML response/assertion. My question is: Does SAML 2.0 ...
2
votes
3answers
74 views

Additional confirmation for online bank payments

Nowadays, when someone is making an online payment, the associated bank often requires an authentication step. As far as I know, there are mainly two ways to do this: SMS Verification. The Bank ...
0
votes
0answers
13 views

Password Managers — Generating Passwords On The Fly a Safe Approach? [duplicate]

Most password managers store user credentials for individual services encrypted on their own back-end databases, so that your passwords are available on multiple devices. So, a DB compromise on these ...
-8
votes
1answer
176 views

Sign In vs Log In [closed]

Using Web apps, I started to believe that these are synonyms. But, suddenly, at the bottom, developing a web app, I received the following response from a Google server: {"google_logged_in":false,"...
-2
votes
1answer
106 views

What scenarios really benefit from signed JWTs?

UPDATE: I have concluded my research on this problem and posted a lengthy blog entry explaining my findings: The Unspoken Vulnerability of JWTs. I explain how the big push to use JWTs for local ...
0
votes
2answers
96 views

Smartphone 2FA has been broken?

This research states that two factor authentication has been broken by the possibility to remotely install an app on a device. I believe that an attacker can publish an app in the store that is ...
4
votes
1answer
57 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
1
vote
1answer
68 views

Pro's and Con's of current 2-step-verification processes?

I am currently working on a project, and we are exploring different types of current industry MFA standards. The most known ones would most likely be HOTP & TOTP pins, which are used in the '...
1
vote
1answer
104 views

Everykey (Bluetooth master key) - is it really secure? [closed]

Obligatory disclosure I have no relation to the Everykey company and do not mean to promote them in any way. I came across the product Everykey that claims to be "your only key" by allowing you to ...
1
vote
3answers
258 views

why don't we store passwords in a database using encryption instead of hashing? [duplicate]

hashing is a one way method, if a user lost his password he will never be able to get that password from the server, so why don't we store passwords in a database using encryption instead of hashing?
5
votes
3answers
274 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
-3
votes
1answer
132 views

Why not just blacklist every IP except yours?

Inspired as a continuation of this question: Is it practical to pre-blacklist certain GeoIP regions? Why would it not make sense to blacklist every single IP address that shouldn't have access to a ...
1
vote
1answer
41 views

What data is sent between an NFC/BTLE FIDO U2F device and Chrome (or other agent)?

I need to explain what "conversation" occurs between a FIDO U2F device (YubiKey NEO) and the agent (Chrome). I want to know if it's a challenge response, and ultimately figure out how much ...
0
votes
0answers
18 views

Is “full loop” and “half loop” authentication the right word to describe this 2FA sequence?

I'm looking for a term to describe this abstract thought about multifactor devices and how they are implemented. In the examples below, there are different levels of device authentication, but the ...
-2
votes
1answer
66 views

Best way to control who can run my application? [closed]

I am planning to make an application and I don't want everyone to use it (only allowed people). What I was going to do is getting the MAC address of the user and add it to our database "allowed_users" ...
0
votes
0answers
27 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
1
vote
1answer
77 views

How important is a static IP address when authenticating with my server?

I am looking to move my business into a small office. I have found somewhere very suitable but unfortunately they cannot provide a static IP address. Currently, to connect to my server from home I ...
0
votes
0answers
20 views

Key Distribution Center Key Protocol Analysis

http://i68.tinypic.com/fwu92v.png As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture ...
87
votes
12answers
12k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
3
votes
1answer
42 views

Relatively simple OTP code generated by SafeNet MobilePass

I noticed something peculiar while logging into the VPN of the company I work for. I generated a one-time passcode from MobilePass, and the code displayed was “010010”. I captured an image of this ...
0
votes
0answers
59 views

OWASP-ZAP and DVWA Login

I need to do a pentest of the DVWA application. To do that, I chose the OWASP-ZAP tool. I followed all the steps of this tutorial. But when I try to run the "spider" the program doesn't find all the ...
1
vote
1answer
48 views

How to secure android REST basic authentication credentials against reverse engineering?

