Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

-5
votes
4answers
132 views

user authentication my method (reinventing the wheel) is this secure?

I have read many articles advising to use OpenID, including Stack Overflow Q&A, for authentication. Unfortunately I can't use openid because my auth is not based on an email id - it is based on ...
4
votes
3answers
471 views

In what ways does increasing SSH host key length increase security

I have read on a few guides on "how to secure SSH servers" that it is a good thing to increase ServerKeyBits from the default of 768 to 2048. Most of these guides seem to be for the entry ...
1
vote
1answer
136 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
0
votes
1answer
32 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
1
vote
1answer
107 views

What is the difference between claims, attributes, and roles?

Many questions have already been asked about Claims-based authentication and the differences with other approaches: Role-based vs Claims-based Explain claims-based authentication Now, my favorite ...
3
votes
1answer
116 views

Is OAuth always the right choice (and when isn't it)

So I am reluctant to ask too much of a noob question, as this guy aked about a non-standard approach and got down voted a bunch, but here goes. I am creating a mobile application which needs to ...
2
votes
1answer
59 views

Self-encrypting drives, certification for tamper-protection?

Consider a drive with Opal 2.0 support that works with Microsoft Bitlocker's "eDrive" feature. In this case, supposedly, the encryption key never leaves the disk (which might increase security, ...
0
votes
1answer
59 views

Social login - authenticate if email exists or create new user

Here's the idea: I have a website where I offer to users to log-in/sign-up via social networks(in this case Facebook and LinkedIn) When a user authenticates with either provider I look-up the users ...
0
votes
1answer
75 views

Why not use client certificates for premaster key generation

The question is about a very specific SSL handshake scenario. I understand that some servers may request client certificates in order to authenticate connecting clients. However, as far as I can ...
1
vote
2answers
166 views

Extracting Facebook ID or E-Mail from Browser History

While i was looking at my browser history i noticed there has been a facebook login from my computer, there are some facebook related messaging and profile links in my browser history (chrome). The ...
2
votes
1answer
67 views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
19
votes
3answers
5k views

What are the main advantages and disadvantages of webid compared to browserid?

What are the main advantages and disadvantages of webid compared to browserid? This question is inspired by this answer which got a number of upvotes despite being very vague on the topic of that ...
0
votes
6answers
218 views

Does ISP have control on all routers in their network?

When I was changing my router my ISP technician told me that he has remote access to all routers provided by ISP. Was that true? If that is a fact it scares me...
3
votes
2answers
215 views

Risks for a new type of website login feature

What would be a security risk for a website feature that allows you to connect to your account without typing your password, given that you allowed such a login for the next say 10 seconds from a ...
14
votes
4answers
2k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
1
vote
0answers
10 views

SSTP data traffic when multiple client approach?

I'm connecting 100 clients through SSTP to a centralized server containing a database. What happens when all clients approaches at same time and how the data traffic is managed in SSTP and how much ...
2
votes
1answer
91 views

2-Factor Auth with SSH

I recently acquired a Synology NAS (DS1513+). I am looking to expose SSH access remotely and to that end would like to harden SSH as much as possible. Is 2 Factor auth possible and if so what are the ...
1
vote
1answer
67 views

What is the best approach for securing log-in credentials on an HTML form?

I realize how basic this question is, but I have relied for years on mechanisms built into .NET to handle log in for me. These days, most of my work involves using client-side logic and calling API ...
-1
votes
1answer
33 views

login not working using hash_pbkdf2 [closed]

i am storing the password using hash_pbkdf2 but now ive hit on a problem my code : 1.for register $salt = openssl_random_pseudo_bytes(125);//salt $final_pass = ...
0
votes
2answers
341 views

Client Authentication by certificates in Google APP Engine java

I am writing an application in Google APP Engine java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the HTTPS ...
2
votes
1answer
299 views

Tomcat IP restriction vs Two Legged OAuth

We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
8
votes
3answers
670 views

Is SiteKey a valid defense against Phishing?

As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. (This is a scheme where the user is shown a personalized image (each user has their own ...
0
votes
1answer
85 views

Is two phase authentication using SMS/voice dead?

I'm looking at implementing a two-factor authentication system for my web site, utilizing a user's cell phone as the "something you have" part of a two-factor system. It seems like there are two ...
0
votes
2answers
57 views

A special file as the second factor in 2FA

Can a file e.g. containing some random key that is generated by my web site/app be acceptable as the second factor (the first factor being a normal password) in 2FA? Someone said so to me in the ...
1
vote
1answer
127 views

Do I need logging enabled in my rules in IPFW for sshguard-ipfw to work/blacklist ip's?

