Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

5
votes
1answer
2k views

Hotspot with same SSID, how does authorization work?

My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network. If someone sets up ...
1
vote
2answers
378 views

Storing Seed for TOTP

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
0
votes
1answer
568 views

Challenge, Authentication and session key

I programmed an application on Linux using C, I added an authentication and cryptography layer that's going like this : 1 -client sends connection request. -server send a random challenge to client. ...
1
vote
1answer
510 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...
4
votes
2answers
974 views

Is OATH TOTP and / or Google Authenticator vulnerable if an attacker has (N) previous codes?

I'm not much of a ipsec initiate, so this is a bit over my head ... but I'm always willing to learn more. Are there any known attacks against OATH TOTP (Google Authenticator's / Authy's algorithm) if ...
0
votes
2answers
393 views

In a SAML2 FSSO Web Browser profile (HTTP POST), should the IdP analyse the AuthnRequest before asking the user to authenticate? [closed]

Context: SAML2 Web Browser SSO profile. (HTTP POST binding). Federated SSO. If the IdP gets an <AuthnRequest> from the SP, should / must / can the IdP do the user authentication first, or ...
14
votes
4answers
760 views

Entering passwords at public computers

Sometimes it happens that I have to access my email or some other web service from public machines. Are there any options to make it secure or at least reduce risks to acceptable levels? I am most ...
1
vote
1answer
761 views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...
5
votes
2answers
2k views

Website: Pre-Shared-Key Authentication

We have this web-application with high valuable (business) data. All communication is encrypted through TLS/SSL. While I consider this a really safe protocol, it can still be compromised if someone ...
8
votes
1answer
235 views

Are most app OAuth implementations vulnerable because of an obscured URL/origin?

I cringe every time I am prompted with OAuth in an app because of the lack of ability to verify that the page is actually originating from the represented source. Are most app OAuth implementations ...
3
votes
2answers
409 views

Is there any way to cryptographically hash a human thumbprint?

Is there any way to cryptographically hash a human thumbprint into a form that can be consistently reproduced by thumbprint readers? Assuming that it would be possible to create a database of ...
2
votes
4answers
6k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
1
vote
0answers
181 views

Remote desktop connection different networks password non VPN [closed]

I'm looking for a solution to bring support to users from a big network to other users into little networks. The idea is to keep control of content (no VPN). Also it's important that always users who ...
8
votes
3answers
2k views

iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

With such a big deal being made about the iPhone 5S's fingerprint reader (and formerly the Thinkpads' fingerprint readers) I really wonder how secure it is to use fingerprints in lieu of passwords. ...
1
vote
2answers
131 views

Verify a user's affiliation with an organization

I'm in charge of IT at a students' organization. Let's call it FratA. FratA has ties to sister-organizations in other university cities in my country. Let's call those FratB through FratZ. These ...
27
votes
9answers
13k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
4
votes
2answers
536 views

Login security without SSL

I have a web app without SSL (I know it's not good, I try to take it as a challenge). The login is two step. First the admin sshs into the server and runs a maintenance companion program that provides ...
0
votes
1answer
40 views

Restrict access to a specific type of entity

I want to create a web service that can only be accessed by a specific type of entity: my own mobile application. Is there any well-accepted methods to do this? I'm thinking about embedding a secret ...
10
votes
2answers
5k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
4
votes
2answers
223 views

Can the client certificate authentication process treated as a user digitally signed the content(and then get verified on the server)?

The authentication was triggered by certain event (like approving button) on the form. In the process of client certificate authentication (in IIS), user was asked to use their PIN (private key) and ...
5
votes
1answer
464 views

Safe to drop email verification when using Facebook login

If a user registers an account on my Website with Facebook authentication, can I safely skip the "verification email" that is usually sent to users who sign up without Facebook (that is, from a ...
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
1
vote
0answers
241 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
2
votes
2answers
653 views

Are Yubi Keys secure “out of the box” when purchased for use with Yubi Cloud?

The YubiKey personalization tool allows someone to configure a YubiKey for HOTP, challenge response, and a variety of other authentication formats. YubiKey offers a number of personalization tools ...
2
votes
4answers
556 views

Is there a way to keep sudoers from editing stuff in /etc/ssh/sshd_config?

I have root login disabled in SSH and I want to be able to eliminate the possibility of a sudo user editing the /etc/ssh/sshd_config file and enabling root ssh login. Is this possible?
0
votes
1answer
674 views

configure squid to use another digest proxy

I'm connected to a squid proxy that does digest authentication , and I have installed another squid proxy on my centOS 6.4 and configured it to use the upper proxy . The problem is that I need ...
6
votes
7answers
4k views

How can I best manage root passwords for many servers?

