Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

107
votes
19answers
27k views

How should I securely type a password in front of a lot of people?

I am a manager in an office where the company does not provide a company email, so I use my personal email. Often, I will receive jobs lists by email from my general manager. How should I log in to ...
6
votes
2answers
69 views

HMAC with or without data encryption?

I'm in the process of developing a system that periodically transmits a small amount of data (16/18 bytes), where the only part that will change is a 4 byte counter that will increment for each ...
2
votes
2answers
79 views

What does it mean to have authentication without confidentiality or authentication without encryption?

I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. ...
1
vote
0answers
22 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication ...
1
vote
1answer
27 views

Allowing VIP Access Credentials from Mobile Devices (smart-phones/BB) but not Desktops

What could be an explanation for such a decision by a company? Simple oversight, or deliberate choice? It seems like a mobile device is easier to lose/crack. ETA: The company is using it as a 2FA for ...
2
votes
3answers
142 views

Is it ok to send plain-text password over HTTPS? [duplicate]

I understand why the password should be salted and hashed before being saved into the database, but my question is if it needs to be hashed on the browser side or just sending plain-text password over ...
1
vote
1answer
95 views

Could EA know my password across multiple sites?

A few days ago I received an email from EA stating they reset my password because it may be compromised: The password for your Origin account was recently reset because a standard systems analysis ...
1
vote
0answers
42 views

Why is CertificateVerify message necessary? (Why isn't client authentication done through the KeyExchange)

Why is client authentication not done throught the KeyExchange like with the server, but through a CertificateVerify message? EDIT: To be more clear: When using RSA key exchange the client encrypts ...
0
votes
1answer
39 views

2 step authentication hybrid

I'm all forward on 2 step authentication. I understand how it is way more secure than a simple password. However I'm always afraid to start using it because I believe that in some cases I could be ...
3
votes
3answers
120 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
1
vote
1answer
57 views

Risks of letting user know if the username is invalid? [duplicate]

I notice most websites simply say "user name or password is not correct", however some will tell you if the user name does not exist. Are there any security risks letting the user know if they ...
0
votes
0answers
18 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
34
votes
3answers
3k views

Overarching term for 'authentication' and 'authorization'?

The internet is rife with 'authentication vs. authorization'-type questions. I'm not asking that here. I'm wondering if there is some overarching term that encompasses both of these. I've seen ...
7
votes
2answers
95 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
0
votes
0answers
49 views

Passive authentication

I am a relatively new developer to advanced information security related features, hence please pardon me for any mistakes. I came across the concepts of passive authentication and active ...
1
vote
2answers
120 views

Is it safe to use Google Authenticator app and SMS instead of passwords

I currently want to start web development where I will be making a login system and want an alternative to storing passwords. The question is: is it safe to use the Google Authenticator app as the ...
1
vote
0answers
73 views

Steam two-factor authentication algorithm? [closed]

I'm all on-board that Value is recently pushing for two-factor authentication on Steam accounts. I'm not happy that they force you to use the Steam mobile app because both on iOS and Android, it's a ...
10
votes
3answers
781 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
23
votes
4answers
5k views

Why did Richard Stallman recommend not to use passwords for wireless networks? [closed]

In a short interview, Richard Stallman recommends not to put passwords on your wireless network. In the OS Revolution documentary he also mentions how he's disliked passwords ever since his job at MIT ...
4
votes
1answer
70 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
13
votes
2answers
3k views

Is this a secure data exchange scheme for a game?

I am writing a multiplayer game. I have a central server which processes everything. For data exchange I use HTTPS protocol. Because this is a game I cannot use computationally expensive systems like ...
0
votes
2answers
128 views

Disclosing too much info over email just to close account?

I have account with a stock option trading platform. They are well known and reputable. I had a couple thousand in the account, bought and sold for a while, and then cashed out and withdrew. So I'm ...
4
votes
1answer
57 views

What types of trade-offs are appropriate when using encryption/authentication on devices with low bandwidth?

This is my first foray into this Stack Exchange, and I have limited knowledge of the InfoSec world, but I'll try to make this a pointed, answerable question. I'm tasked with investigating including ...
0
votes
2answers
37 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
2
votes
0answers
26 views

OAuth2 client account & data storage [duplicate]

Context I have a REST API where a user can create an account from a web client. The password is saved as a salted hash in a database. When a user is authenticated they can save and retrieve private ...
2
votes
1answer
38 views

Wired Deauth-Like Attacks

[story] Good Evening Guys, I just got out of a lan house which uses a system named Geto (Geto Lan House Management System 4.0), and I was wondering if it is hackable. [/story] While searching for ...
4
votes
2answers
142 views

Kerberos vs. LDAP for authentication — which one is more secure

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? And Can we switch between them transparently?
5
votes
0answers
63 views

