Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
31 views

Should I stretch the secret key in a secure cookie protocol implementation?

I'm building an api authentication layer that basically works like the secure cookie protocol, where instead of a cookie I give the api client a token which they must provide on subsequent requests. ...
0
votes
1answer
75 views

Root The Box - easy CTF framework [closed]

I am planning to host a CTF contest in a few months at my local university. While searching for some hints I met this wonderful tool called Root The Box. It basically gives you all you need to host a ...
46
votes
7answers
3k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
2
votes
2answers
62 views

Issuing secure tokens that doesn't require any server side state

The issue I am currently designing the backend for a SPA (Single Page Application), which I'm planning to construct in a fairly RESTful manner. The backend will ideally be just a thin layer between ...
1
vote
1answer
62 views

Authentication, authorization in native mobile clients (Android)

I am developing native mobile client for store that requires user authentication in order to make purchases available. I have my web store page, authentication is provided by CMS (OpenCart). Now I ...
1
vote
1answer
123 views

What's the typical approach to caching invalid authentication attempts?

Clients (actually software pieces developed by some random dudes all over the Internet) are authenticating on a web server using "basic" authentication scheme and to do so they are passing the ...
11
votes
6answers
393 views

How to protect against adversaries snatching booted laptops to defeat full disk encryption?

I read an article describing how FBI agents snatched Ross Ulbricht's laptop while it was running to defeat full-disk encryption: Two plainclothes FBI agents, one male and one female, walked up ...
4
votes
2answers
412 views

Is it safe to use virtual mobile numbers for verification

Is it safe to use virtual mobile numbers for account verification & authentication for services such as PayPal, Twitter, Gmail, Linkekdin, etc.? And what is the security drawback for this?
5
votes
1answer
143 views

How secure is CertiVox M-PIN?

CertiVox have designed a system with the aim of "getting rid of passwords". Essentially the system authenticates users with two factors of authentication: A 4 digit PIN and a token stored within the ...
2
votes
2answers
137 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
23
votes
2answers
3k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
2
votes
1answer
96 views

Why is information obtained from public records considered a secure way of confirming your identity?

Various financial institutions, government agencies, etc., use public records information to confirm people's identities, as touched upon in UPS my choice -- How can I access my public records? The ...
39
votes
7answers
8k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
2
votes
2answers
64 views

Certificate chaining:Intermediate Certificate Authorities

Wikipedia says: For example, if a certificate issued to "example.com" and issued by "Intermediate CA1", and the visiting web browser trusts "Root CA", trust may be established in the following manner: ...
13
votes
2answers
594 views

How do I prevent my twin sister's “pulled from public record” information from being used when I try to answer security questions?

Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
6
votes
2answers
329 views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
1
vote
2answers
148 views

Does Convergence solve the problem of hacked CAs?

My question is about the Firefox AddOn Convergence. So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
1
vote
1answer
37 views

Centralized authorization with distributed service providers

I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization). The ...
1
vote
1answer
121 views

Is This DIY Password Authentication Scheme Acceptable?

This is mostly a thought experiment for client/server communication, and I want to know the flaws. When a user account is created (with U as the username and P as the password,) I generate a random ...
2
votes
3answers
3k views

static vs dynamic vs challenge response

I am taking a security class. The slides say that smartcards usually use one of three types of authentication protocols: static, dynamic and challenge response. What is the difference between these?
3
votes
2answers
321 views

What stops an SSH server from MITMing logins?

When I read this question about what gets signed with the private key by the client I wondered: What stops the following scenario from happening: A client connects to an SSH server. The SSH server ...
2
votes
0answers
44 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 ...
2
votes
1answer
2k views

Bypassing CVE-2010-4478 (J-PAKE parameter validation) in OpenSSH 5.1

Did anyone successfully exploit CVE-2010-4478 in the past? This is insufficient validation of the J-PAKE public key parameters in OpenSSH up to 5.6. I'm dealing with a vulnerable machine running ...
1
vote
1answer
39 views

Locking access to remote DB from a freely downloadable app (that acces the DB)

If I want to publish a software that needs to interact directly with a remote database, I will have to put on the software all the required credentials and logic to have the access from the program ...
3
votes
3answers
55 views

HTTP Server: Response time on login request

I have a site on which I would like to prevent an unauthenticated attacker from knowing if an account exists. On the site, passwords are hashed using bcrypt, so login requests must do a bcrypt ...
0
votes
1answer
40 views

How to manage a custom session in a webapp?

