Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

9
votes
3answers
10k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
0
votes
1answer
158 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
7
votes
3answers
2k views

Is my session-less authentication system secure?

So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
1
vote
1answer
488 views

RADIUS proxy chains

RADIUS is a widely deployed remote authentication protocol. I'm looking here at its use in wireless roaming. The RADIUS protocol allows for proxies and chains of proxies: |CLIENT|<->|Access ...
4
votes
3answers
798 views

Two-Factor Authentication: When is it worth it?

I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
3
votes
1answer
4k views

what is the role of RADiUS server and Active Directory to increase the security in wireless networks?

In the CBT Nuggets Video Training, one slide about Wireless networks : i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and ...
3
votes
4answers
2k views

Client Certificate in SSL HandShake insecure?

Imagine we have an application which is trying to establish a secure connection to a server by using SSL. Now we want the user to authenticate himself with a client certificate which he stores in an ...
6
votes
1answer
2k views

What is the opaque field in HTTP Digest Access Authentication used for?

Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value ...
0
votes
2answers
406 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
2
votes
3answers
3k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
18
votes
6answers
2k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
4
votes
4answers
2k views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
1
vote
1answer
347 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
2
votes
1answer
103 views

What's the best way to enumerate log/sign in attempts?

For sign in via a website, what is the best way to count the number of attempts that is: least vulnerable to tampering reliable quick The system would: use HTTPS throughout the sign on phase (at ...
0
votes
1answer
8k views

How to create trusted chain of certificates if I have the last certificate?

Good day. During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using) My server is: telnet xmpp.odnoklassniki.ru ...
9
votes
2answers
4k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
5
votes
3answers
6k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
-1
votes
2answers
823 views

How can Facebook 2FA mechanism be hacked? [closed]

two-factor authentication process that uses one-time random code,I think season hijack can be used, I would like to know if there are more techniques to crack it. With season hijack, I think that if ...
16
votes
4answers
11k views

why a client authentication is not commonly performed in the TLS protocol?

Is there any reason for this other than key/certificate management on the client-side?
26
votes
11answers
3k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
3
votes
2answers
226 views

Secure login across two web apps

I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is ...
3
votes
1answer
171 views

SRP: Can the client authenticate using only the stored hash?

Based on the description of SRP, it seems that it would be possible for a client application to cache the hashed password x and reuse it for subsequent authentifications. The actual password p doesn't ...
3
votes
2answers
763 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
3
votes
4answers
396 views

Login form authentication logic

I am building my login form action, and I want to make sure my logic is solid and as secure as possible. 1.) First I check if the provided e-mail address exists in database, if not, I show a generic ...
54
votes
12answers
3k views

How do you log in from an unsecured computer?

Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
5
votes
2answers
4k views

When using symmetric key encryption, do we need to sign?

Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
-2
votes
1answer
241 views

Digest authentication - client side [duplicate]

Possible Duplicate: Client side password hashing How one design support for digest authentication in client side. HTML form probably won't help. Does one need javascript and set the header ...
5
votes
2answers
1k views

How to login and encrypt data with the same password/key

I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
16
votes
2answers
457 views

Which factors should I consider for devices that accept handwritten digital signatures?

These days many locations ask you to give your signature on a digital signature pad/device. As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
7
votes
2answers
578 views

An adequate message authentication code for REST

My REST service currently uses SCRAM authentication to issue tokens for callers and users. Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
12
votes
2answers
18k views

How does ssh public key authentication work?

My basic understanding is this: The (connected to) server's sshd uses the public key to encrypt some message The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
5
votes
1answer
2k views

False negative in biometrics

In biometric systems preventing false positive is usually far more important than preventing false negatives. In what situations can false negatives be more serious than false positives?
7
votes
4answers
345 views

How to suspend a user from my website and prevent them from creating a second account?

I am an outsourcing person, not a programmer. My website is a shopping website (think eBay). My website will need a user suspension feature, in case a user violates the terms and conditions. The ...
2
votes
1answer
716 views

Can Diffie-Hellman Anonymous be used as a cipher for SSL for one-way certifiate-based authentication

I want to use Diffie-Hellman anonymous cipher for SSL. I also want to use a one-way certificate for server authentication. Is this possible?
3
votes
1answer
288 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
3
votes
4answers
148 views

Strong authentication over insecure links

Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the ...
2
votes
1answer
217 views

Mitigate risk of security questions [duplicate]

Possible Duplicate: Do security questions subvert passwords? Many Web sites nowadays require a (hopefully strong) password along with some pretty easy security questions. Sometimes it is ...
2
votes
1answer
862 views

Password authentication using DynamoDB

I'm working on a Mac app. I have users stored using DynamoDB. Authentication is needed to enforce access control on system-internal operations, such as uploading files to Amazon S3. Of course, I ...
9
votes
2answers
879 views

My bank makes me enter my password using the mouse. What's up with that?

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
1
vote
0answers
248 views

Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]

I have installed openssl and now the rsa_test.c is running fine. What I want to do is: Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey. The public key contains the ...
5
votes
2answers
2k views

Do Client Nonces enhance the security of HTTP Digest Auth?

As far as I understand the answer at http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...
5
votes
1answer
284 views

Does DPAPI works if a user hasn't a login password?

I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
3
votes
2answers
404 views

Wi-fi security using WPA or WEP

In current years we have used WPA and WPA 2 for the encryption of data sent over an 802.11 network. But in the past WEP is used . From time to time, many people say that WEP (Wired Equivalent Privacy) ...
11
votes
2answers
1k views

BCrypt's 72-character limit and using it as a general digest algorithm

Goal: have token/cookie-based authentication that doesn't require keeping sessions on the server TL;DR: What, if any, is the accepted mechanism to work around the 72-character limitation of BCrypt? ...
1
vote
1answer
612 views

Silent (no user interaction) utility to clear cached credentials on Windows [closed]

Is there any way to clear cached credentials on Windows, that doesn't require: user interaction (e.g. a confirmation window); administrator access; or making a persistent change to the ...
4
votes
1answer
812 views

How to disable caching of form data?

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ...
5
votes
1answer
527 views

Secure web user authentication even after server-side database compromise

By now, we should all know to use bcrypt or scrypt to store salted password hashes with a sufficient number of rounds. (See, e.g., https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) The ...
10
votes
4answers
835 views

What is the key when facial recognition is used as a password?

I get the basics of what face recognition is and the fact that it is used to protect PC's and as a login replacement. However, if it was to be used for encryption, where the role of the key is played ...
3
votes
3answers
3k views

is it possible to create a login “key” out of a USB drive?

I was recently thinking about keeping my computer secure from physical access, and i decided that the safest way to keep my data under lock and key, was to do just that: Create a lock and key out of a ...
2
votes
6answers
1k views

Does Username + Password + Pin improve login security?

I've been asked to add a feature to a website to require a pin for users. The site currently uses username and password. If a user wants to change their password they need to supply the current ...