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer ...
1
vote
1answer
34 views

Limiting access to data in a web application from IPs outside the network

My goal is to build a system (PHP + MySQL) where a user will have access to particular data only when logged in locally (from one of the office computers with a local IP), and to all the non-sensitive ...
0
votes
2answers
46 views

SSL protocol analysis

1) What is the use of Cert B in this protocol? 2) What does it prove to Alice? 3) Is it okay if we remove Cert B in this protocol? Even without Cert B, isn't the fact that Bob used his private key ...
1
vote
0answers
58 views

Azure AD B2C vs Auth0

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct comparison?...
-1
votes
0answers
62 views

HMAC Signature Based authentication for REST APIs

We are building publicly available RESTful APIs for eCommerce where clients can place logistics requests with us. We want stateless authentication on these APIs. While on-boarding, every client will ...
1
vote
0answers
44 views

How can I authenticate securely to an internal website from an iPad without an strong password?

I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities: Credentials stored in the iPad (like Gmail credentials). Using ...
2
votes
1answer
53 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
0
votes
1answer
37 views

How can I test my SSO connection without having access to the Identity Provider?

I'm trying to set up an SSO connection using Auth0. My app is set up as the Service Provider (SP), and it needs to work with PingFederate as the Identity Provider (IdP). I don't have access to an ...
1
vote
0answers
32 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
1
vote
0answers
27 views

Dynamic Key Management in WPA through Radius server

Can anybody tell me in detail (or provide good links), how the dynamic key management is done by the authentication server in WPA? In other words, let's say I gave my credentials to the authentication ...
0
votes
0answers
32 views

Use MDC to provide origin authentication for public key encryption?

Why can't we use an manipultation detection code (MDC) to provide origin authentication when using public-key encryption?
0
votes
0answers
24 views

Providing identity verification via confirmed contact info to unconfirmed address w/o leaking information?

I emailed a known e-mail address for my local telecommunications/internet company about a complaint with their service. It appears the person I emailed forwarded this to somebody else in their office ...
0
votes
2answers
41 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. http://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
2
votes
0answers
42 views

What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?

The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include third party legacy services which need a login/...
0
votes
0answers
38 views

Would encrypting a signed JWT prove viable to secure claims payload?

I am working on a server-client web application, and as an authentication scheme, I am issuing base64 encoded json web tokens. Consider the following token... eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
0
votes
1answer
121 views

Why is storing usernames in cookies bad? [duplicate]

A commonly repeated advice over the web is not to store usernames in cookies. However, I don't really understand the problem. What I'm doing in my web application is: I generate a 16-byte (converted ...
0
votes
1answer
45 views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide 33:...
0
votes
1answer
82 views

Handling user login using asymmetric cryptography

Is it possible to implement a login protocol with asymmetric cryptography instead of the hashed password method? For example, while creating an account, the client generates a private/public key pair ...
6
votes
4answers
283 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
0
votes
0answers
51 views

Framework to authenticate web API requests from legacy application

I have a legacy ASP.NET MVC application that uses pretty standard forms authentication which validates logins against an application database. The scope to change this application is limited, however ...
1
vote
1answer
84 views

How is github 2FA personal access token more secure than passphrase?

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
0
votes
1answer
58 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
0
votes
1answer
63 views

Authentication scheme security: unique link and birth date

Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details. ...
0
votes
0answers
115 views

Secure Handshake and register for Auth

The registration The Start - pre-authentication Let's assume there are Alice and Bob. They know each others public keys and each of them generates a random string - Bob's Bobkey and Alice's Alicekey....
5
votes
1answer
101 views

Why does Android care about differentiating multiple fingerprints?

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this ...
1
vote
0answers
41 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
0
votes
0answers
41 views

Token-based SSO for multiple domains for backend API requests

I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we ...