From the FreeBSD handbook: Even with the logging facility enabled, IPFW will not generate any rule logging on its own. The firewall administrator decides which rules in the ruleset will be ...
1
vote
1answer
110 views

What is the purpose of Rb in the 3rd step of the 3-pass mutual authentication in ISO/IES 9798-2?

Recently I am studying ISO 9798-2 Three-pass mutual authentication. There are 3 steps, as following: B -> A: NB // B sends to A a "nonce" value NB A -> B: {NB||NA}K // A's identity is proven ...
2
votes
2answers
747 views

Security behind the windows 8 eye

I use the Windows 8 operating system. Whenever I navigate to the login page of Internet Explorer 10, or even the login screen of the operating system, I see an eye symbol at the end of the password ...
2
votes
1answer
160 views

How do I ensure secure communication and inter-process authentication in a multi-server application

Note: Question updated to narrow the scope a bit. Scenario Client <-> Application server <-> Data server Users use the client to connect to the application server and build queries for ...
1
vote
1answer
105 views

What good does the Kerberos Authentication Server

I currently try to understand the Kerberos protocol. And I think I understand the parts of it. How Alice gets a ticket from the Authentication Server to authenticate herself to the ticket granting ...
0
votes
2answers
42 views

user roles or access levels

I am beginning a new project and I already know that I'll have various roles for various users, regardless of their access level. They just have different jobs to do. With that in mind, I'm thinking ...
3
votes
1answer
129 views

How do you evaluate and audit Central Authentication Service (CAS)?

This is in reference to Jasig's CAS software and I'm looking for a checklist to audit the state of security of a CAS implementation. While the Jasig site has a lot of documentation and their mailing ...
35
votes
5answers
6k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
4
votes
2answers
617 views

Is there any drawback of using OAuth “pseudoauthentication” as opposed to OpenID?

I have seen posts that insist that OAuth is an orthogonally different thing from OpenID, because OpenID is about authenticating users, while OAuth is about giving access to certain services to a third ...
1
vote
0answers
57 views

How should I authenticate my SPA frontend with my API since I´ve got no authentication process in the site?

We are designing a web site for selling financial products online. The following is a high level description of the components: Our frontend will be a SPA built with AngularJs. The frontend will ...
21
votes
7answers
4k views

How to prevent cheating (extra votes) in online contests?

Mitigating Cheating & Voter Fraud in Online Contests… We run online contests of various sorts that involve users voting on entries (usually one vote per user per day). The prizes range from ...
1
vote
0answers
29 views

Use TLS certificate as both server and client?

For a federated server-to-server protocol with domain-based identities, I am thinking of using TLS client certificates as authentication mechanism. I figured that re-using each peer's TLS server ...
1
vote
0answers
60 views

Does Diffie-Hellmann (DH) key exchange protocol lower Off-The-Record protocol (OTR) security level?

Off-the-Record protocol employes Diffie-Hellman key exchange protocol (DH). DH protocol does not provide authentication of the communicating parties and, according to many sources, is vulnerable to ...
1
vote
2answers
149 views

Security of login form

I would like to know how secure is this code I made for a login form... because I'm new in this and have serious doubts. $sql = "SELECT user_name, user_password " ."FROM users " ."WHERE ...
0
votes
1answer
30 views

Allow access only for some Mac Ids

There is an application which shows a login page. However, I do not want people to login through any machine. I want to restrict login to a few Mac Ids. Is there a way to do this? There is probably a ...
0
votes
2answers
66 views

How do SSL authenticated users prove authenticity through UDP packets?

I chose SSL for registration in the game client. The client communicates with the game server which stores a salted/hashed password. If I use SSL to authenticate users on login but the game does all ...
0
votes
1answer
39 views

How do I solve a lot of Failure Audit (529 680) which are appearing in event viewer “Security” tab?

was trying to consume an Web Services that I have published on the Web but I couldn't thing is that when I got into the server and check the "Event Viewer" I have a LOT of "Failure Audit" and they ...
3
votes
1answer
247 views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
1
vote
0answers
129 views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
1
vote
0answers
157 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
0
votes
3answers
89 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...
1
vote
0answers
66 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
5
votes
2answers
1k views

JSON Web Tokens (JWT) as user identification and authentication tokens

I'm implementing a REST service that requires authentication. I cannot store any per-user state (such as a randomly-generated token) because my service does not have direct access to a database, only ...
20
votes
7answers
1k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
22
votes
5answers
3k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
1
vote
1answer
109 views

SAML and kerberos what to use where [closed]

I came across SAML and kerberos, both are used to establish identity using assertions (tickets) so is there an overlap in their use ? Can somebody highlight their differences and point which ...