Lets say I have two racks with about 40 nix servers in them. I don't want to set all of the root user passwords all the same do I? If not how do you manage and keep up with all of the passwords? Is ...
3
votes
2answers
229 views

Risks for a new type of website login feature

What would be a security risk for a website feature that allows you to connect to your account without typing your password, given that you allowed such a login for the next say 10 seconds from a ...
2
votes
2answers
2k views

Is this REST service authentication system secure?

I have to implement a token based authentication for a RESTful web service. This is the first time I'm implementing security features in a software, and this is what I have in mind for now : The ...
0
votes
1answer
499 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
2
votes
2answers
262 views

Dual Authorization (Social Auth 2.0)

Can you see any obvious challenges to requiring 2+ users to confirm authentication requests using an association such as a friendship type of relationship. A practical application would be an ...
30
votes
5answers
2k views

What are the security implications of storing password blacklist?

I want to add a password blacklist that would prevent the 1000 most common passwords from being used in order to mitigate shallow dictionary attacks. Is there any negative implication of storing this ...
6
votes
2answers
1k views

Is it wise to log failed login attempts of non-existing accounts?

In terms of application layer authentication, it is common to track failed login attempts to existing user accounts. However, I have not seen anyone tracking failed login attempts of non-existing user ...
1
vote
5answers
1k views

What are the benefits and drawbacks of emailing a user a login token/link?

The Question I was reading a forum last night discussing the idea of emailing a user a login link, much like a password reset link, so they don't require a password. Their email address is already ...
4
votes
4answers
2k views

Is it safe to show user a message if account is locked

I am working on a web application, security is high priority. So, if a user has failed to login more than 3 times, the account will be locked. Should I display a message to the user saying "your ...
0
votes
0answers
765 views

Why do you need to login after you change a password? [duplicate]

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
1
vote
1answer
553 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
30
votes
4answers
4k views

Disclose to user if account exists?

Someone told me it shouldn't be possible for someone to detect if a certain email address is a registered user on a Website. So, for instance, when the user asks to reset his password, you should say ...
5
votes
1answer
4k views

WCF - Is this a good security Architecture?

I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users ...
0
votes
1answer
253 views

Protecting Website Static Resources

If I have a website that is only accessible by authenticating at a login page, is it possible for a non-authenticated person to get access to static assets (images, css, javascript, ...)? I imagine ...
1
vote
0answers
352 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
3
votes
2answers
471 views

Security measures for “Forgot password” link

I noticed that Facebook sends out a "Forgot password" code of six digits, which is very short for a validation code, so I assume they are doing the following: Set a session variable which is linked ...
3
votes
1answer
372 views

Why do major sites (eBay, Github) not ask for a password when I attempt to change email addresses?

When users change their email addresses within a web application's user account, I see the following problem: An attacker (who has access to your session) could change your email address to a new one ...
2
votes
3answers
226 views

Alternative to charging 2 small amounts for credit cards authentication?

Currently the client I'm working for charge 2 small amounts on adding credit card to authenticate credit card. After that they ask end-users to check the exact amounts on their monthly statements and ...
0
votes
2answers
856 views

Is there a way to configure WPA2-PSK to provide Forward Secrecy?

Is there a way to secure an wireless connection against a decryption attack where the PSK is known (E.G. Airdecap-NG)? Is it possible to configure Forward Secrecy on 802.11 Wireless Connections?
0
votes
1answer
108 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
2
votes
2answers
1k views

Security behind the windows 8 eye

I use the Windows 8 operating system. Whenever I navigate to the login page of Internet Explorer 10, or even the login screen of the operating system, I see an eye symbol at the end of the password ...
5
votes
4answers
644 views

Pin + guid in URL secure for a web app?

We have an ongoing project at work in which the security is a hot topic of debate. The whole site is SSL and proposed auth process is like so: User receives a non-unique 4 digit pin number in ...
4
votes
6answers
370 views

Ban or delete abusive users [closed]

I'd like to hear recommendations on a best practice for handling abusive users (for whatever reason) on an authenticated Website. Is there any point in keeping the user in the database with a ...
2
votes
1answer
143 views

Extended Basic Authentication

I would like to implement a REST API with Basic Authentication which relies on username and password. Because REST is stateless the user would have to reenter username and password for every request ...