Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
14
votes
6answers
725 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
13
votes
2answers
526 views
Password and Generated number - How does it work?
In my company, they don't allow accessing the company email or servers from outside the company network.
To access the email from outside the network, you have to use: Username, password and a number ...
13
votes
6answers
674 views
Appropriate password requirements for a login (OpenID) service/provider/delegate/thing
This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements).
Currently, password requirements are:
Must contain 3 of: lower case ...
13
votes
3answers
520 views
What can I do if my bank thinks my date of birth is “known only to me”?
My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name.
...
13
votes
4answers
400 views
Effectiveness of Security Images
Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater?
Per my understanding, if somebody is phishing your users, it's ...
13
votes
2answers
3k views
How secure is Windows 8's Picture Password login?
The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
13
votes
3answers
179 views
Are malicious relying parties able to abuse OpenID logins?
if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me?
Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
13
votes
2answers
1k views
Hiding user account names from unauthenticated RDP sessions
This is for a Windows 7 Ultimate system, which is not a member of a domain.
When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
13
votes
3answers
1k views
Should security question answers be case-sensitive?
Question
In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers?
Scenario
An ...
12
votes
9answers
656 views
Anybody have additional information on the EMC RSA SecurID compromise?
The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
12
votes
6answers
525 views
Is This Login Security Enough?
I'm coming up with my next login system for admins of an ecommerce website to have
login form is SSL secured
password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
12
votes
5answers
28k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
12
votes
5answers
977 views
How should passwords be stored if they must be recoverable?
By "encrypting" passwords you are violating CWE-257: Storing Passwords in a Recoverable Format. But this is exactly what the French government wants. They want to be able to obtain the passwords of ...
12
votes
4answers
278 views
Why aren't digital signatures the standard way to authenticate web clients?
The web is a mess of incompatible cookie schemes, asinine requirements ("your password must contain letters, numbers, and at least one symbol from !()-_., and must begin with a letter, and once you ...
12
votes
5answers
552 views
Is there a digital “safety deposit box” equivalent?
Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy?
There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
12
votes
3answers
795 views
Multi factor authentication on Ubuntu workstations, where to start?
Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed)
...
12
votes
3answers
1k views
Recommended policy on password complexity
Is there any research on how how a password complexity policy can increase or decrease the quality of passwords?
If you don't have any requirements on the password then probably 90% of users will use ...
12
votes
2answers
326 views
Which factors should I consider for devices that accept handwritten digital signatures?
These days many locations ask you to give your signature on a digital signature pad/device.
As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
11
votes
9answers
1k views
2 factor authentication - cost effective solution for a web startup
My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device.
I am doing a web startup in the ...
11
votes
5answers
634 views
Good session practices
What are some good practices for ensuring logins, session IDs and session content are secure for a website?
11
votes
5answers
591 views
Does two factor authentication prevent social engineering attacks
After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password.
Considering three different additional ...
11
votes
4answers
2k views
Google Account: implications of using application-specific passwords
In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
11
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
11
votes
3answers
458 views
Does signing out of a website ensure no-one can cookie hack?
If I click the signout link of a website, does this mean it is not possible for someone to hijack my cookie and sign in with it?
While I'm logged in, is it possible for someone who has access to my ...
11
votes
3answers
2k views
Three-Factor Authentication for Windows
This HowToGeek article...
http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/
...got me thinking.
Is there any software (or combination of software) that ...
11
votes
5answers
972 views
How to implement non-password authentication in a web site
In an answer to this question about pw reset, D.W. says:
Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
11
votes
3answers
245 views
Verifying server software integrity?
I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
11
votes
2answers
927 views
Encryption strategies for multi users access in production systems
I am pretty unknown to encryption strategies in production environments. So my concern is to find a solution how to strongly encrypt data, but make it available to multiple users with different keys.
...
11
votes
2answers
607 views
Biometric versus other Two Factor Authentication Mechanisms
Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
11
votes
1answer
316 views
Is it secure to connect to a remote Windows Server using Remote Desktop only?
I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
10
votes
8answers
1k views
Can IP address be a component of 2-factor authentication?
I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
10
votes
7answers
8k views
Can my email account be accessed without the password? How secure is it?
Can my email account be accessed without the password, and how secure is email if I store my personal documents on it?
And how come Yahoo Mail asks me to tell them my friends and folders names to ...
10
votes
4answers
622 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
10
votes
4answers
1k views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
10
votes
3answers
1k views
Computationally simple, lightweight replacement for SSL/TLS
Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
10
votes
4answers
826 views
Password resets - what practices should web services follow?
Many of you may have seen How Apple and Amazon Security Flaws Led to My Epic Hacking, where a Wired reporter's Amazon, Apple, Gmail, and Twitter accounts were successfully hacked. The hacker followed ...
10
votes
2answers
367 views
Is it a bad idea for an information holder to e-mail a user their password?
A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
10
votes
6answers
3k views
How to set up a single sign-on for multiple domains?
I've set up a single-sign-on for two of our sites that live on the same domain: a.domain.com and b.domain.com
I did it through cookies, but they are domain-dependant. And - as it is written in the ...
10
votes
4answers
504 views
What is the key when facial recognition is used as a password?
I get the basics of what face recognition is and the fact that it is used to protect PC's and as a login replacement.
However, if it was to be used for encryption, where the role of the key is played ...
10
votes
3answers
453 views
Why do some sites ban pasting usernames or passwords?
I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
10
votes
2answers
138 views
Preventing Voter Fraud on a Social Media Contest
I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
10
votes
3answers
424 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
10
votes
3answers
3k views
How do I secure my REST API?
In Detail here's the problem:
I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
10
votes
2answers
207 views
“Pulled from public record” security questions
Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
9
votes
5answers
361 views
CSRF protection with Session Id
To protect against CSRF, couldn't my page javascript just dynamically insert the session id from the cookie into the body of each HTTP request right before it's sent?
The server would then just ...
9
votes
6answers
2k views
How to implement multi factor authentication using a token generator?
I'd like to implement multi factor authentication on a few projects.
Now the first factor would be username and password, for the second factor I would like to use a token generator.
These tokens ...
9
votes
4answers
894 views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
9
votes
4answers
778 views
Can .htaccess and .htpasswd really protect me?
I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
