Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
1answer
373 views

Why do major sites (eBay, Github) not ask for a password when I attempt to change email addresses?

When users change their email addresses within a web application's user account, I see the following problem: An attacker (who has access to your session) could change your email address to a new one ...
2
votes
3answers
226 views

Alternative to charging 2 small amounts for credit cards authentication?

Currently the client I'm working for charge 2 small amounts on adding credit card to authenticate credit card. After that they ask end-users to check the exact amounts on their monthly statements and ...
0
votes
2answers
859 views

Is there a way to configure WPA2-PSK to provide Forward Secrecy?

Is there a way to secure an wireless connection against a decryption attack where the PSK is known (E.G. Airdecap-NG)? Is it possible to configure Forward Secrecy on 802.11 Wireless Connections?
0
votes
1answer
108 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
2
votes
2answers
1k views

Security behind the windows 8 eye

I use the Windows 8 operating system. Whenever I navigate to the login page of Internet Explorer 10, or even the login screen of the operating system, I see an eye symbol at the end of the password ...
5
votes
4answers
647 views

Pin + guid in URL secure for a web app?

We have an ongoing project at work in which the security is a hot topic of debate. The whole site is SSL and proposed auth process is like so: User receives a non-unique 4 digit pin number in ...
4
votes
6answers
376 views

Ban or delete abusive users [closed]

I'd like to hear recommendations on a best practice for handling abusive users (for whatever reason) on an authenticated Website. Is there any point in keeping the user in the database with a ...
2
votes
1answer
145 views

Extended Basic Authentication

I would like to implement a REST API with Basic Authentication which relies on username and password. Because REST is stateless the user would have to reenter username and password for every request ...
5
votes
1answer
511 views

Custom web authentication scheme

For a project at work I'm currently implementing a not too large webservice. For reasons of learning something new I tried making it a REST service, which then prompted the issue of authentication. I ...
0
votes
2answers
298 views

Using authentication only one time passwords [duplicate]

I would be interested in advice. Imagine a authentication mechanism where users are authenticated ONLY using some code (e.g., one time password) which they receive (say as SMS) on their mobile phone? ...
1
vote
1answer
790 views

Transparently authenticating users or devices on mobile devices

I have an interest in using EAP-TLS to authenticate both users and devices separately on mobile devices (phones, iPods, tablets, etc.). My issue is how to delineate between user authentication and ...
9
votes
1answer
13k views

Security for REST api (user/pass auth vs hmac vs oauth)

I have two servers (one on Hetzner (I am calling it H) and other in my office (calling it O) ). I need to run a basic CRUD web service on O and the only consumer of the service is H. Data on O is ...
4
votes
2answers
1k views

Is secure web-app off-line auth possible?

I'm currently thinking about a web-app that can go offline (after being online) and still be able to provide authentication to the user securely. (For example, in a multiuser environment, it's quite ...
11
votes
4answers
1k views

What is the use of the “secret” displayed when setting up 2 Factor Authentication?

What is the purpose of the "secret" that is displayed when you take the picture of the QR code to set up 2 Factor Authentication on a non-Google site? Why would you need it? If you save it, doesn't ...
1
vote
2answers
103 views

How to log into sites that you have set up Google 2 Step Authenticator if you lose your phone?

If you use Google Authenticator to log into sites using 2 Factor Authentication, how do you log in after you lose your phone? Can you install Google Authenticator on another device?
0
votes
2answers
714 views

Do Google 2 Factor Auth backup codes work for logging into Google or other sites?

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device. Are these used only to log into Google, or can they be used to log into other sites?
-3
votes
2answers
715 views

Why doesn't Google 2 Factor Auth ask for a code? [closed]

I set up Google 2 Factor auth to use 2 Factor Auth with certain sites. But reading over the help suggests that Google 2 Factor Auth is only used to log into Google services like Gmail. But when I log ...
3
votes
2answers
963 views

A protocol to authenticate users without login/password

A casual message exchange on reddit yesterday got me thinking whether it might be possible to design a protocol that removes the need for users to remember a unique password for every service (s)he ...
-3
votes
1answer
913 views

What are some good user login/authentication libraries or protocols to use with Python on Google App Engine? [closed]

I've read elsewhere (http://forums.udacity.com/questions/6028436/bcrypt-not-suitable-for-pythongae) that bcrypt is not suitable for use on Google App Engine. What are some good ways to create a user ...
5
votes
4answers
718 views

User password as key instead of hashing it

I was reading here on Hashes and Salts and I thought about another method to do user authentication. I need your thoughts on this as I might be overlooking something. Scenario: For web application ...
4
votes
4answers
4k views

Can one connect to wireless router without cracking WPA2 handshake?

Is it possible to re-broadcast the appropriate parts of a captured four way handshake and connect to the router? If not why so?
3
votes
2answers
2k views

If a login/session cookie is stolen,does changing the password void it?

Considering the scenario where a Gmail session/login cookie is hijacked or stolen and it is discovered my means of Gmail last account activity,will changing my password immediately void the cookie or ...
1
vote
1answer
608 views

BitMessage : Key authentication?

