Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
3answers
596 views

How good is validating source with request.referer than checksum?

I have 2 portals(both are under my control & domain names are different) In 1st portal, there is a link on click of which User can directly get logged into 2nd portal. Link which will be hit in ...
205
votes
7answers
39k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
3
votes
1answer
200 views

Are there any uses of having a non-deterministic salt value for hashes?

So I've been toying with the idea of having non-deterministic salt values for hashes. Let me explain what I mean: Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
20
votes
1answer
22k views

Configure SSL Mutual (Two-way) Authentication

A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
5
votes
4answers
6k views

Is it safe to allow users multiple login at different browsers & computers?

We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
7
votes
4answers
428 views

Candidate authentication in large scale assessment

First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes. We're ...
2
votes
1answer
137 views

Authenticating a ciphertext

what can be considered as a downside of authenticating a ciphertext? For example, can we say drawback of authenticating a ciphertext is that we lose repudiation, for example, we can't prove to the ...
3
votes
2answers
253 views

Are there any serious problems with this method for generating single-use tokens?

I need your advice on the security of this design. I have a scenario whereby a server application and a smart card application need to share a value e.g. 52, which has been encoded in a long decimal ...
1
vote
1answer
194 views

What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?

I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible. On ...
4
votes
2answers
889 views

How Secure are Authenticity Token in Rails

I came across a website which uses Rails Authenticity token to prevent CSRF attacks. My concern here is that I can see the authenticity token in the source code of the web page. If any other service ...
1
vote
1answer
471 views

Facebook Login for Intranet

How safe is Facebook Login? I'm currently building an intranet, for my small company. We're 10 employees, and no risk of them messing up from inside. But is using Facebook Login safe for this? How ...
9
votes
3answers
23k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
3
votes
5answers
1k views

If someone steals my laptop while I'm logged in, how can I protect my browser?

My question has its roots in an xkcd from this week: http://xkcd.com/1200/ Isn't this true and ironic? We place so much emphasis on browser security and OS security -- and rightly so -- yet if I ...
5
votes
2answers
2k views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
6
votes
3answers
206 views

Is there any sense in using two-step authentication for personal email address?

There is two-step authentication available at gmail and outlook as well. There are some using it, but the majority doesn't. In what cases it is recommended? If I have a strong password what are the ...
5
votes
1answer
277 views

Authentication concept for sites served to another site

We are going to serve content to a Content Management System that embeds it through an iframe (yuck). Some pages that we serve need to be authenticated before – only a valid user should be able to see ...
2
votes
1answer
302 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
8
votes
5answers
10k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
1
vote
1answer
440 views

Best practice for securing user credentials once they reach the server using Basic Auth + SSL

I know it's generally said that storing user credentials in plaintext is a horrible idea. I'm in the middle of implementing Basic Auth over SSL and was wondering what I should do with the user ...
4
votes
3answers
962 views

Secure login system - using sessions?

I'm looking for a secure way to let users login on my website. Currently, I've always used a session system, like this: <?php session_start(); if (validPass() || isset($_SESSION['userId'])) { ...
2
votes
2answers
285 views

Client code tampering detection

I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been ...
-3
votes
1answer
109 views

What is the notion challenge in authetication? [closed]

Can someone help me what is a challenge in authentication wordbook?
1
vote
1answer
454 views

Basic Authentication with WebAPI and HTML/JS Client?

I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
1
vote
1answer
287 views

What rules should be enforced for users to create a strong password?

I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best ...
5
votes
6answers
5k views

What's the most secure technique for authenticating user in a website?

I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
6
votes
3answers
540 views

What is the value in asking for a second password for sensitive operations?

When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions? Does it provide any benefit over ...
1
vote
1answer
486 views

How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA

I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
36
votes
9answers
2k views

Use additional “password” in Referer to hide private site?

I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at example.com, ...
2
votes
2answers
680 views

Looking for general guidance on securing web API application for client applications and users

I have a web service built with WebAPI that accepts JSON requests and responds accordingly. The core architecture is built but there isn't any authentication/authorization. After a lot of googling ...
6
votes
2answers
1k views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
8
votes
1answer
6k views

Drawbacks of storing an authentication token on the client side?

I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
12
votes
2answers
311 views

Preventing Voter Fraud on a Social Media Contest

I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
1
vote
1answer
497 views

What is the origin of the three factors of authentication?

The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
3
votes
2answers
127 views

Can a good SSO protocol be built around a server signing tickets rather than validating them on demand?

CAS and its alternatives all seem to require a flow like this when one service is acting as a proxy for a user when accessing a back-end service: Service A makes a request to Service B on behalf of a ...
5
votes
1answer
2k views

How secure is Integrated Windows Authentication for IIS SMTP?

I have a Windows SMTP server that is currently allowing the "AUTH LOGIN" method of authenticating. As I now know, this is simply a base-64 encoding of the username and password, which is basically as ...
14
votes
2answers
1k views

Password and Generated number - How does it work?

In my company, they don't allow accessing the company email or servers from outside the company network. To access the email from outside the network, you have to use: Username, password and a number ...
5
votes
2answers
1k views

Man in the middle attacks for Out of band Authentication

I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows: "In ...
3
votes
1answer
464 views

Will using external OAuth providers for authentication protect users better than custom authentication?

On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
2
votes
3answers
7k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
3
votes
2answers
322 views

BOTs C&C channels

Can someone please explain the C&C for bots ? im reading a paper about Android bot , and its explaining something called URL flux as method of C&C . however i couldn't really get it , so ...
1
vote
1answer
925 views

Browser cache, cookies, active logins and other data

This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure. I'm seeking to know how secure it is to let the ...
1
vote
1answer
119 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
9
votes
5answers
3k views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
2
votes
1answer
2k views

Web service HMAC authentication/anti-replay

I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows: ...
7
votes
1answer
2k views

What possible use does an iFrame have for security?

I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password. But just before the end </table> tag there's a blank iFrame which ...
5
votes
5answers
611 views

Should an invalid user name be logged?

While authenticating, should attempts with invalid user names be logged? OWASP Logging Cheat Sheet says that authentication failures must always be logged. I can observe several programs doing this, ...
4
votes
1answer
17k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
4
votes
2answers
794 views

user authentication by decrypting a random blob

Normal user authentication is done by comparing "hash"-values. A simple example of this: The user password is hashed with PBKDF2 on the client using a salt (the salt is the hash of the user password ...
7
votes
4answers
1k views

Why does getting a password wrong takes more time than not

I type my password to login to Win or Linux. Case 1: I get it right. Almost instant reaction. Case 2: I misspelled it. It takes a while, and then rebounds. Why does it takes longer to identify a ...
2
votes
4answers
7k views

Is using Google Voice number for two-factor authentication a big mistake?

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...