Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
2answers
110 views

Token-based authentication - what's a good token length?

What's a good token character length for a token-based login? Currently I'm using the following code: <?php $token = bin2hex(openssl_random_pseudo_bytes(16)); Is 16 sufficient or should ...
3
votes
2answers
122 views

Comparing the 2FA Vendors

If we need to choose a vendor for the 2FA in our environment, what are the features that we should look for? Our selection process depends on the functionality and usability they provide. But when I ...
3
votes
1answer
87 views

What's the weakness of keyed-MD5 for message authentication?

I've seen public web API's using keyed-MD5 to generate message authentication code rather than adopting the HMAC algorithm. People wouldn't just invent HMAC for fun, so it must have some advantages ...
22
votes
9answers
4k views

Is it helpful to have a captcha on a login screen?

I introduced recaptcha to the login screen of a system. My goal was all about security things like dictionary/bots attacks or other thing of that type. The users now hate it, Some did not even ...
4
votes
2answers
87 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
18
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
0
votes
2answers
179 views

Are the Microsoft Windows images found on the internet safe?

Microsoft has stopped offering the Windows images for download. It is now only possible to get the image if one has a key of a retail version of the corresponding OS. The question is now, whether the ...
22
votes
2answers
22k views

Why does HTTP Basic authentication encode the username and password with base64?

RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64. To receive authorization, the client sends the userid and password, separated by a ...
0
votes
3answers
269 views

What is the most secure way to save user authentication: Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application. All of them will use really confidential ...
10
votes
4answers
3k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
7
votes
1answer
194 views

Using RSA-SHA as/instead HMAC in OpenVPN?

While reading the manual of OpenVPN 2.3, I came across the --auth alg option. The manual says: Authenticate packets with HMAC using message digest algorithm alg. (The default is SHA1 ). HMAC is a ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
1
vote
1answer
40 views

How to migrate users? (Changing the login system)

Let's say that you are about to change your log in system and you have a few millions of users that you want to switch to the new system. Specification Old System Username : email address Password ...
3
votes
5answers
121 views

Any security risks for the login authentication and change password on the same page?

I want to ask if there are any security risks for the login authentication and change password on the same page? Normally the user needs to authenticate first in order to see the password change ...
1
vote
1answer
65 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
1
vote
3answers
238 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
4
votes
2answers
469 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
2
votes
1answer
55 views

Time tracking proof of identity

Does anyone know any other way to determine who is logging into a system, tracking if worker is on the clock and physically there working? Time tracking is awful in the hourly service world, because a ...
1
vote
1answer
44 views

Are there any simpler ABAC implementations available for big data systems? [closed]

Can any one suggest simpler Attribute Based Access Control implementations available for big data systems like Hadoop, Hive etc? I have checked Apache ranger they dont have any support for ABAC yet ...
11
votes
1answer
584 views

Is Postgres's uuid_generate_v4 securely random?

I'm using Postgres's uuid_generate_v4 in a uuid primary key column to generate secure one-time authentication tokens. Is this okay? Does Postgres use a secure random number source for generating these ...
1
vote
0answers
42 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : ...
81
votes
9answers
144k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
2
votes
1answer
92 views

Securing REST API without sending or storing clear credentials

We are currently designing a REST API, and thinking about securing it. Going through a lot of documentation, it has become clear that 2 options are available. HMAC Authentication By hashing with ...
-3
votes
1answer
56 views

Session hijacking [closed]

I know one way of doing session hijacking 1.copying the session value from the chrome browser and pasting the cookie value to firefox browser Is there any other way of doing session hijacking ? If ...
2
votes
1answer
55 views

Security bounds of TLS client authentication (from browsers)

Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...
4
votes
4answers
170 views

Securing REST API without HTTPS

I'm developing a REST API but I am unable to use HTTPS without using self-signed certificates. I understand that that might be acceptable for some, but I don't want security messages popping up on ...
0
votes
1answer
33 views

Would 2FA's second factor be a safe enough way to login? [duplicate]

I'm thinking of adding my website an option to login with just 2FA's second factor instead of just password. How safe would it be? I'm thinking of TOTP as 2FA method. Considering it isn't a big or ...
4
votes
1answer
42 views

How does LDAP keep an authenticated session

I feel like I'm missing something, because I'm not finding an answer Let's have a pretend scenario. I connect to an LDAP server I issues a BIND command and successfully log in (I think the sever ...
1
vote
2answers
64 views

Verifying Client with Server

I'm currently designing a basic Java program that uses sockets to communicate from a server to multiple clients. I want the clients to be unmodified, however, to prevent against users trying to use ...
11
votes
1answer
580 views

Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?

