Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

35
votes
3answers
31k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
34
votes
3answers
3k views

Overarching term for 'authentication' and 'authorization'?

The internet is rife with 'authentication vs. authorization'-type questions. I'm not asking that here. I'm wondering if there is some overarching term that encompasses both of these. I've seen ...
34
votes
4answers
4k views

Disclose to user if account exists?

Someone told me it shouldn't be possible for someone to detect if a certain email address is used by a registered user on a website. So, for instance, when the user asks to reset his password, you ...
34
votes
4answers
20k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
34
votes
3answers
19k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
32
votes
11answers
4k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
32
votes
2answers
14k views

HMAC - Why not HMAC for password storage?

Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. Let's say ...
32
votes
2answers
4k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
32
votes
4answers
2k views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
31
votes
4answers
3k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
31
votes
5answers
6k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
31
votes
5answers
2k views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
30
votes
6answers
4k views

How safe are employee laptops in China against International corporate espionage?

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. This loaner had MS Outlook and was linked to my normal company ...
30
votes
7answers
5k views

Silently Limiting Login Attempts

I've seen the following login rate limiting approach used on a web site I worked on, but I can't figure out if it's a good idea: After any failed login attempt, the site locks the user account for a ...
30
votes
3answers
5k views

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. ...
30
votes
5answers
2k views

What are the security implications of storing password blacklist?

I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
29
votes
4answers
24k views

How to achieve non-repudiation?

If I have a message that I need to send to another person, how do I achieve non repudiation ? Is digitally signing the message sufficient ?
29
votes
3answers
189k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
28
votes
7answers
3k views

What is a good way to authenticate a user to a smart phone?

What would be a good way to authenticate a user to a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be ...
28
votes
6answers
39k views

What is single sign on versus federated login?

What is the difference between Federated Login and Single Sign On authentication methods?
28
votes
2answers
31k views

Why does HTTP Basic authentication encode the username and password with base64?

RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64. To receive authorization, the client sends the userid and password, separated by a ...
28
votes
5answers
3k views

Should usernames be kept secret?

Help me settle an discussion among colleagues and guide future design: Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
27
votes
7answers
12k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This ...
27
votes
4answers
12k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
27
votes
9answers
15k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
27
votes
8answers
3k views

Share certain information only after death

After your death, you want to make sure that a special someone gets a vital piece of information (like the password to your bank account), but: You don't want anyone else to be able to get that ...
27
votes
3answers
1k views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
26
votes
7answers
4k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries ...
26
votes
9answers
2k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
26
votes
9answers
3k views

How can I ensure that I connect to the right wireless Access Point?

Under Windows/Linux, client side. How can I ensure that I'm not connecting to a rogue AP?
26
votes
4answers
3k views

How is “something you have” typically defined for “two-factor” authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
26
votes
2answers
7k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
25
votes
10answers
7k views

Two passwords for one account

Would it be a good idea if you had one account which would require two different passwords ? For example your login details were: email: example@gmail.com password 1: P4$$w0rd1 password 2: ...
25
votes
5answers
7k views

Why is “something you know” the weakest factor of authentication?

Quoting from CompTIA Security+ guide The first factor of authentication (something you know, such as password or PIN) is the weakest factor. Why? it makes sense when we say that humans/users ...
25
votes
10answers
6k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
25
votes
3answers
2k views

Is authentication using personal pictures more secure than passwords?

Statement 1 There is a start up called PixelPin. On the web site it reads: The PixelPin solution is simple and quick to use, yet very secure. PixelPin eliminates the traditional alphanumeric ...
24
votes
5answers
30k views

Preventing deauthentication attacks

I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network. I captured and analyzed the network traffic on my Wifi work ...
24
votes
4answers
4k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
23
votes
9answers
4k views

Is it helpful to have a captcha on a login screen?

I introduced recaptcha to the login screen of a system. My goal was all about security things like dictionary/bots attacks or other thing of that type. The users now hate it, Some did not even ...
23
votes
5answers
6k views

How to uniquely identify users with the same external IP address?

I have created a login module on my website. I was able to deal with simple brute force attacks since I can identify the user based on username/email and throttle their login based on failed login ...
23
votes
3answers
4k views

What are the disadvantages of implementing HTTP authentication in a web application? [duplicate]

I know that there are different types of authentication mechanisms available. One among them is the HTTP authentication. What is the danger in using this method compared to other methods?
23
votes
4answers
5k views

Why did Richard Stallman recommend not to use passwords for wireless networks? [closed]

In a short interview, Richard Stallman recommends not to put passwords on your wireless network. In the OS Revolution documentary he also mentions how he's disliked passwords ever since his job at MIT ...
23
votes
3answers
3k views

How is Google Chrome managing authentication to sites?

In Chrome, every tab is its own process. Yet, logging in to a site, say, Facebook, persists across tabs. For that matter, in many cases, it persists across OS reboots. This seems inherently very very ...
23
votes
4answers
3k views

What are the alternatives to door passcodes?

Passwords have been a problem since the dawn of computing. They tend to be either so complex that no one can remember them, or so obvious that anyone could guess them. ... Some users ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
23
votes
2answers
9k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
23
votes
5answers
3k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
23
votes
7answers
8k views

How to prevent cheating (extra votes) in online contests?

Mitigating Cheating & Voter Fraud in Online Contests… We run online contests of various sorts that involve users voting on entries (usually one vote per user per day). The prizes range from ...
22
votes
13answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...