Tagged Questions

Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

5
votes
1answer
9k views

How does basic HTTP Auth work?

How does basic HTTP Auth work?
2
votes
2answers
2k views

Is it possible to change the admin user/password remotely on a router without logging in?

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
16
votes
3answers
1k views

Multi factor authentication on Ubuntu workstations, where to start?

Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed) ...
2
votes
2answers
200 views

How does LiveID work? Is there any documentation on the LiveID provisioning site msm.live.com?

I'm trying to learn details on how LiveID works, when compared to other federation technologies. To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand ...
3
votes
3answers
2k views

What is the exact difference between SAMLp and WS-Trust?

They seem to be similar on the surface, but I'm not sure how deep the differences are. Can someone explain to me the difference between SAMLp and WS-Trust? ADFSv2 gives me a choice between these ...
5
votes
2answers
167 views

How is the password prompt going to protect me from ruining my computer?

On Unix based systems, I'm often prompted to enter my password before installing or running a program. Why does this protect me? If I'm running a kiosk, I understand that a password might prevent ...
6
votes
2answers
838 views

How effective is the Mac Open Firmware password protection?

I have used Mac's Open Firmware password protection before and I've always wondered how effective it actually is at protecting my stuff. [assuming a good password] Would does the firmware password ...
9
votes
1answer
265 views

What shell binary should I use for the root account on a Linux system?

Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
7
votes
1answer
306 views

How to properly generate and use (m)TANs?

If you have an application that uses transaction authentication numbers (TAN) or mobile TANs, how do you generate them correctly? What are the pitfalls? And should you only allow the next number on ...
9
votes
3answers
753 views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
22
votes
4answers
584 views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...
18
votes
1answer
662 views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
35
votes
5answers
5k views

How to Securely Implement a “Remember Me” Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
19
votes
5answers
994 views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?