Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
0answers
95 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
9
votes
4answers
4k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
80
votes
11answers
12k views

“Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?

Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
5
votes
3answers
27k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
9
votes
3answers
6k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
5
votes
1answer
4k views

Facebook page receiving improbable amount of likes from unknown users

A bit of an odd problem, but I'm not totally sure where to post this. I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
0
votes
1answer
58 views

Considerations when displaying OpenID and WS-* output to an end user

I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure. I would like to create a page that decryption the current session's OpenID or WS-* token, ...
8
votes
2answers
5k views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
0
votes
1answer
354 views

Implementing an invitation process for user setup

In a new ASP.NET MVC application I'm working on we'd like an administrator user to be able to set up other user accounts by creating invitations which will be emailed to the new user. That email will ...
3
votes
2answers
937 views

SASL Authentication Protocol with No Cleartext passwords

As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL. The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
4
votes
1answer
2k views

Comparing the standard HTML form POST for user authentication vs Javascript/AJAX

Are there any security implications with POSTing a authentication request with the use of javascript/ajax, as opposed to POSTing an HTML element by pressing the submit button? thus <form ...
4
votes
1answer
334 views

Custom EC2-style user authentication system - how secure is it?

At work I'm trying to design a user authentication system that is session-less (including session based tokens such as those used in OAuth2) due to client software requirements. The services are REST ...
9
votes
4answers
551 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
3
votes
4answers
2k views

Authentication between web services within the same project

In our project, we have several web services. Some of them are meant to be used only by the other services and the system administrator. We already have a global authentication system for users, this ...
-1
votes
2answers
104 views

What happens when and attacker changes the installed public keys in browser

I was reading about SSL. I understood that each browser comes with a predefined set of known public keys,which is then used to authenticate the messages. I was wondering what will happen when a virus ...
8
votes
3answers
1k views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
1
vote
4answers
464 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
6
votes
1answer
2k views

NVidia update service creates local account on system. Does anyone know the users password?

Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker. Details: wmic ...
3
votes
1answer
862 views

Are there any anonymous OpenID providers similar to Gawker's “burner”?

Gwaker has an anonymous commenting system called Burner. It is offered as an alternative to Facebook, Twitter and Google. What's the difference between Burner and creating a throwaway Google , ...
2
votes
3answers
889 views

Establish a secure channel with mutual authentication given pre-shared public keys

Suppose I have a system whereby parties are identified by their public key (with some pre-selected asymmetric key algorithm). Suppose I have a party PUB1 which wants to establish a secure channel with ...
1
vote
1answer
540 views

What user was this spammer trying to authenticate as?

I have a custom application that monitors and logs a user's SMTP session, and came across this spammer trying to use my MTA as a relay. Is it possible to determine what username they are trying to ...
5
votes
3answers
2k views

Delivery Failure Notification spam protection?

My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure ...
1
vote
1answer
103 views

How to detect suspicious tokens collected by a hacker

I previously asked a question here What's the use of adding a challenge in the otp algorithm? Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...
1
vote
3answers
297 views

Mass account lockout prevention using CSRF tokens

I'm currently working on reducing the risk of mass account lockout on a site that (unfortunately) issues sequential, numeric user IDs. Changing the structure of the userID is not an option at this ...
22
votes
1answer
5k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
5
votes
2answers
854 views

Could this login form be “hacked” to allow access?

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell: $email=$_POST['email']; ...
5
votes
3answers
387 views

Authenticating client without hardcoding key?

A basic question, but I'm not a master and this is puzzling me- How is it possible to authenticate a client from the server's perspective? i.e. imagine you're the server, and you want to give the ...
2
votes
2answers
97 views

Are there any nice info sites dedicated to explaining how and why to (not) store user passwords in the database?

I keep finding various websites that are able to email me back my password. I try to email them every time, telling them about this. But it can be tricky to be taken seriously - it's just a random ...
12
votes
6answers
14k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
7
votes
4answers
1k views

Password hashes should run md5 thousands of time: really?

I skimmed through How Companies Can Beef Up Password Security and I thought that several assertions were completely wrong, in particular: Cryptographic hash (like md5) with salt are bad. It isn't ...
1
vote
3answers
617 views

Login System Security Suggestions

I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup: nonce to check if the login originated from our login form session and cookie auth mixed - in ...
3
votes
1answer
407 views

Implementation of Blizzard's Mobile Authenticator

How is the Blizzard Mobile Authenticator implemented? Does it happen to use OATH-TOTP or something similar?
1
vote
2answers
136 views

How do i use a guessable ID for authentication

This question doesn't fit well in many categories but hopefully someone's run into it before. I'm developing a web api that will interact with a physical device. Each new physical device has it's ...
1
vote
1answer
1k views

Google custom Search Engine api key: is it confidential?

Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to ...
1
vote
4answers
66 views

When (if ever) should web app force numerical, generated (hence hard to remember) logins?

Some bank sites force me to use system generated numerical login (ie. 8 digit number). Apart from singnificantly decreasing usability and giving impression of security (to some), does it serve any ...
1
vote
2answers
94 views

How are 2 Open IDs linked on StackExchange?

I have an account with Google & Facebook. Login IDs for them both are same (same gmail id). When logging into StackOverflow using either of Google or Facebook logins would link to same account. ...
1
vote
1answer
398 views

What makes a secure smartcard secure? Is contactless/RFID better?

In short what security features exist that I should look for in a smart card? What physical features exist, which are important? It appears smart cards may exhibit different levels of wear and ...
1
vote
2answers
1k views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
0
votes
1answer
610 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states ...
20
votes
1answer
130k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
2
votes
4answers
2k views

Using only password to authenticate user (no “username” field)

I am creating a client access system, to allow manage invoices, make payments, access information about their products and information/functionality alike. Supposedly there are less than 1000 ...
2
votes
2answers
143 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
2
votes
3answers
195 views

Whether certificates can be used for regulating access

I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose. My ...
2
votes
4answers
2k views

Why does my bank use this verification method?

I hold my business account with Lloyds TSB [UK] and the process for logging in to their online banking service(s) is as follows: Login page Enter customer number Enter password Put debit card into ...
1
vote
2answers
148 views

Does Convergence solve the problem of hacked CAs?

My question is about the Firefox AddOn Convergence. So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
3
votes
2answers
847 views

failed login attempts analysis

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication ...
7
votes
3answers
1k views

Getting started with SmartCards; what equipment do I need, what do I need to know?

I have an unused SmartCard slot on my laptop and I want to learn how companies take advantage of it. Are all SmartCard slots capable of reading and writing a blank card? Are there compatibility ...
2
votes
3answers
356 views

How should one manage authentication on custom line of business software

I am writing line of business software for a company, and we want to authenticate users, so we can manage workflow and do some auditing. Basically my employers don't want me to piggyback off of ...
5
votes
5answers
4k views

How secure are “mobile authenticators” versus traditional key fobs?

Two-factor authentication, password + device, seems to be increasingly mainstream among consumers with products like Activision Blizzard's Battle.NET authenticators. However, I am curious what the ...
1
vote
1answer
551 views

Using Tokens to Keep Users Logged In

I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? ...