Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
1
vote
2answers
57 views
How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?
This is a clone of a question I posted on Stack Exchange. Thought I might catch the eye of some different people who could help here.
We are trying to implement a hmac-based one time password ...
6
votes
2answers
407 views
How can I prevent people from duplicating my barcodes [duplicate]
I would like to manage my inventory using a barcode system, but I am afraid that people will be able to scan or copy my barcode and make duplicates.
I would like to offer a discount card that has a ...
23
votes
4answers
1k views
Should I change the default SSH port on linux servers?
Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why.
If you have a strong password and/or a certificate, is it useful for anything?
...
3
votes
2answers
202 views
Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?
Suppose you have a system whose OS drive is encrypted with bitlocker and uses TPM + PIN authentication to authenticate the boot path against tampering. As I understand it, this setup theoretically ...
0
votes
2answers
95 views
Senario:SSL Enabled Online Banking Application. Question: Should card numbers be provided back to a user un-masked, when there is a failed login?
For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login.
Would this be a violation of PCI DSS 3.3 or not as the ...
4
votes
2answers
171 views
How can the low-water mark property apply to Bell-LaPadula?
I am taking a computer security class, and have a homework problem which has the following setup:
Now assume a dynamic version of the Bell-La Padula Confidentiality
model that incorporates a ...
5
votes
6answers
229 views
Is there multi-factor authentication for machines?
Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
3
votes
2answers
134 views
Proper Linux user authentication through PAM aware applications
Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. ...
6
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
22
votes
3answers
994 views
Is authentication using personal pictures more secure than passwords?
Statement 1
There is a start up called PixelPin. On the web site it reads:
The PixelPin solution is simple and quick to use, yet very secure.
PixelPin eliminates the traditional alphanumeric ...
1
vote
0answers
39 views
Can double encryption with different key increase the security? [duplicate]
Encrypting the file using same encryption algorithm using different Keys can increase the security or not?
0
votes
1answer
102 views
Is this a secure method for authenticating clients?
I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy.
Client sends a ...
0
votes
0answers
64 views
Are there any SmartCards with NFC or Bluetooth technology? [closed]
I'm looking for a Smartcard that has integrated NFC communication, (or any other contact based transfer).
Does this technology exist, and must I rely on non-integrated solutions?
1
vote
1answer
126 views
Web Applications (http): Don't get how token based authentication is secure
See something like this:
http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088
Or more specific:
Token-based authentication - Securing the ...
10
votes
3answers
423 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
16
votes
3answers
4k views
What are the main advantages and disadvantages of webid compared to browserid?
What are the main advantages and disadvantages of webid compared to browserid?
This question is inspired by this answer which got a number of upvotes despite being very vague on the topic of that ...
30
votes
5answers
4k views
What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?
Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook.
One advantage ...
2
votes
2answers
121 views
MySQL Access Control?
I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
2
votes
4answers
262 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
5
votes
1answer
93 views
Security and authentication problem
We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes.
First of all, lets imagine a real world scenario:
Imagine that a user ...
0
votes
0answers
48 views
Best strategy using encryption to ensure that only authorized application can access smartcard? [closed]
I want to encrypt the data in smart card to ensure the safety of the data so no unauthorized application could access these data, any suggestion about good mechanism to do that? what is the best ...
2
votes
3answers
171 views
HMAC What is secure manner to distribute shared secret between client and server?
I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
3
votes
2answers
108 views
what is the difference between a mac and a digital signiture
I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
2
votes
1answer
132 views
Improving Digest Authentication using PBKDF2
For a variety of reasons, I need to use digest authentication for a REST server that I have created.
I have come up with an "improvement" that I believe strengthens the algorithm against MD5 attacks ...
1
vote
1answer
111 views
4
votes
4answers
223 views
Is Username/Display Name Login more secure than email login?
I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
1
vote
3answers
120 views
Use Authentication using 2 encrypted strings
So, basically I am trying to log a user in with a cookie and do not query DB to improve performance.
Here is a brief idea:
Transmit everything via SSL
Set a Global secret key A and secret key B
...
2
votes
1answer
130 views
What is the cost of SSL encryption?
So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an ...
5
votes
1answer
67 views
Authentication by Signing or MAC?
I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
7
votes
3answers
259 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
12
votes
5answers
28k views
Can someone steal money from my bank account if they know my IBAN and personal details?
To deposit money into your account, some websites require that you provide them with a lot of details about your bank account: name, complete address and IBAN which includes your account number and ...
2
votes
7answers
232 views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
3
votes
4answers
378 views
How to “demonstrate” man-in-the-middle attack?
I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project).
Over the years a bunch ...
1
vote
1answer
198 views
iOS auth/auth with a REST Webservice
we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
2
votes
2answers
168 views
static vs dynamic vs challenge response
I am taking a security class. The slides say that smartcards usually use one of three types of authentication protocols: static, dynamic and challenge response. What is the difference between these?
1
vote
2answers
112 views
How high is the entropy of this salt-generating code? (No code-reading actually necessary)
What is the best method?
Assumption: I have a function that generates a number of medium-high entropy bytes
Step1:
I generate 3 of these medium-high entropy bytes.
Step2:
I hash these bytes using a ...
-2
votes
1answer
107 views
When logging into a web page what exactly happens when a user types the wrong password?
I have two related questions as to what happens when a user tries to log in to a website
If the entered password is wrong what should happen?
I have two ideas:
Redirect to a page saying "wrong ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
2answers
120 views
Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?
It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
1
vote
1answer
87 views
What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?
Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
1
vote
1answer
43 views
Should Framebusting be used (not used) on an IdP login page?
I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.
On the other hand, if I ...
1
vote
1answer
107 views
Is this a good way to handle login process
Just wanted to know if this would be considered a good way to handle login process. It doesn't matter which language it is written in.
I will use this fellowing format. - Event (Where it happened)
...
0
votes
1answer
147 views
What type of attack should be used in order to pass this authentication
I am practicing the Astalavista Wargames and i came across this challenge. The question is:
Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to
log ...
5
votes
1answer
81 views
Are there risks of using the same OpenID provider for sites with different security levels?
I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
2
votes
3answers
88 views
Is password authentication worse that signed messaging if done over SSL?
Let there is a public API:
HTTP-based
via SSL
there are no browsers, just connections between custom written programs
The first authentication scheme that came to my mind was... client signs their ...
19
votes
11answers
921 views
Is it safe to use a weak password as long as I have two-factor authentication?
I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
6
votes
3answers
2k views
Why is Chrome asking for the application-specific password and my account's password every time?
I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
7
votes
2answers
233 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
4
votes
2answers
84 views
Logging in a user after password reset via link
Lets say password reset functionality flow is the following:
User submits email address used for his account.
An email is sent to that email address with a link with a password reset hash.
Upon ...
5
votes
1answer
150 views
How does SRP prevent man-in-middle attacks?
SRP is designed to resist both active and passive attacks, how does SRP prevent man-in-middle and packet modification attacks?
