Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

17
votes
4answers
865 views

Is it a bad idea for an information holder to e-mail a user their password?

A couple of websites with which I'm registered have, after a period of inactivity on my part, each sent me an e-mail to remind me that I'm still registered. In each case, that e-mail has included my ...
1
vote
0answers
13 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
0
votes
1answer
107 views

ssh always too many authentication failures

No matter on which server I try to connect via password login, I always get the error message Too many authentication failures for If I have exchanged the ssh-keys, I can login without password as ...
9
votes
2answers
3k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
0
votes
4answers
134 views

Why must every OTP be unique

All OTP systems that I have observed, send a new OTP every time a user requests for an OTP. (for example whatsapp) Only the latest OTP is valid and an OTP can only be used for X hours. I am wondering ...
0
votes
1answer
88 views

Password Storage with Jasypt StrongPasswordEncryptor vs PBKDF2

We are currently working on authentication for a web application. For password storage, we're using Jasypt StrongPasswordEncryptor with SHA-256 and tens of thousands of iterations. Going into the ...
3
votes
2answers
135 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
5
votes
2answers
769 views

Could this login form be “hacked” to allow access?

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell: $email=$_POST['email']; ...
0
votes
0answers
24 views

How to test ldap that authenticates with kerberos

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ...
0
votes
3answers
69 views

Recommendation for identity system

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, ...
16
votes
11answers
2k views

2 factor authentication - cost effective solution for a web startup

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device. I am doing a web startup in the ...
1
vote
3answers
159 views

Resetting passwords howto

I am currently in the process of designing a registration form for the users to register accounts. The accounts will contain a lot of personal information, so I want to ensure highest possible ...
0
votes
3answers
104 views

“Remember me” cookies - did I implement them securely?

I am currently working on a pet project website and I want to implement the "remember me" feature for logins and wanted to know if my procedure is secure. The authentication process basically goes ...
0
votes
2answers
104 views

Security issues in “Remember Me” function code example

I'm a beginner, and these may be very obvious for you, but I'm trying to understand if there are security issues with this example. Today on Stack Overflow, I saw the following post: PHP Sessions ...
0
votes
2answers
64 views

Are there any flaws in my design for a paper-based OTP grid?

I'm trying to implement two-factor authentication on the cheap for a website of mine. My bank uses this sort of grid-based OTP system, so I wanted to emulate it in my application: Cards are ...
18
votes
4answers
6k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
0
votes
0answers
32 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
1
vote
5answers
163 views

Why after a website password reset am I asked to login again?

I have noticed that every web site has the exact same behavior for their password reset pages. They send a link to your email using which you can reach the password reset page. On that page you enter ...
0
votes
1answer
99 views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
0
votes
3answers
107 views

Would this authentication method prevent MiTMs getting the password?

Assuming SSL/TLS cannot be used in this context, is this method secure enough to authenticate someone without someone listening to be able to retrieve the password from the information transmitted. ...
1
vote
0answers
78 views

Secure login procedure

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the ...
4
votes
1answer
3k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
3
votes
7answers
933 views

Sharing passwords and credentials between founders and employees

What's the best way to share passwords and credentials from the business's various accounts in a secure manner? For example, email doesn't work because if someone gets into one of your employee's ...
8
votes
5answers
811 views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
8
votes
2answers
580 views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
0
votes
1answer
43 views

Basis Authentication Protocol: a concrete attack

Below is an informal protocol narration of a simple authentication protocol. A sends to B a signed hash of message M, B's name and a nonce N. B knows that the message M is intended for him, that it ...
5
votes
4answers
271 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
3
votes
2answers
1k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
0
votes
2answers
96 views

Is a Windows AD credential combined with AD group membership 2 factor authentication?

We have a requirement for 2-factor authentication for our internal WiFi SSID's. Currently we use PEAP w/ MS-CHAPv2 to pass windows creds through the AP to a RADIUS server (A Domain Controller running ...
12
votes
6answers
8k views

Preventing deauthentication attacks

I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network. I captured and analyzed the network traffic on my Wifi work ...
2
votes
1answer
71 views

Is asking for credentials from a separate trusted domain an acceptable practice?

I know of at least two pages that I would have just assumed were a phishing scheme if I didn't know any better. Serverfault.com is a stack exchange site on a different domain, however if you click to ...
0
votes
3answers
101 views

User Account Guessing [duplicate]

I'm doing some research on user account guessing, and wanted to ask a question about some "bad practices". My thought is generally this is a trade-off between great user functionality/UX and ...
5
votes
3answers
2k views

Is there a reason to protect SIM with PIN?

If phone would be stolen then SIM card will be thrown out by thiefs just after the theft so that they can't be found. If phone would be losed then it will be harder to find an owner for people that ...
179
votes
18answers
12k views

Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
43
votes
1answer
3k views

How does a SIM card prevent cloning?

I have read a few articles about SIM cards, stating that the chip inside them uses some cryptographic magic to prevent people from cloning your number. This to me seems borderline impossible, given ...
2
votes
0answers
138 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
1
vote
1answer
53 views

Server + Client certificate vs Server certificate + Client password

There are three different ways how TLS (1.2) can be used: server and client authenticate, only the server authenticates or neither authenticates. If neither server nor client authenticates using a ...
1
vote
1answer
59 views

Auth / Login token schema

According to this answer, a valid login token schema would consist of the username (U) the time of issuance (T) and secret key K owned by the server only The suggestion then is to concatenate the ...
0
votes
1answer
44 views

Better way to store user authentication on phone app

We are creating an app and registration of user happens in following way. User sends via app: email-id/phone and username. Server sends a pin to enter in app via phone/email. User enters the pin in ...
3
votes
3answers
631 views

Websites Forcing Weak Password Standards (Updated) [duplicate]

Please Note: I am not going to name the websites which have these horrible standards for their clients and users. I have had to change my passwords for my routine update just recently in the last ...
3
votes
3answers
148 views

What are the (practical) dangers of writing your own login method?

I have always been told that writing your own login method (e.g. validate user given the username and password) is bad practice, and that one should reuse existing libraries for that. I have always ...
5
votes
2answers
729 views

Website: Pre-Shared-Key Authentication

We have this web-application with high valuable (business) data. All communication is encrypted through TLS/SSL. While I consider this a really safe protocol, it can still be compromised if someone ...
6
votes
1answer
88 views

4 bytes authentication problem

I have a classic security problem where Alice needs to prove its identity to Bob but with quite unusual requirements and constraints due to a M2M context. EDITs in bold The communication channel ...
0
votes
1answer
134 views

security in banking app with 4 digit pin code and social security number

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
0
votes
2answers
98 views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
0
votes
2answers
72 views

Encryption mechanism

I want to send data over the Internet securely. For that, I am using an public key of the receiver to encrypt the data. In this case, if an intruder in the network modifies the data, like placing the ...
1
vote
5answers
254 views

Secure login feature with low CPU power

I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
0
votes
0answers
32 views

Secure access of web application on a newly created AWS instance using the associated keypair

I create an AWS instance using a private AMI (Linux) with an embedded web application (Jetty) which is activated on instance start. As soon as the instance is launched first time, I want the ...
3
votes
1answer
190 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
0
votes
1answer
78 views

Single sign on - is this a secure way to log in?

I am fiddling about with a sort of single sign on procedure. Let's say there is site1 and site2 and both use an SSL certificate. Users are signed in on site1. I was wondering what the experts think ...