Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

20
votes
6answers
2k views

Web authentication - password vs key file

There is a corporate web mail site (PHP + MySQL) for limited numbers of users who are employees of a company working remotely with the corporate web portal. Each user has a login and password. I'm ...
0
votes
2answers
202 views

Best practice for two WebServices that have to authenticate with each other [closed]

I have two WebServices that are hosted by two different applications. Both Applications access each other's webservices: Now both WebServices have to authenticate with each other. Different ...
1
vote
1answer
239 views

Secure way of opening web page from iOS without need of logging in

I am developing an iOS application and web page, both use same Parse backend. Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the ...
2
votes
1answer
600 views

How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw?

According to this post (and to my personal experience), installing the Skype app on Facebook and the Skype client on OSX Mavericks will result in you being logged out from Facebook every time you ...
3
votes
3answers
378 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
0
votes
1answer
191 views

ChangeCipherSpec Authentication

According to RFC 5246, 7.1. Change Cipher Spec Protocol: The ChangeCipherSpec message is sent during the handshake after the security parameters have been agreed upon, but before the verifying ...
-1
votes
1answer
71 views

What are relation between security services? [closed]

message confidentiality message integrity message authentication non-repudiation The 4 services are related in the sense that one services often implies/provides another. Indicate for each service ...
0
votes
0answers
319 views

CAS protection against CSRF attacks

A website based on Apache Struts uses central authentication service (cas) for login. I'd like to know if additional csrf protection needs to be provided with Struts in case cas doesn't provide that. ...
3
votes
3answers
181 views

Is an emailed PIN for 2FA worthwhile?

To log in to our web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password login, which ...
1
vote
1answer
89 views

Does a username/password + emailed PIN count as strong 2FA?

To log in to a enterprise web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password ...
2
votes
1answer
475 views

Implementing password-reset in a web application by authtoken over email

I think I have a basic understanding of security concerns, but I feel like if I don't know everything, I'm going to implement lousy solutions. Below is my current strategy; Have I overlooked obvious ...
17
votes
4answers
8k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
2
votes
2answers
400 views

Is this token based web service secure?

Note: Original question asked at http://stackoverflow.com/questions/24012390/is-this-token-based-web-service-secure but here seems to be the right place for it. The company that I current work for ...
2
votes
1answer
263 views

Using OAuth as Security For E-Commerce Sites

I need some help in understanding the security risks if I want to use OAuth 2.0 (Facebook, Twitter and G+) as standard login provider for an E-Commerce site. Keeping in mind that I will not be saving ...
1
vote
1answer
4k views

Bypassing CVE-2010-4478 (J-PAKE parameter validation) in OpenSSH 5.1

Did anyone successfully exploit CVE-2010-4478 in the past? This is insufficient validation of the J-PAKE public key parameters in OpenSSH up to 5.6. I'm dealing with a vulnerable machine running ...
4
votes
1answer
242 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote machine,...
0
votes
2answers
911 views

When I reset my password for my Microsoft account, how do they know what password I've used before?

Assumption used: all password that I've used have been salted with some random elements before hashed and stored somewhere in their database. If my previous password exists only as salted-hashes in ...
6
votes
1answer
876 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
3
votes
1answer
2k views

HMAC secret key client storage

I've read numerous articles about using HMAC and the secret key for client authentication in a RESTful client (Javascript) application today. Still, I don't find a single source that is able to ...
0
votes
1answer
221 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
1
vote
2answers
184 views

Is it safe to rely on text messages as a means on authentication?

Many websites, including banks, use text messages as their primary or secondary means of authentication. In theory, it sounds like a perfect method unless the user loses their phone or has it infected ...
8
votes
4answers
498 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
1
vote
1answer
73 views

Are there other ways for a CA to have their certificates included in a browser?

From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser. What if the root certificate of a particular CA is not included in the web ...
0
votes
1answer
105 views

Secure end-to-end when part of conversation must be over HTTP

We have a situation where a user's identity can be verified as follows: the network provider knows the identity of the user and injects secure headers into the HTTP request, which our servers can use ...
-1
votes
1answer
130 views

Prevent someone to login to my website from teamviewer

I have my own suspicions that there are blocked users of my website that use Teamviewer to login to my site from their friends' pc. Is there any way to identify if the one who visit a website is using ...
4
votes
4answers
740 views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
44
votes
4answers
7k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
0
votes
2answers
222 views

RSA for authentication?

Is it possible to use RSA public and private keys to authenticate two computers (or to make sure they're both the right computers)? If so, how? Thanks!
3
votes
1answer
993 views

Does using token-based auth make CSRF checks on login unnecessary?

Based on my understanding, avoiding the use of cookies as an authentication mechanism prevents CSRF vulnerabilities entirely (namely token based authentication in an SPA), when authenticated. Does ...
1
vote
1answer
217 views

How do I migrate users with shared email addresses to an email-based forgotten password process?

I'm migrating users from custom application-level authentication security (built into the app, using username as the unique identifier) to security as a service (using ThinkTecture's Identity Server ...
1
vote
2answers
184 views

Authenticated sessions and Man in the middle

I see a lot of websites (including Stackoverflow) using this authentication mechanism: Client authenticates under HTTPS and gets back a session id. Client drops back to HTTP and accesses secure ...
39
votes
12answers
7k views

Sending passwords to someone remotely

As someone who usually works with people in other countries it has always been a problem to send login information to each-other. For development login details like debug databases etc sure I can ...
1
vote
3answers
590 views

failed Login attempts logic

I want to add security to the system login. So here's my idea: If a user tries to login with a valid username but invalid password, then count it as a failed login attempt and store it in the users ...
0
votes
2answers
366 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
1
vote
1answer
136 views

what are security flaws on providing access to users through a unlisted/private/token/signed URL?

Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which ...
4
votes
3answers
2k views

PHP IP check as security?

Would just like some input on a PHP script I'm writing. It's just a simple script that only myself should be able to access. I don't have a dynamic IP address, so this isn't an issue for me, but I'm ...
2
votes
0answers
174 views

Why is AWS phasing out public/private key authentication? [closed]

I'm working on the authentication strategy for my app (again). My current strategy is a clone of the AWS strategy of issuing public and private keys and using them to sign requests sent to my API. My ...
7
votes
4answers
518 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
0
votes
1answer
205 views

Using encrypted data in session key instead of random

I am writing a service-oriented (REST) application that is (nearly) totally stateless: it can authenticate by API keys, but for web UI it uses the session where it stores nothing but an authenticated ...
1
vote
1answer
530 views

Challenge-response login without storing a password equivalent

A problem with many challenge-response login systems is that the server has to store a password equivalent. For example, if the server stores SHA1(salt + password), and an attacker captures that hash, ...
-1
votes
3answers
116 views

How would authentication when depositing, and withdrawing money from a fund, differ?

I have to do a presentation on developing an authentication plan for a financial services application used to manage an investment portfolio. I have to develop use scenarios for the 2 functions (...
4
votes
1answer
296 views

Is it a security risk for users not to logout of a website?

Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause ...
0
votes
2answers
519 views

Creating port-specific SSH authentication for the same user

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...
1
vote
4answers
2k views

Log in with email is more secure than a username?

Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
4
votes
1answer
1k views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
1
vote
2answers
2k views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
2
votes
3answers
3k views

Determining the accuracy of a biometric system

How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?
0
votes
3answers
63 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
1
vote
3answers
113 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
4
votes
2answers
152 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...