Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

158
votes
7answers
27k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
27
votes
7answers
2k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
0
votes
2answers
104 views

Recovery plan in case of lost Android smartphone with Google Authenticator?

So I am using Google Authenticator as my two factor authentication. I'm not a security expert, but I was thinking late last night as I was about to fall asleep: How can I login to my favourite ...
0
votes
1answer
61 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
0
votes
1answer
131 views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
0
votes
3answers
59 views

How SplashData knows about Worst Passwords used by users annually

It is known that every reputable website stores their user passwords into their database after implementing some hashing algorithm on it, and even they don't know what the actual password of the user ...
3
votes
4answers
121 views

Hardware token to authenticate web application

My company is developing a web application, and I was asked to research how to do hardware-based token authentication to login into our web application. Let me repeat: basically there will be a web ...
1
vote
1answer
75 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
2
votes
3answers
149 views

Web site accepting authentication via GET

There is a sign-in form on the website, which submits login/password via POST method. Problem is, that code, which accepts login/password and authenticate user also accepts it via GET method (also, if ...
4
votes
3answers
282 views

How does EAP/PEAP integrate with modern security protocols?

How exactly does Extensible Authentication Protocol (EAP)/Protected EAP integrate into modern security protocols? What I know (or not know) so far... It's used by wireless networks utilizing ...
2
votes
1answer
629 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
-1
votes
1answer
38 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
0
votes
1answer
45 views

How do you log into Amazon Web Services if you lose your phone which has Google 2-factor authentication set up?

And if it is possible, how do you prevent other people from claiming they are you and lost their phone? Amazon only directs you to a page which does not exist. http://aws.amazon.com/iam/faqs/ If ...
6
votes
2answers
818 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
3
votes
2answers
53 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the ...
0
votes
1answer
57 views

Securing access tokens?

Preface: I have no experience with securing applications whatsoever. I'm building a web app that uses Google Plus authentication to sign users in. My initial thought is to save the access token that ...
3
votes
1answer
241 views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
0
votes
1answer
35 views

User-friendly public/private manual authentication protocol

I have a remote service which allows users to SSH login to the machine and they're automatically sent to the (command line) application (without access to a bash prompt, for instance). In the course ...
0
votes
1answer
90 views

Sharing RSA Public Key for decrypting JWT amongst Load Balanced servers

I'm trying to implement a cookie-less authentication mechanism for a web API that is stateless on the server (does not store session tokens) and can be load balanced across several servers. I have ...
0
votes
1answer
60 views

single sign on across two servers

I have been wondering how and what kind of tools are needed to do single sign on in the following scenario: 1) Alice is logged in to site X hosted by server W 2) Alice navigates site Y hosted by ...
3
votes
2answers
2k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
5
votes
2answers
616 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
-2
votes
1answer
91 views

What is “Pass the hash” attack?

The article on Wikipedia doesn't explain how the attacker can authenticate to the remote server using the hash instead of the original password. According to the following article the attack is still ...
0
votes
1answer
98 views

Is the following PayPal Vulnerability a design/implementation flaw?

I am trying to understand the logic behind following vulnerability, I believe this a design flaw not only an implementation. To me the problem with the two-factor authentication service at PayPal is ...
0
votes
2answers
59 views

Detect Different Machine using Browser [closed]

Some web apps like Facebook and Gmail detect the first time we try to login from a device. Assuming that a browser can't read machine name, and MAC ADDRESS. What kind of variables are they collecting ...
19
votes
5answers
5k views

Why is “something you know” the weakest factor of authentication?

Quoting from CompTIA Security+ guide The first factor of authentication (something you know, such as password or PIN) is the weakest factor. Why? it makes sense when we say that humans/users ...
0
votes
2answers
79 views

OTP vs. Keyfile

I have been wondering what are the benefits and cons of using an OTP (one time password) versus a keyfile to, for example, decrypt a keepass database, connect to a server via SSH, or other uses. ...
0
votes
2answers
152 views

future of graphical password authentication [closed]

I'm a student currently pursuing my Engineering in Computers. I'm planning to put all my knowledge in and try to actually implement something related to security. To be more specific I'm more ...
295
votes
20answers
49k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
1
vote
4answers
429 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
0
votes
3answers
59 views

How is chase mobile deposit verified? [duplicate]

I read this but it didn't ask the question I want answered. How is Chase Mobile Deposit Secure? What I want to know is how do they avoid accepting a Photoshopped check? When someone gives me a ...
7
votes
4answers
642 views

What are factors in evaluating the fitness of a security questions?

Attempting to understand the key factors in evaluating the fitness of security questions. By security questions, I mean for example: What was the name of your first pet? In what city was [insert ...
0
votes
1answer
121 views

Api authorization basic concepts in detail

I am trying to write an application is rails. Which is more like a api application so that when a user gets redirected from his application into mine I would like to authorize him and start a session ...
1
vote
1answer
59 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
9
votes
2answers
5k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
21
votes
6answers
1k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
2
votes
1answer
67 views

How can I compute the value of the ASP.NET forms authentication cookie?

How can I compute the value of the ASP.NET forms authentication cookie?
15
votes
5answers
12k views

Preventing deauthentication attacks

I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network. I captured and analyzed the network traffic on my Wifi work ...
11
votes
4answers
1k views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
3
votes
2answers
87 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
0
votes
1answer
136 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
2
votes
1answer
112 views

How to autenticate properly in Java

I have to write some login module for Java EE application. Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the ...
4
votes
1answer
2k views

Isn't MongoDB actually storing plaintext passwords?

According to the documentation at http://docs.mongodb.org/meta-driver/latest/legacy/implement-authentication-in-driver/: The driver then runs the authenticate command for the database on which to ...
2
votes
1answer
523 views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
3
votes
3answers
143 views

Where are the user credentials stored when remember password is selected?

Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
2
votes
1answer
309 views

Is it possible to Spoof a TeamViewer ID?

I am using 2 forms of remote access to my Windows Server 2008 machine, both go to the Admin account since we only use it to host a Minecraft (MC) Server. Remote Desktop, that goes over a custom port ...
0
votes
1answer
69 views

Techniques for bypassing zero length check in javascript?

I am working on a node.js application that allows users to sign up for accounts using social media. When they do this an entry is created in our database with their email address, and a blank ...
2
votes
1answer
206 views

MySQL Authentication Hash Cracking

I'm currently conducting research regarding MySQL server remote authentication. I've captured unencrypted, uncompressed authentication packets between the client and the server where the username is ...
1
vote
1answer
80 views

Could Mental Cryptography(?) be useful to ordinary users?

I recently read about 'Mental cryptography' or 'Metal hash' process from this post: Mental cryptography and good passwords (via this message board ...