I can't believe it happened to me but I entered Gmail account's user-name and password into a website as part of a phishing scam. I use Gmail's 2-step verification and have changed my password. Is ...
5
votes
3answers
150 views

Session vs Cookie Authentication

Here what I means by the two : Session Authentication : Stored "Is authenticated" state in a session variable. Cookie Authentication : Stored "Is authenticated" state in a cookie protected from ...
8
votes
1answer
1k views

Does restricting the names of computers allowed to connect to a wifi network provide any security

In response to a statement elsewhere that MAC address filtering was essentially useless for protecting a wifi network because it was trivially by passable by network attack tools, I was asked if the ...
1
vote
1answer
93 views

Difference between authentication, integrity and data origin authentication

I first thought all these terms were synonyms, but I sometimes see those terms used in the same document. For instance, on MSDN: data origin authentication, which enables the recipient to verify ...
3
votes
2answers
59 views

Requirements Placed on a User of a FIPS 140-2 Validated System

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be ...
0
votes
1answer
788 views

How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can ...
7
votes
2answers
4k views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
2
votes
1answer
89 views

LastPass authentication grid hacked on June 15?

I wonder how safe LastPass's grid authentication is. I take it that they have a copy of the authentication grid on their server. You are supposed to print the grid and carry it with you to any device ...
1
vote
1answer
190 views

Publicly Available API + Sensitive ID/Key Transmission Over HTTP

I've run into a predicament... I'm developing a mobile application that utilizes a server for various things. One portion is that it stores an id/key pair related to accessing and processing ...
0
votes
1answer
60 views

Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons

This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
9
votes
3answers
618 views

Can an attacker “simulate” a private IP address?

I have a SSH server with a rule that does not allow password connections outside the local network. So people already on the local network, either physically or via VPN, are allowed to connect with ...
5
votes
4answers
455 views

Bad password policy at my bank

I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons". The policy for new passwords is: 6 to 10 characters, no special ...
5
votes
1answer
122 views

Security protocol for NFC stickers/cards

Lets say I'm using NFC cards for access control. NFC cards/stickers are easily readable and writable, so my worry is that the data on them could easily be cloned onto another card/sticker and bypass ...
1
vote
1answer
74 views

Why should I include a client_id in an OAUTHv2 password grant request?

Like little red riding hood, you don't know who is knocking on the door... Why even bother accepting a client_id in case of a API <-> Javascript-website or API <-> Android App password grant ...
1
vote
2answers
71 views

Public/private key auth and VPN

If a server uses public/private key authentication to access SSH, will there be any advantage of restricting the access of SSH over VPN? This link describes both approaches to solve brute force ...
-1
votes
1answer
24 views

RADIUS use outside of network AAA

I've seen RADIUS used for wireless authentication, but are there any other use cases that RADIUS works well in? Has anyone had experience with using RADIUS for AAA between two applications? I'm ...
1
vote
2answers
213 views

ASP.NET session id strength

After reading this and this, I am wondering if it is considered secure to use the default ASP.NET sessionID as a means to authenticate the user. I know it would be better to implement ASP.Identity, ...
5
votes
7answers
265 views

Should user IDs be implemented in online banking?

How common is it for a bank to request you to make a user ID as well as password when banking? Should they simply use a pre-determined number such as your credit-card, or are there advantages to have ...
1
vote
1answer
185 views

Why AJAX is not used to log in?

I'm wondering why AJAX is not used to log in nor register in most of the pages and it's used PHP reloading the whole page. Is it about security, or it's just that it's not practical at all?
1
vote
1answer
694 views

Forcing EAP-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE certificate based handshake with a FreeRADIUS server and WPA_supplicant - both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
0
votes
1answer
43 views

vpn and strong authentication, how does the two work as a pair? [closed]

Dont know. maybe I was to unprecise.... I basically am asking if a SSL-VPN solution is solving both the encryption and the authentication, like that the user authenticates himself to the vpn-client ...