Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
2answers
65 views

Challenges in authentications

I have a case where I have a set of low compute capable processors connected to a gateway processor. I need a way of authenticating these processors to gateway processor. The main things are: I need ...
4
votes
3answers
703 views

Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?

This considers the route where somebody does not use the SMS option, but rather using TOTP, and the site offers a generated seed to input. Two factors questionably at use: password: something KNOWN ...
3
votes
3answers
208 views

How to make authenticity of text verifiable without third party services?

There is a person who wants to establish a system which allows her/him to publish texts anywhere and make it verifiable that s/he is the true origin of that text. Only the first message is not ...
6
votes
6answers
1k views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in: A year ago we used to close the shop and arm the alarm using a key fob. This means the worst case scenario was that I ...
1
vote
2answers
266 views

Securely passing critical data to other domain

My company owns a domain A.com , and subsdiary is on B.com B.com redirects their users to A.com for accounts registrations. Post successfull registration , A.com logins that user ( User doesnt get to ...
7
votes
3answers
13k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
4
votes
2answers
2k views

Windows Authentication and Session Ids

After a penetration test made upon an intranet application I'm developing, in ASP.NET MVC, one of the concerns raised was that the application supports concurrent user sessions and it is recommended ...
9
votes
3answers
6k views

Why is there a minimum username length?

In some (web) applications there is a minimum length for usernames, usually there is a restriction for a minimum of 6 characteres length. For example, free gmail accounts and miiverse (Nintendo ...
6
votes
1answer
4k views

What does chacha20-poly1305@openssh.com mean for me?

OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
1
vote
2answers
94 views

Associate guest orders with account if email matches?

A web shop allows orders from guests. When checking out, the guest has to provide an email address (in addition to shipping address and payment data). When this email address is already in use by a ...
4
votes
3answers
803 views

Can a zero knowledge proof of voting be made using a trusted auth server (without client side crypto)?

Questions: Can one implement a secure voting system having all the features described below? e.g. without disclosing any individual's vote to the government server (or the third party), preserving ...
1
vote
3answers
304 views

Should I trust my bank after this [closed]

I have just discovered that I can login to my bank with passwords that is not mine. Example: My password is "1234" but I am authorized with all possible post characters. For example "12345" or ...
1
vote
0answers
157 views

Putty Event Log

Can anyone explain me the Step by step process of Key Exchange that takes place while accessing Linux machine using Putty ? I found the Event Log of Putty but the Various Key Exchange didn't make very ...
4
votes
5answers
6k views

Does using WPA2-Enterprise just change the attack model vs WPA2-PSK?

As far as I can tell based on the reading I've done so far, WPA2-Enterprise uses the same encryption and security algorithms and methods as WPA2-PSK, with the addition of using another service for ...
1
vote
1answer
90 views

Transport Layer Security for multiple persons

I know that TLS protocol is used to authenticate two persons and when a secure channel is established we can perform a key exchange. My question is if TLS can be used to establish a secure channel ...
2
votes
0answers
204 views

How to verify a message?

I have a 192 bit data string and a 384 bit signature calculated with curve ANSIp192r1 as well as the public key. These readings originate from a SYM2 electricity meter and I would like to ...
1
vote
5answers
899 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
0
votes
1answer
252 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
2
votes
2answers
1k views

Token based authentication under http

I am doing a token based authentication but facing some security problems. In the system, a user will login as follows: Type username and password to login in a https login page If the login is ...
0
votes
2answers
391 views

How to detect authenticity Of Client and Server Certificate?

How its possible to detect authenticity Of Client and Server Certificate. For example, If server A has certificate and someone C stolen its certificate and send it to B then How we decide that it's ...
1
vote
1answer
431 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
0
votes
2answers
824 views

Security of cloud-based password manager (Dashlane, LastPass) vs. federated login (OpenID, Google, Yahoo, Microsoft, Facebook)

Many websites offer the option to log in with your existing Google or Facebook account (among others). For a long time I've resisted doing this because I use a password manager and I figured it was ...
13
votes
2answers
477 views

Why should one avoid chains of SSH sessions?

In this document on Security on NSC computing resources, there are several obvious pieces of advice (use a strong password, don't repeat passwords, etc.). One piece of advice I have not seen before, ...
1
vote
3answers
2k views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
1
vote
5answers
694 views

VPN Authentication over WiFi — Is it secure?