Samba printer usernames and passwords , security problem

Password leaks , printing from Linux client to windows based print server When authenticating Linux users for using a windows share printer on their machine, the windows domain user-name and password ...
4
votes
5answers
220 views

Avoid unauthorized updating of online leaderboard php/sql [duplicate]

I am developing an offline web app (game) for android using cordova (phonegap). The leaderboard of the same is maintained online in my server. Currently this is how the leaderboard is updated Step ...
3
votes
1answer
170 views

SQL Injection - login bypass [closed]

Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button. Info on what I have and was able to find out: it is ...
3
votes
1answer
53 views

Proper secret key management

Right now, I'm thinking that for all incoming requests, my server will check the token of the request against the token constructed from my app's global secret key for authenticity. The only way for ...
1
vote
0answers
24 views

central auth servers and in-app password changing

BLUF: philosophically, when (if?) should (web) services that use a central auth server add the power to change passwords? Simplified definitions, for the sake of this question: Central Auth Server: ...
3
votes
2answers
65 views

Multi-factor authentication - email link

I'm trying to understand possible issues with the approach of sending the MFA one-time-token to the user as a clickable link in the email. Instead of submitting the OTP on the web page, user will ...
0
votes
0answers
30 views

Persona private key storage?

Following the Q&A here, I have a few remaining questions: I am still confused about whether the could be any local access from a malicious browser extension to this shimmed private key or not? ...
-1
votes
1answer
38 views

Token in URL changes on click [closed]

Logging into OpenCart admin, I find a token in its URL: http://localhost/opencart/admin/index.php?route=common/dashboard&token=xOHq2UzQ0YwKTubXgxNpGFySmAA9W90z The synchronizer token pattern is ...
3
votes
1answer
68 views

Security problems with password-less SSH

Is there any downside of configuring password-less SSH authentication? Although it is very handy and secure, if someone gets access to my system with my account and there is password-less ...
5
votes
1answer
41 views

How should resource providers validate OAuth2 tokens?

Resource providers often provide read and write access to resources. A resource provider should therefore not only validate the token (is it expired? is it revoked? is it valid? does it contain the ...
1
vote
1answer
65 views

When automatic login may be acceptable from the point of view of security?

In my organization some IT people is requesting to install devices with automatic login configured. The reason they defend is that the user will be able to perform only very low risk actions: for ...
20
votes
3answers
270 views

What precautions should I take when creating users that will be used by applications and not by people?

I have some applications that need to access to a webservices bus. Own applications that access to the bus authenticate using a webservice on that bus but in this case I need that third party ...
4
votes
2answers
96 views

Can Simultaneous Logins Occur When Two Users Have Both Pieces Of Two-Factor Authentication Information?

In a hypothetical situation (say a screen capture program or rootkit, where, incidentally, a password change will not make any difference) where an attacker has both your password, and sees the ...
0
votes
1answer
42 views

Create mod page for an anonymous website

I developed a website. There is no login section in the website. I didn't want to force people to sign up. Now I have a problem. There are a few .php pages that only I should access. How can I do ...
1
vote
0answers
102 views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
-2
votes
1answer
81 views

Storing Data Without Knowing Anything About the User

Let me start by stating that this is really my first foray into encryption. I have written username/password systems, and such, and am familiar with salting and hashing passwords... but I have never ...
4
votes
2answers
83 views

Prevent CSRF attack using regular expression, session storage, and auth token?

User login to my Web API Service using his user name and password. Web API Service response auth token to client browser. Client browser save auth token to session storage using JavaScript. Client ...
1
vote
1answer
86 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
1
vote
1answer
43 views

does the --nack command do what I think it does in reaver and why won't it work?

I have a problem with reaver. I try the --nack command reaver -i mon0 -b 00:01:02:03:04:05 -vv --nack --mac=00:BA:AD:BE:EF:6 for example. And I assume it will try a different PIN, even if it ...
0
votes
1answer
124 views

Protect software from copy [duplicate]

Imagine I wrote some software on .NET which will run on client machine. Is it possible to detect that someone copied my software to different computer? (Assuming my software can connect to a remote ...
3
votes
3answers
78 views

Custom Authentication in a RESTful API - Will this work?

I was just wondering if this would be a reasonable way to write a custom authentication method for a RESTful API. It seems moderately secure, but perhaps I'm way wrong here. 1) Email and Password are ...
20
votes
7answers
3k views

Are reCAPTCHA enough to prevent brute-force password guesses?

I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
-3
votes
2answers
73 views

Client certificate vs HMAC

My team is working on web API project for one customer which will call this API. Now we are thinking about authentication. We've stopped on two options HMAC and client certificates HMAC: pros - no ...