I was reading through the OWASP Cheat Sheet and something mentioned in the "Weak Authentication and Session Management" row did not make sense to me. It is recommended in the Design Column, that ...
1
vote
2answers
88 views

two factor authentication without TLS/SSL

It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds. Would the login be more secure if ...
1
vote
1answer
217 views

Chat encryption system avoiding protocol sniffing and then key+decryption replay?

I'm working on a chat system and I want to add it some kind of security (not just HTTPS with SSL since I've read it can be sniffed and decrypted with a few tools). Now, my knowledge in cryptography is ...
1
vote
1answer
81 views

Why doesn't the OS authenticate itself to me?

Sometimes it occurs to me, when doing something like a brew install, or really anything on a CLI (though I suppose this is also true of GUIs to a marginally lesser extent) that prompts me for a ...
1
vote
1answer
59 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
4
votes
2answers
67 views

Securing anonymous website posts

Can a website allow users to securely post anonymously, while still allowing these posts to be edited by the original author at a later time and preventing editing by other users? In this context, ...
0
votes
0answers
45 views

Designing a security system for road pricing

It's my first semester with Information Security and I still feel a little lost. Sorry in advance for stupid mistakes I may have made. the examples in round brackets below are my own ideas, wrote ...
0
votes
2answers
55 views

Is injecting a second Authenticity_Token on a login request considered a security threat?

I'm running a security test on a website. The login request looks like this: POST /sessions HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) ...
0
votes
1answer
39 views

QR-code based credential retrieval?

This is a sort of design review question that I'm hoping is suitable for this site. I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile ...
18
votes
8answers
7k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
37
votes
4answers
11k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
3
votes
1answer
63 views

Purpose for “One Time Use Token”

I'm connecting a Salesforce ORG with a third party vender through a custom API (they basically wrote it just for us). The API requires you to retrieve a "token" that you pass into other calls through ...
1
vote
1answer
57 views

Pre-Requisites for Mutual Authentication

For Mutual Authentication, the client must contain the CA certificate of the Server and his own Certificates, and the server must contain the CA certificate of the Client and his own Certificates.In ...
37
votes
6answers
5k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
11
votes
4answers
499 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
0
votes
1answer
127 views

Which systems in a network are able to spoof a TCP handshake?

I am reviewing for my final exam tomorrow, I came across a past exam question. An attacker wants to initiate a TCP handshake with a target to make him think E initiated it, attacker knows IP ...
16
votes
2answers
1k views

Is it okay to sign a PGP key without an IRL meeting?

[PGP] can get paralyzed by excessive analness. — Phil Zimmermann Preamble I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by ...
0
votes
2answers
114 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
0
votes
0answers
138 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
0
votes
0answers
75 views

Social game authentication exploit

We're running a popular social game and we have a security problem that is growing more and more popular these days. We have the following product requirements: There should be no registration to ...
23
votes
4answers
8k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
6
votes
5answers
3k views

Is there a reason to protect SIM with PIN?

If phone would be stolen then SIM card will be thrown out by thiefs just after the theft so that they can't be found. If phone would be losed then it will be harder to find an owner for people that ...
1
vote
1answer
91 views

Secure key generation and authentication in PHP

I'm not sure how to phrase this so I'll just explain my scenario and hopefully you can help. I have to create a site that will have 50-100 students all selecting courses they would like to take for ...
46
votes
6answers
6k views

How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?

I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case. When I sign on to my online banking account, I'm prompted ...
2
votes
5answers
164 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...