Count this question as part of my ignorance on how authentication scheme is done on your typical VPN session. But here goes: We often advise the security-conscious user that if one must use an ...
3
votes
2answers
616 views

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?

Why don’t SMTP servers just require all senders to be authenticated before accepting mail?
2
votes
1answer
606 views

How authentication using md5 works in this ospf example?

I am trying to understand how md5 authentication works between this 2 cisco routers. The password is cisco in both routers. In the output in the field Auth Data: the hash is different in every packet. ...
2
votes
3answers
189 views

Website Authenticity/Verification without SSL

Are there any other ways of verifying the web server you're visiting is actually the correct one? For example, if a domain name's DNS was hypothetically hijacked, and users were directed to a phishing ...
1
vote
0answers
26 views

Get Service_key in the course of kerberos authentication [closed]

Built environment 1) Exchange server: The operator system of Exchange server is Windows Server2008R2, We configured it as Active Directory (primary domain controller) used for client authentication ...
1
vote
2answers
1k views

When paying online with a credit card, what is “3D authentication” and is it reliable?

I tried making a purchase from http://www.laptop-batteries.ca/ but on the very last step the page reloaded with an error. A representative contacted me asking why I didn't complete the order and I ...
1
vote
0answers
62 views

How to get Service_key and the corresponding function call interface from the Samba source TGS_REP part

1, My existing configuration environment are as follows: (1), Server_side, Redhat5.5 Enterprise with samba4.0.0 installed, Ip Address: 5.5.5.149; domain name: EXAMPLE.COM; (2), Client_side: windows ...
1
vote
0answers
61 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
6
votes
2answers
528 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
0
votes
1answer
150 views

Is MS-CHAPv2 incompatible with securely stored passwords?

I have a directory service that can speak a number of protocols and is used for user authentication. Currently user credentials are stored using Bcrypt to protect them in case of a compromised ...
1
vote
0answers
97 views

Is what flexi_auth does with its use of its $this->auth object good practice?

I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used Like this: `$this->auth ...
5
votes
2answers
737 views

How does YubiKey protects it's secret key?

From what I understand, a YubiKey stores a secret key which can be used to generate passwords to enter a server. How does a YubiKey protect it's secret key? If it is plugged into an infected ...
3
votes
2answers
530 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
1
vote
1answer
729 views

Google's Mobile Authentication for REST APIs

So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using ...
-1
votes
2answers
134 views

user identity certificate

I want to create a new scheme for user identification, like X.509 certificates, but not X.509. Is it possible to use this new certificate over the existing Internet? and if yes, what are basic ...
2
votes
4answers
314 views

How is “security word” safe from man in the middle attack?

In this bank site I read the following lines Item #2 - You will also need to create a "Security Word". This allows you to verify that you have reached our Internet Banking site, and not some other ...
1
vote
1answer
323 views

Can I use a CDN for static content without sacrificing SSL keys?

I would like to use a CDN for the static content of a website. But obviously I do not wish to share my SSL key with any external service. What are my options? An ideal solution would be to link to ...
24
votes
2answers
10k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
0
votes
2answers
127 views

SSL/TLS Question [closed]

I am currently working on my SSL/TLS assignment and I got a question to ask. What is the use of a login password since it is not needed for establishing secret communication between your computer and ...
4
votes
1answer
2k views

OWASP Recommendation on Client-Side Password Hashing

The OWASP Application Security FAQ recommends the use of JavaScript to produce a salted hash of the password client-side with JavaScript prior to sending it to the server. Is this something truly ...
7
votes
3answers
3k views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry ...
0
votes
2answers
217 views

how to store key securely [duplicate]

I will receive some secret key from server which I will use as an authentication key for a MAC function in the future. But my question is how do I store this key securely on my machine? Will I have to ...
8
votes
2answers
6k views

How reliable are device IDs provided by PhoneGap on Android and iOS?

I have a web application that allows users to add mobile devices to their accounts (using mobile app). Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
32
votes
2answers
4k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
2
votes
1answer
857 views

How do I ensure secure communication and inter-process authentication in a multi-server application

Note: Question updated to narrow the scope a bit. Scenario Client <-> Application server <-> Data server Users use the client to connect to the application server and build queries for ...
2
votes
1answer
206 views

A problem with the cookie theft detection mechanism of Barry Jaspan's Improved Persistent Login Cookie scheme

I have read this article http://jaspan.com/improved_persistent_login_cookie_best_practice i intend to implement cookie theft detection mechanism Barry Jaspan devised in it. but a problem seemed to ...