Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
0answers
37 views

Securing a Web API Service Layer

We've created a website and am using a service layer to expose common functions so that other applications will be able to call via REST API. The main website will have users that will add/edit ...
0
votes
1answer
37 views

Authorizing an Android app to carry out operations on backend server

The users of my Android application can pay (using Paypal or in-app billing) to light a LED on a remote location. The LEDs are controlled, at each of the locations, by Internet-connected Arduinos. ...
1
vote
0answers
27 views

What's the best way to implement phone-based 2FA

Some websites (for ex. Google) call you and you hear an recorded number, which you have to type in your computer. Some websites (for ex. Amazon) display a number on your computer which you have to ...
21
votes
5answers
2k views

Why do some websites and programs restrict password characteristics?

There are some websites and even programs that I use that have ridiculous password restrictions. Lots of forums for instance restrict passwords to ~32 characters. Others enforce a restricted charset. ...
0
votes
0answers
8 views

FID on iPad app on non company network

I am planning to implement SSO for one of company iPad apps. The app will never be on an App Store but instead loaded with third party authentication. The users on iPad will rarely be on the company ...
0
votes
1answer
19 views

Metasploitable: Change/Location of login page file?

I have been messing around with Metasploitable 2 and changed the default login credentials. The login page looks like this: I want to change where it says "Login with msfadmin/msfadmin to get ...
0
votes
1answer
44 views

Security issues with concurrent sessions in iOS app and Safari browser

We have two ways a user can buy products on our e-store. We have a mobile native app for iPhones and a mobile optimized browser experience from an iPhone default browser (i.e. Safari). The iOS (...
-1
votes
2answers
62 views

Google Authenticator, one QR Code, many devices (users)

I have a commercial website where people pay to use the services on it. The services I offer on it is of a word games-nature so it really doesn't need serious banking "Ford Knox" type encryption, and ...
1
vote
2answers
304 views

Device authentication mechanism

I am doing a project that needs device authentication with a gateway. What are some of the best ways of doing that ? Whether a certificate based mechanism is feasible in this case ?
3
votes
1answer
301 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
7
votes
4answers
2k views

Adding “Email or Username” in login page, is safe?

Suppose a website has a login page with "Email or Username", and shows the username publicly to every user on that site. Does that make it easy for an attacker to hack other someone's account?
3
votes
1answer
54 views

Is “Windows” mode inherently more secure than Forms authentication for .NET web apps?

We have a web application being reviewed and I see the usual section in Web.Config: <authentication mode="Windows"> <forms loginUrl="~/Account/Login" timeout="10800" defaultUrl="~/"/> &...
0
votes
0answers
35 views

Basic authentication issue in IE [migrated]

Problem I have an AngularJS application hosted in IIS 7.5 that requires Windows authentication and then Basic authentication. We're only running this on IE 10/11. It works fine but only after ...
0
votes
1answer
73 views

Why CDNs don't require authentication to access static files?

Why companies like Facebook do not require authenticated HTTP/HTTPS requests to access content (like images) using CDNs? In a way, once one "friend" can access the image URL, he/she can effectively ...
0
votes
1answer
41 views

Remote Biometric Authentication using mobile phones

As Google endeavours to do away with passwords, biometrics authentication as a method of proving identity has gained popularity. Logging into a system using a fingerprint or other biometric data would ...
4
votes
2answers
128 views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
1
vote
1answer
47 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
0
votes
1answer
197 views

Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons

This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
0
votes
1answer
26 views

Authenticating services with PKI (pycrypto)

so I'm trying to solve an issue at work. We have a popular key value store which does security via tokens. The kv store issues a specific token which dictates which clients can query which keys. I ...
-2
votes
1answer
142 views

What scenarios really benefit from signed JWTs?

UPDATE: I have concluded my research on this problem and posted a lengthy blog entry explaining my findings: The Unspoken Vulnerability of JWTs. I explain how the big push to use JWTs for local ...
66
votes
3answers
122k views

What is the difference between authorized_keys and known_hosts file for SSH?

I am learning the basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
0
votes
2answers
117 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
17
votes
6answers
3k views

What extra security does a 2-step website login process with a PIN provide?

I am currently working on a web application with a significant security risk attached to its function. We're using Microsoft Identity Framework to handle user logins, with the system forcing strong ...
-1
votes
1answer
59 views

Secure PIN verification if HTTPS is decryptable by third party

I'm developing a system where mobile applications communicate with server through HTTPS. The communication consists of two phases: at first, app "registers" at server: among other stuff, user chooses ...
3
votes
4answers
167 views

Question on information retrieved from systems that could potentially lead to exploits

Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of ...
-1
votes
1answer
68 views

Do I need to detect user's device for “remember me” system? [closed]

I'm following solution #1 of this answer. After a while, there will be some redundant rows in the table. Suppose this table: // cookies +---------+-------------------------+------------------+--------...
1
vote
0answers
12 views

Why do I need to redirect in order to send the external OAuth2 authentication token to the client?

In an OAuth2 scenario: user confirmed his identity, allows the app to access his details server got the external access token I intend to respond directly with a local access token as opposed to ...
2
votes
1answer
64 views

TPM based authentication without a trusted third party

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed. In general, what are the TPM operations that ...
49
votes
9answers
9k views

Is the UK Parliament e-petition system trustworthy?

Over the last few days, I've been hearing often about the petition to (pratically) "repeat" the Brexit referendum and I noticed that it is an online petition. I noticed that the "sign petition" form ...
10
votes
3answers
2k views

What are the security implications of using TOTP for single factor authentication?

(Note: I am not actually planning to do this. This question is strictly theoretical.) TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
3
votes
3answers
136 views

Can identification imply authentication in biometric systems?

I know the difference between Identification and Authentication, which are basically claiming who you are and proving that claim. In terms of a system, they are username and password in general. But ...
3
votes
1answer
2k views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
2
votes
0answers
42 views

Is a Kerberos ticket valid with only one-way external trust between domains?

The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
33
votes
4answers
2k views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
4
votes
3answers
113 views

Custom Authentication in a RESTful API - Will this work?

I was just wondering if this would be a reasonable way to write a custom authentication method for a RESTful API. It seems moderately secure, but perhaps I'm way wrong here. 1) Email and Password are ...
1
vote
3answers
109 views

HTTPS client “pairing”

I've been redirected here from SuperUser, I hope the question is appropriate. I need to restrict usage of a certain site to a limited number of customers. More than that, actually: I would like to ...
9
votes
3answers
999 views

Two factor authentication with my bank

My bank requires a security dongle. Place the debit card in the card reader and enter a pin code. An 11 digit code appears which is entered on the bank's website and access is granted. But if I ...
2
votes
1answer
194 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
6
votes
2answers
1k views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at http://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
31
votes
4answers
13k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
5
votes
3answers
309 views

Authentication Middleware

We run a large distributed system consisting of a number (>10) of Django-based web services and web applications with a consumer base of about 10000 university students. Currently, we use a single ...
43
votes
5answers
8k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
5
votes
5answers
3k views

What are the advantages of multi-level authentication?

By multi-level authentication, I am referring to the fact that the user makes use of a primary username password keypair to log into his account. Then, to perform some other actions, such as authorize ...
-1
votes
1answer
43 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
0
votes
4answers
101 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
35
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first bash:...
1
vote
0answers
33 views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
0
votes
0answers
136 views

Social game authentication exploit

We're running a popular social game and we have a security problem that is growing more and more popular these days. We have the following product requirements: There should be no registration to ...
0
votes
1answer
59 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
1
vote
3answers
217 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...