Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
4answers
2k views

Client Certificate in SSL HandShake insecure?

Imagine we have an application which is trying to establish a secure connection to a server by using SSL. Now we want the user to authenticate himself with a client certificate which he stores in an ...
6
votes
1answer
2k views

What is the opaque field in HTTP Digest Access Authentication used for?

Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value ...
0
votes
2answers
434 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
2
votes
3answers
3k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
18
votes
6answers
3k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
4
votes
4answers
2k views

Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?

I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far Most of what I ...
1
vote
1answer
361 views

Protect database resources from fake data inputs via web forms

Scenario: I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
2
votes
1answer
103 views

What's the best way to enumerate log/sign in attempts?

For sign in via a website, what is the best way to count the number of attempts that is: least vulnerable to tampering reliable quick The system would: use HTTPS throughout the sign on phase (at ...
0
votes
1answer
9k views

How to create trusted chain of certificates if I have the last certificate?

Good day. During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using) My server is: telnet xmpp.odnoklassniki.ru ...
9
votes
2answers
4k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
5
votes
3answers
7k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
-1
votes
2answers
853 views

How can Facebook 2FA mechanism be hacked? [closed]

two-factor authentication process that uses one-time random code,I think season hijack can be used, I would like to know if there are more techniques to crack it. With season hijack, I think that if ...
17
votes
4answers
12k views

why a client authentication is not commonly performed in the TLS protocol?

Is there any reason for this other than key/certificate management on the client-side?
27
votes
11answers
3k views

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
3
votes
2answers
236 views

Secure login across two web apps

I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is ...
3
votes
1answer
181 views

SRP: Can the client authenticate using only the stored hash?

Based on the description of SRP, it seems that it would be possible for a client application to cache the hashed password x and reuse it for subsequent authentifications. The actual password p doesn't ...
3
votes
2answers
795 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
3
votes
4answers
417 views

Login form authentication logic

I am building my login form action, and I want to make sure my logic is solid and as secure as possible. 1.) First I check if the provided e-mail address exists in database, if not, I show a generic ...
54
votes
12answers
3k views

How do you log in from an unsecured computer?

Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
5
votes
2answers
4k views

When using symmetric key encryption, do we need to sign?

Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
-2
votes
1answer
250 views

Digest authentication - client side [duplicate]

Possible Duplicate: Client side password hashing How one design support for digest authentication in client side. HTML form probably won't help. Does one need javascript and set the header ...
5
votes
2answers
1k views

How to login and encrypt data with the same password/key

I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
16
votes
2answers
469 views

Which factors should I consider for devices that accept handwritten digital signatures?

These days many locations ask you to give your signature on a digital signature pad/device. As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
7
votes
2answers
606 views

An adequate message authentication code for REST

My REST service currently uses SCRAM authentication to issue tokens for callers and users. Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
13
votes
2answers
20k views

How does ssh public key authentication work?

My basic understanding is this: The (connected to) server's sshd uses the public key to encrypt some message The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
5
votes
1answer
2k views

False negative in biometrics

In biometric systems preventing false positive is usually far more important than preventing false negatives. In what situations can false negatives be more serious than false positives?
7
votes
4answers
348 views

How to suspend a user from my website and prevent them from creating a second account?

I am an outsourcing person, not a programmer. My website is a shopping website (think eBay). My website will need a user suspension feature, in case a user violates the terms and conditions. The ...
2
votes
1answer
808 views

Can Diffie-Hellman Anonymous be used as a cipher for SSL for one-way certifiate-based authentication

I want to use Diffie-Hellman anonymous cipher for SSL. I also want to use a one-way certificate for server authentication. Is this possible?
3
votes
1answer
302 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
3
votes
4answers
150 views

Strong authentication over insecure links

Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the ...
2
votes
1answer
221 views

Mitigate risk of security questions [duplicate]

Possible Duplicate: Do security questions subvert passwords? Many Web sites nowadays require a (hopefully strong) password along with some pretty easy security questions. Sometimes it is ...
2
votes
1answer
955 views

Password authentication using DynamoDB

I'm working on a Mac app. I have users stored using DynamoDB. Authentication is needed to enforce access control on system-internal operations, such as uploading files to Amazon S3. Of course, I ...
9
votes
2answers
889 views

My bank makes me enter my password using the mouse. What's up with that?

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
1
vote
0answers
259 views

Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]

I have installed openssl and now the rsa_test.c is running fine. What I want to do is: Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey. The public key contains the ...
5
votes
2answers
2k views

Do Client Nonces enhance the security of HTTP Digest Auth?

As far as I understand the answer at http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...
5
votes
1answer
312 views

Does DPAPI works if a user hasn't a login password?

I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
3
votes
2answers
409 views

Wi-fi security using WPA or WEP

In current years we have used WPA and WPA 2 for the encryption of data sent over an 802.11 network. But in the past WEP is used . From time to time, many people say that WEP (Wired Equivalent Privacy) ...
11
votes
2answers
1k views

BCrypt's 72-character limit and using it as a general digest algorithm

Goal: have token/cookie-based authentication that doesn't require keeping sessions on the server TL;DR: What, if any, is the accepted mechanism to work around the 72-character limitation of BCrypt? ...
1
vote
1answer
637 views

Silent (no user interaction) utility to clear cached credentials on Windows [closed]

Is there any way to clear cached credentials on Windows, that doesn't require: user interaction (e.g. a confirmation window); administrator access; or making a persistent change to the ...
4
votes
1answer
905 views

How to disable caching of form data?

A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ...
5
votes
1answer
539 views

Secure web user authentication even after server-side database compromise

By now, we should all know to use bcrypt or scrypt to store salted password hashes with a sufficient number of rounds. (See, e.g., https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) The ...
10
votes
4answers
859 views

What is the key when facial recognition is used as a password?

I get the basics of what face recognition is and the fact that it is used to protect PC's and as a login replacement. However, if it was to be used for encryption, where the role of the key is played ...
3
votes
3answers
3k views

is it possible to create a login “key” out of a USB drive?

I was recently thinking about keeping my computer secure from physical access, and i decided that the safest way to keep my data under lock and key, was to do just that: Create a lock and key out of a ...
2
votes
6answers
2k views

Does Username + Password + Pin improve login security?

I've been asked to add a feature to a website to require a pin for users. The site currently uses username and password. If a user wants to change their password they need to supply the current ...
1
vote
2answers
934 views

Implementing SRP Challenge login system *with SSL* (Using PHP)

My question: Anyone knows how to implement SRP / Diffie-Hellman authentication in PHP (or if this has already been done)? (Some details) I'm using CodeIgniter with TankAuth (both latest version) ...
7
votes
3answers
8k views

Why is Chrome asking for the application-specific password and my account's password every time? [closed]

I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
39
votes
3answers
78k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
1
vote
3answers
2k views

Testing http authentication via netcat

I'm currently trying to track down what I think is a false positive from Nessus, my attempts to netcat into the device are failing, but I believe the service is shut off anyway and Nessus is being ...
10
votes
4answers
7k views

What are the disadvantages of single sign-on authentication?

We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication. Advantages Users ...
13
votes
1answer
1k views

When authenticating ciphertexts, what should be HMACed?

Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM. However, when doing, this, what should be HMAC'd? And how? ...