Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

4
votes
4answers
663 views

Ensuring a web-service only processes requests from specific computers

I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the ...
13
votes
5answers
1k views

Is there a digital “safety deposit box” equivalent?

Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy? There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
7
votes
2answers
816 views

Any advantage to securing WiFi with a PSK, other than to keep out unauthorized

As I understand WiFi with a PSK, such as WPA(2)-PSK or WEP, anyone on the same network can decrypt anyone elses packets because everybody has the same key. In which case, if you are not going to ...
7
votes
6answers
2k views

Is denying login after incorrect attempts ineffective?

Generally denying login attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicious login attempts. Yet, surely doing this is ...
8
votes
2answers
437 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
8
votes
2answers
296 views

Is the argument really over on SSO?

I got shot down on ServerFault recently for suggesting that SSO can be less secure than having different credentials for each service. What are the arguments against SSO?
8
votes
5answers
402 views

Oldest security feature still in active use

Beyond commonsense and physical access controls, is the system password the oldest still in active use security feature? By physical access, I mean for example leaving the system within a secure ...
8
votes
4answers
445 views

Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?

This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
0
votes
2answers
292 views

Can you pick up any device specific information by monitoring bluetooth signals? [closed]

Could I use some sort of permanent device ID broadcasted by the bluetooth radio in my phone to do something like unlock my door? I don't want to have to ever pair the device, or take it out of my ...
6
votes
3answers
2k views

Is the OpenPGP private key inherently password-protected?

I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key? Essentially, ...
1
vote
1answer
359 views

How do security questions work? [duplicate]

Possible Duplicate: Do security questions subvert passwords? Is it true that on some websites (e.g.: free webmail) there are "security questions" - if the user forgets about his password he ...
14
votes
3answers
2k views

Should security question answers be case-sensitive?

Question In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers? Scenario An ...
3
votes
1answer
706 views

Open source centralized authentication for heterogeneous network

I'd like to centralize all authentication on my network using something like an LDAP server. Clients consist of Windows and Linux servers. I'm looking to manage authentication for virtualized ...
3
votes
0answers
216 views

Theory behind RSA SecureID/Lockheed attack

Unless I missed something I don't think RSA/EMC came out and said publicly what was stolen earlier this year when they were compromised. So I know the answers to this question will be conjecture. That ...
3
votes
0answers
165 views

Files for download and their hash numbers

I'm far from being an expert in the IT security and I have this maybe naive question. Many downloadable files are deployed on websites together with the corresponding hash numbers to ensure their ...
4
votes
2answers
481 views

Attack vectors in POSTing variables from one php script to the next?

I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as ...
21
votes
9answers
2k views

How can I ensure that I connect to the right wireless Access Point?

Under Windows/Linux, client side. How can I ensure that I'm not connecting to a rogue AP?
41
votes
9answers
3k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
44
votes
5answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
15
votes
4answers
4k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
15
votes
4answers
263 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
77
votes
3answers
11k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Or should ...
25
votes
9answers
2k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
15
votes
6answers
1k views

Appropriate password requirements for a login (OpenID) service/provider/delegate/thing

This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case ...
5
votes
2answers
2k views

Verify SAML Response is from a Trusted Source

I'm in the process of making changes to my site so that we can be a SAML 2.0 Service Provider. We will be doing IdP initiated SAML with Out-of-Band account federation. My question is this: Given a ...
37
votes
6answers
5k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
25
votes
4answers
2k views

How is “something you have” typically defined for “two-factor” authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
7
votes
3answers
1k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
56
votes
7answers
40k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
5
votes
1answer
1k views

TLS at layer 4 BUT 802.1X EAP-TLS at layer 2?

In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine. Port security 802.1X and EAP is a data link layer 2 ...
8
votes
2answers
426 views

Is there a way to negotiate a secret between 2 parties with no prior knowledge?

Is there a way for 2 parties to negotiate a shared secret (for example, a session key) without having a pre-shared knowledge? SSL does this by using asymmetric encryption. Is there any other way to ...
3
votes
7answers
591 views

Biometric authentication in the real world

can anyone give a realistic estimation, based on real-world experience, of how much biometric authentication techniques are being used in the IT field?
17
votes
3answers
2k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
14
votes
3answers
3k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
29
votes
2answers
9k views

HMAC - Why not HMAC for password storage?

Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. Let's say ...
4
votes
2answers
149 views

Question about the SessionLock paper

Some time ago there was a big fuzz over Firesheep: by listening to wifi traffic your login session can be stolen which is very bad because now somebody can e.g. send emails on your behalf. Some people ...
4
votes
4answers
866 views

Are there consumer-grade VPN services that support two-factor authentication, like SecurID?

I'd like to increase my VPN security, and Google hasn't turned up anything with regard to VPN services and SecurId. Does anyone know of services like this?
4
votes
1answer
486 views

How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?

It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing? Some examples I'm thinking of ...
4
votes
2answers
1k views

How do Azure ACS 2.0 security features compare to ADFS 2.0?

I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0. ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...
41
votes
4answers
13k views

What is the use of a client nonce?

After reading Part I of Ross Anderson's book, Security Engineering, and clarifying some topics on Wikipedia, I came across the idea of Client Nonce (cnonce). Ross never mentions it in his book and I'm ...
13
votes
5answers
1k views

How should passwords be stored if they must be recoverable?

By "encrypting" passwords you are violating CWE-257: Storing Passwords in a Recoverable Format. But this is exactly what the French government wants. They want to be able to obtain the passwords of ...
2
votes
3answers
227 views

Identify client based on computed hash

I'm currently developing a web application which will serve data to iPhone clients. In order to be the owner of the data, I don't want other clients to be able to get it. I thought I could use a ...
27
votes
3answers
3k views

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. ...
4
votes
3answers
699 views

Is it possible to have authentication without state

In order to login to most websites you need a username and password which is often stored in a SQL database. You are storing per-user information that can change, this is state. Can you prove that ...
1
vote
1answer
441 views

OpenSSO and Basic Auth together

Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that ...
13
votes
9answers
743 views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
4
votes
2answers
887 views

P3P HTTP Headers and Session ID's

Is there any chance that Session ID's can be shared between different websites (one in other IFRAME of others) through P3P Headers?
6
votes
3answers
977 views

Is there a way to accept signed requests without storing client's password in plaintext?

We are developing REST Web service. We will give Identifier and Secret string to each of our REST clients. When doing requests, clients will authenticate themselves using HMAC algorithm (they will ...
12
votes
3answers
342 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
19
votes
3answers
1k views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...