Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
3answers
356 views

How should one manage authentication on custom line of business software

I am writing line of business software for a company, and we want to authenticate users, so we can manage workflow and do some auditing. Basically my employers don't want me to piggyback off of ...
5
votes
5answers
4k views

How secure are “mobile authenticators” versus traditional key fobs?

Two-factor authentication, password + device, seems to be increasingly mainstream among consumers with products like Activision Blizzard's Battle.NET authenticators. However, I am curious what the ...
1
vote
1answer
552 views

Using Tokens to Keep Users Logged In

I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? ...
-1
votes
1answer
177 views

About important hacks in history [closed]

I would like to know how important hacks happened, because I can figure out how they hacked a website but I can't figure out how did they hacked into NASA International Space Station source code. Or ...
10
votes
3answers
1k views

HMAC Based Request Signing - Storing the Salt

I'm working on a (non high security) project that currently isn't live but might go live at some point. We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
7
votes
1answer
3k views

Does NIST really recommend PBKDF2 for password hashing?

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
3
votes
5answers
6k views

Two-factor authentication w/certificate and username & password?

Example scenario: ActiveSync Authentication method: certificate-based authentication AND Active Directory domain username-password Encrypted on device: public & private key AD username ...
44
votes
1answer
3k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
5
votes
2answers
2k views

MAC vs Encryption

I understand the difference between MAC (eg. hmac_sha256, etc.) and Symmetrical Encryption (eg. rc4, etc.), but my question is what advantage does MAC solve that using encryption doesn't? I know that ...
2
votes
1answer
401 views

Authentication for a batch script

It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of): What is the most secure way for a batch script, a program needing to ...
12
votes
7answers
25k views

Can my email account be accessed without the password? How secure is it?

Can my email account be accessed without the password, and how secure is email if I store my personal documents on it? And how come Yahoo Mail asks me to tell them my friends and folders names to ...
3
votes
4answers
974 views

Can we prevent a man-in-the-middle attack with symmetric-key cryptography?

Suppose that Alice signs the message M = "I love security" and then encrypts it with Bob's public key before sending it to Bob. As well known, Bob can decrypt this to obtain the signed message and ...
8
votes
6answers
4k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
4
votes
2answers
551 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
5
votes
4answers
365 views

Voting System, is there a hole here?

I had this idea a few years ago and improved it today as I notice a hole or two. I believe I have the system down right but If there was a hole the first time there may be a hole this time. I believe ...
5
votes
2answers
189 views

What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?

In many organizations these days, employee IDs are very mutli-functional. They can serve as: Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
2
votes
3answers
239 views

Emerging Standards for file transfer and integrity check?

What are the emerging standards for file transfers (including online transactions)? How about for file integrity checks?
5
votes
1answer
1k views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
4
votes
3answers
464 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I ...
2
votes
2answers
370 views

Why superuser or administrator account should never locked?

Why should administrator or superuser account never locked regardless how many incorrect login attempts are made? What should be done instead to alert the staff to the attempted instrusion?
3
votes
1answer
461 views

Cookie based session variables

I have a situation in which I cannot use a server-side session, but must allow users to log in, and for their logged in state to be persistent between queries. As with anything that involves crypto ...
1
vote
2answers
258 views

X509 mutual authentication: is there a security flaw?

On the client side, my application accepts the server's certificate in case of the client certificate being signed by this server cert. Is this correct or may it be dangerous? Is it better to ask a ...
0
votes
1answer
228 views

Authentication methods without trusting 3rd parties unless explicitly indicated

The plan is to have a situation in which no third parties have to be trusted unless you explicitly indicate so. For example CA's are only used when the contact explicitly added the CA as a trusted ...
1
vote
1answer
124 views

Viable way to authenticate certificate without a web of trust?

For SSL certificates we have a web-of-trust principle. If we are allowed to make alterations to the certificate format, are there viable ways to automatically or semi-automatically authenticate the ...
6
votes
2answers
4k views

Full disk encryption and multi-factor authentication

All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
2
votes
1answer
802 views

Implementing 2-step verification via email for web apps?

I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
1
vote
1answer
404 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
6
votes
4answers
10k views

Secure use of psexec or better alternative to it

I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop ...
4
votes
5answers
909 views

Do any organizations use Smart Cards other than the military?

The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why? UPDATE What are the pros/cons of smart cards, compared to other methods?
1
vote
1answer
229 views

Device authentication mechanism

I am doing a project that needs device authentication with a gateway. What are some of the best ways of doing that ? Whether a certificate based mechanism is feasible in this case ?
3
votes
2answers
2k views

Is leaving the root user enabled in Mac OS X a security risk?

To those unfamiliar, the Mac OSX has the root account disabled by default. In order to enable the root user you have to go deep into System Preferences and authenticate yourself with an administrator ...
18
votes
3answers
24k views

What is single sign on versus federated login?

What is the difference between Federated Login and Single Sign On authentication methods?
6
votes
4answers
4k views

HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?

We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
1
vote
2answers
732 views

Appropriate strategy for preventing brute forcing of logins?

I am currently building security into a website. So far, I have the following rules, and am wondering if this seems sufficient. 5 failed login attempts for a particular username will cause that ...
3
votes
1answer
404 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
3
votes
2answers
528 views

What algorithms can be used for device pairing?

I am to implement a system where android devices connect to a central server and have to register with different user accounts, so I have decided to create a pairing dance similar to what can be ...
1
vote
1answer
228 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
5
votes
2answers
1k views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
1
vote
1answer
2k views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
4
votes
3answers
1k views

Are Three attempts to block login a good idea?

In the company that I work there is a security rule: If you enter your password 3 times wrong, your login will be blocked! Then I have to go to mainframe program and re-register my new password. ...
5
votes
3answers
3k views

What are some good ways to verify user identity for password resets?

I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
14
votes
3answers
761 views

What can I do if my bank thinks my date of birth is “known only to me”?

My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name. ...
4
votes
1answer
1k views

How secure is TOTP key on phones?

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...
1
vote
1answer
552 views

Multiple security layers for SOA REST intranet services

For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
4
votes
2answers
13k views

How to use OAuth with Active Directory

I'm creating a REST WCF service and want to use OAuth to authenticate each user's request. The user accounts are stored in Active Directory so I have access to their AD login name on the client ...
13
votes
5answers
1k views

Is there any reason to show the same message for invalid username as password?

I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
13
votes
7answers
8k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
7
votes
5answers
636 views

Should a user have the ability to be logged in from multiple locations at the same time?

In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time. What are the security ...
2
votes
1answer
221 views

How to estimate the number of entropy bits & search space of a signature system like passtouch?

Apologies if I'm using the wrong lexicon, I'm just reading up about password systems out of interest. After seeing the xkcd strip on passphrases and coming across the passtouch system (youtube demo) ...
6
votes
2answers
490 views

What are the shortcomings of the following bank transaction authentication scheme?

Here in Germany, authentication of transactions in online banking (beyond the basic log-in password which is and has always been needed as well) has evolved from a list of one-time passwords which are ...