Does BitMessage provide key authentication? If so, then how? How would one can be sure that the public key belongs to the right person?
2
votes
2answers
309 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
-1
votes
2answers
8k views

Want to authenticate oracle login using encrypted password…how to?

We are connecting to Oracle using korn shell scripts, which use sqlplus to connect to Oracle. The Oracle database is on the same Solaris box. Currently, we are storing the Oracle user id and ...
10
votes
1answer
408 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change ...
4
votes
1answer
3k views

Isn't MongoDB actually storing plaintext passwords?

According to the documentation at http://docs.mongodb.org/meta-driver/latest/legacy/implement-authentication-in-driver/: The driver then runs the authenticate command for the database on which to ...
2
votes
1answer
2k views

Why can I see the Basic Auth credentials in plaintext when using SSL

I just read this about the security about Basic Authentication over SSL: Is BASIC-Auth secure if done over HTTPS? And I don't get it. I just installed ProxyDroid (http proxy) on my rooted android ...
4
votes
1answer
1k views

Authenticate users through Google using only an OAuth2 access token

I have a question about having users logon to my service using their Google Credentials. I've gone through the Using OAuth 2.0 for Login documentation provided by Google. The documentation mentions ...
5
votes
3answers
1k views

How can salted, hashed password storage be combined with a plaintext, nonce and hash based authentication?

My understanding is as follows: To securely store a password (e.g. in a database), you use a hashing algorithm designed for this purpose (designed to be slow, e.g. bcrypt), and you use a unique salt ...
5
votes
5answers
2k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
6
votes
3answers
560 views

Should password be cleared after unsuccessful logon attempt?

Lets assume following workflows a) On a device with keyboard: I type my username and password Press enter [realization] I made a typo Password field is cleared: not a big deal, I can type ...
17
votes
7answers
2k views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
7
votes
2answers
2k views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
1
vote
3answers
860 views

NTLM security and password complexity

A client that allows to respond to the server with LM and NTLM, with a password which is simple,, is it insecure. Isnt a more secure way is to have all the communication with NTLMv2 scheme? and in ...
-1
votes
2answers
12k views

How to get an NT hash from registry? [closed]

I want to manually get the NT hash from the registry (without any tool). Let's say just for the administrator. I know that it must be stored in the SAM area of the registry somewhere so I tried to ...
9
votes
1answer
82k views

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific ...
0
votes
1answer
363 views

What are the performance and security tradeoffs when selecting “ECC” or “Subgroup” in a U-Prove token?

In one of the U-Prove documents, I remember reading something that compared Subgroups versus ECC and it went something like this (paraphrased): Subgroups Requires a bigger key to achieve equivalent ...
2
votes
0answers
64 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...
2
votes
0answers
106 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
9
votes
1answer
501 views

Is there a list of phone numbers Facebook uses to send auth tokens?

Up to a few days ago, I always received Facebook auth tokens from numbers +181338477XX, except a few times from +85294985XXX. Problem is that lately I've been receiving codes directly from Italian ...
2
votes
1answer
354 views

Authentication for Mobile Devices

I am looking for ways to Authenticate on a mobile device. The mobile application is connecting to a WCF Service which in turn connects to a Database. Before the application retrieves any information ...
1
vote
1answer
2k views

How to secure database table of users for an application?

I am working on a Windows application that utilizes a MySQL database for its user authentication and data storage. Within the application, the highest level of user (Administrator) can create and ...
3
votes
1answer
747 views

WSS (WSS4J): cleartext password in UsernameToken vs salted password hash in database

I'm currently struggling a little with the security layer of a web service I'm writing using WSS4J and CXF. We obviously do not wish to store plaintext passwords in our backend, but would prefer to ...
3
votes
2answers
733 views

Store private key on server, then use k1 to log in, k2 to verify HMAC and k3 to decrypt private key

I'm working on a proof-of-concept program to encrypt email with less difficulty for end-users with a process like: To create an account: Generate a random salt and IV, and get a password from the ...
4
votes
3answers
5k views

Role vs Identity based authentication? What is the difference?

What is the difference between role-based authentication and identity-based authentication? If a system uses ONLY a password mechanism to authenticate operators (different PIN for Admin and User) it ...
4
votes
4answers
680 views

Should both user ID and Password be masked for online banking?

Is there a best practice for security purposes requiring masking of both User ID and Password for online banking? Is there any rationale for or against masking both?
3
votes
2answers
114 views

How to ensure two messages are from the same party

I need to verify that two messages, that came over distinct channels, come from the same origin: without knowing anything about the origin beforehand the channels are one-way, only one message may ...
5
votes
7answers
267 views

Should user IDs be implemented in online banking?

How common is it for a bank to request you to make a user ID as well as password when banking? Should they simply use a pre-determined number such as your credit-card, or are there advantages to have ...
2
votes
1answer
700 views

API authentication without Oauth2 server

I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login ...