Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
1answer
190 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
0
votes
1answer
76 views

Single sign on - is this a secure way to log in?

I am fiddling about with a sort of single sign on procedure. Let's say there is site1 and site2 and both use an SSL certificate. Users are signed in on site1. I was wondering what the experts think ...
21
votes
3answers
2k views

How is Google Chrome managing authentication to sites?

In Chrome, every tab is its own process. Yet, logging in to a site, say, Facebook, persists across tabs. For that matter, in many cases, it persists across OS reboots. This seems inherently very very ...
2
votes
1answer
113 views

Is it legal to “use” security vulnerabilities [closed]

I understand that the answer to questions like this depend on country, but I'd like to get an idea what the usual approach to cases like this are. Heres the case: I found a security hole in one of ...
0
votes
2answers
318 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
1
vote
1answer
85 views

Web app with iframe and user - how to deal with session?

We have application which will be in iframe. Partner sites can use our application - put iframe in their sites. Partner site has users with money, who will use our application in iframe to buy items. ...
0
votes
0answers
33 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
26
votes
4answers
20k views

How do I secure my REST API?

In Detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
179
votes
7answers
130k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
3
votes
2answers
140 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
2
votes
1answer
260 views

How authentication using md5 works in this ospf example?

I am trying to understand how md5 authentication works between this 2 cisco routers. The password is cisco in both routers. In the output in the field Auth Data: the hash is different in every packet. ...
3
votes
1answer
86 views

Do non-browser clients work around Gmail's 2-factor authentication?

If you use a client like mutt to access your mail, you probably know that it doesn't support 2-factor authentication. It still prompts only for a password - either your account password or, in the ...
4
votes
2answers
131 views

How can I enable opportunistic encryption for my web-site?

As per an honourable mention in an answer for « Why self-signed https is less trustworthy than unencrypted http? », it appears that there are already two post-Snowden drafts that have to ...
1
vote
2answers
421 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
5
votes
2answers
397 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
66
votes
5answers
6k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
1
vote
1answer
287 views

Why use an authentication token instead of the username/password per request?

The author of http://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
1
vote
3answers
285 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Several systems rely on using UID of smart card for identification/authorization. For example database stores list of smart card UIDs and corresponding privileges. Given that today there exist cards ...
3
votes
2answers
141 views

How to prove flyer was (not) authored by specific person?

Let's say we create a flyer in some desktop publishing software (e.g., InDesign, Illustrator), physically print it and post it somewhere. We don't want inauthentic claims of authorship. Is there a ...
2
votes
2answers
85 views

Authenticating REST API using Access Token

If you have a REST API, which when you log in from the client side, generates an access token for the client, which is then stored in local storage and used for all authentication from this point on. ...
1
vote
2answers
81 views

On password change in a web application, should it log users out

When a user is logged into a web-based application in multiple tabs, and changes their password should it automatically log them out of the other tabs? The use case is an account is compromised, the ...
1
vote
1answer
67 views

What is the point of hosting database externally?

Following the breach of avast:forum.avast.com they decided to host the database externally@id.avast.com. My question is, what is the point of hosting the database externally since when you get remote ...
3
votes
4answers
148 views

Storing Old Password History and Information

Google, Facebook, Twitter, and several other services still knows the older passwords which we used on our accounts. At times, I can not reuse the same password as I have. Then with Google, if I type ...
1
vote
2answers
132 views

Remember Me vs Remember Email

From what I have noticed, there is very few services that offer the Remember Email over Remember Me or Sign-in Automatically. These options really do make the life easier for the end-user of ...
1
vote
2answers
145 views

This protocol is vulnerable, but why?

I know that the following authentication protocol is vulnerable, but I can't understand why. A and B share a secret key K (64 bits) R1 and R2 are two 64 bit numbers A-->B: I am A B-->A: R1 ...
1
vote
3answers
237 views

Order of authentication and authorization

This is my first question here in Information Security SE. Is there a recommendation to help telling the scenarios where authentication should precede authorization from the ones where authorization ...
2
votes
2answers
126 views

How to build a secure affiliate network

I'm going to build a demo affiliate network, which needs to be secured. Let say I have a web application called Affiliate Network Manager that manages all affiliates associated with my online book ...
0
votes
0answers
61 views

How to secure my REST API once user authenticates with Google on mobile client?

In my application, I build REST APIs so that user can interact with my application server. Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all ...
4
votes
1answer
361 views

Authenticate users through Google using only an OAuth2 access token

I have a question about having users logon to my service using their Google Credentials. I've gone through the Using OAuth 2.0 for Login documentation provided by Google. The documentation mentions ...
0
votes
2answers
72 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
0
votes
0answers
44 views

Authentication for my app

i'm currently building an authentication module and got a question about something, I have setup a server with an api and want my users to authenticate to this server but everything with angular is ...
0
votes
1answer
74 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
4
votes
3answers
133 views

What implementations are possible for dual control?

An organization requires employees to use 2 person authentication in some scenarios. That is, when accessing, say, a server, secret knowledge from 2 people should be used for authentication. No one ...
0
votes
2answers
64 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
1
vote
1answer
269 views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
2
votes
2answers
895 views

How can Bank of America tell that I'm logging in on a computer I haven't used with them before?

When you sign into Bank of America for the first time on a computer that you haven't used with them before, they detect this and force you to answer one of your security questions. I think I've seen ...
14
votes
3answers
926 views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
0
votes
0answers
50 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
46
votes
9answers
5k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
0
votes
1answer
195 views

Security with Single Page application

I am creating SPA application using Angular. This will serve my two purpose for middle layer on mobile as well website. Now trying to security my application from XSS, CSRF and also wanted secure ...
-1
votes
1answer
44 views

Is telling user that he is already signed in while signing up vulnerable?

I am making a site's authentication system in which the sign up form isn't located at index and it isn't going to be at index. If a user is already signed in and wants to fill sign up form, the script ...
3
votes
3answers
114 views

What are some cards that are vulnerable to RFID theft?

I heard that some credit cards are vulnerable to RFID scanning and thus identity theft. I am concerned about my cards and I would like to learn which cards are vulnerable to such abuse? Are any of ...
3
votes
2answers
89 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
0
votes
2answers
296 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
3
votes
2answers
114 views

How to troubleshoot “client certificate” related errors in 2 way HTTPS

I have a webserver which is asking for client certificate for mutual authentication. I have what I think is the right certificate loaded into my client browser. However, the browser is not able to ...
1
vote
1answer
240 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
-1
votes
1answer
73 views

How does SSL client authentication work?

I read the RFC document, it mentioned that there are some kinds of client certificate type. So I don't understand what does this type mean. For a instance, one type named rsa_fixed_ecdh, it said, the ...
0
votes
1answer
76 views

USB Token Authentication Security Issues

First of all, I should mention that I read this thread and it was useful in my case, but I need more comments and reviews about this authentication method.USB Token authentication which I want to talk ...
2
votes
4answers
269 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude ...
5
votes
2answers
1k views

Do Client Nonces enhance the security of HTTP Digest Auth?

As far as I understand the answer at http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...