Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
3answers
80 views

Is it a good idea to let a database do a password check?

Setup A server running a PostgreSQL database and an Apache with several php applications. Access to db is over the loopback interface. The db contains a table with the username and SHA-512-CRYPT ...
59
votes
9answers
17k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
1
vote
2answers
91 views

memorable word and answers to security questions when resetting password?

Context We have a situation where we are allowing our users to login using either using Username & password + Memorable word OR Username & Password + answer to Security questions depending on ...
3
votes
2answers
176 views

NFC - Felica / NXP (Desfire EV1) or ACOS3 which is more secure?

I am new to NFC, and just have been researching on security from different manufacturers, trying to find out which system is more secure with their password protected area. I only know that Desfire ...
1
vote
2answers
96 views

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
26
votes
2answers
7k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
0
votes
0answers
25 views

PostScript/Jet Direct port TCP 9100 mandatory for printers?

I'm trying to acquire more knowledge on the topic in order to find and fix a few security issues on printer infrastructures to prevent misuse, pranks and secure all data in it. Currently I have a few ...
1
vote
1answer
55 views

Attack Challenge/Response Authentication by requesting challenges

If a client/server application uses a challenge/response pattern for authentication, e.g. SCRAM or alike, it often involves the usage of nonces (client nonce and server nonce) for preventing replay ...
3
votes
0answers
59 views

Secure a server on `localhost` such that only the authorized users can connect

Consider an application (such as an IPython notebook) that runs an HTTP server, and that (by design!) allows arbitrary code execution by authenticated users (this is the entire point of IPython, ...
0
votes
0answers
25 views

Securing device communication with API back-end with no user interaction

We have remote devices programmed in Python that talk to our back-end to update our database with information gathered from sensors connected to our remote devices. The remote devices are not ...
-3
votes
3answers
1k views

Two-factor authentication Without Mobile Phone

Two-factor authentication is based on the notion of “something you know” and “something you have”. Is it absolutely necessary for having your mobile phone involved in two-factor authentication, which ...
2
votes
1answer
93 views

Can data coming into my UDP server be sniffed?

I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
3
votes
0answers
84 views

Thoughts on my JWT implementation

So I've been trying to learn as much as I can about JWT tokenisation, and auth0 seems to be the defacto JWT information hub. However, the more I read about refresh tokens, the more I cringe - the ...
2
votes
3answers
3k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
0
votes
0answers
52 views

Benefits/negatives of password-less authentication

I am facing the following dilemma: I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products. Currently, the ...
2
votes
1answer
87 views

Email code authentication

I'd like to replace passwords with a temporary code that's emailed to the user. The login flow would go like this: User enters their email address. "If that email belongs to a user, a code will be ...
3
votes
1answer
81 views

Security requirements for one time access code/token in the url

I have an application that will send an SMS reminder for user containing a URL to log on. I would like to avoid user typing in username/password and log him in directly. For that I plan to use an ...
46
votes
6answers
9k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
0
votes
0answers
31 views

What is attribute-based authentication?

I found the following definition here : From a privacy perspective a better solution would be the use of attribute-based authentication (Goyal et al. 2006) which allows access of online ...
1
vote
1answer
57 views

Secure login form from unsecure site

We have two sites, app.company.com and www.company.com. Right now, users are trained only to enter their login credentials on app.company.com. Both sites use SSL. The app.company.com uses CSRF and we ...
1
vote
0answers
34 views

Migration problem between different machines using TrouSerS TPM library

My question coincides with the question posted by Maximiliano Ezequiel. Below is a question. I could make migration process work in one single machine. I can: Export SRK public key. ...
2
votes
3answers
310 views

Does HTTPS allow replay attack on authentication request? [duplicate]

If I sent a username and the password to a website over HTTPS, is it possible that someone on the net would save this request and re-send it later to authenticate on the website?
2
votes
1answer
101 views

How to verify if a phone number is an online SMS account as opposed to a genuine SIM card

We are using Authy for phone number verification on our website. It is very easy to create a free online SMS account through Twilio or other providers. Is there any way to determine whether the phone ...
2
votes
0answers
109 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
6
votes
2answers
3k views

Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?

What exactly is the difference between following two headers: Authorization : Bearer cn389ncoiwuencr vs Authorization : cn389ncoiwuencr All the sources which I have gone through, sets ...
7
votes
2answers
258 views

mobile number authorization strategy using SMS, best pattern and practices

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
3
votes
2answers
2k views

Recovery plan in case of lost Android smartphone with Google Authenticator?

So I am using Google Authenticator as my two factor authentication. I'm not a security expert, but I was thinking late last night as I was about to fall asleep: How can I login to my favourite ...
0
votes
1answer
1k views

How to avoid storing plaintext during CHAP authentication

When using CHAP authentication, passwords are stored in plaintext, then I used reversible encryption to store password. However, I recently found Citrix states " storing passwords using reversible ...
1
vote
0answers
69 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels ...
1
vote
0answers
27 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
0
votes
0answers
31 views

Integrated Windows Authentication and Java/Unix

I have a specific scenario where we have existing ASP.NET Web applications/services hosted in IIS and accessible via Integrated Windows Authentication. The challenge is to have a new web application ...
3
votes
1answer
81 views

Revoke access from intranet if an employee leaves the organization

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed. This organization has offices in maybe 50+ countries, ...
26
votes
7answers
4k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries ...
1
vote
1answer
26 views

Extract X509 client certificates from TCPdump files

I have the following question: assuming I have a TCPDump file containing a number of HTTPS connections using TLS mutual authentication, is there a way to extract all client certificates sent to the ...
39
votes
6answers
16k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
0
votes
0answers
29 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
2
votes
1answer
116 views

Why refresh tokens are used

Reading about JWT I see it is common practice to include a refresh token along with the short lived token. So commonly it seems you have a short lived token which lasts for a short time such as 15 ...
2
votes
2answers
48 views

IP Restricted OTP like Web Admin Authentication Safe or Not

I created a web admin panel with the following security implementation. It is located on a sub directory of the web, which will trigger a 404 Error when tried to access (just like the link is ...
2
votes
1answer
124 views

SQL injection vulnerability when using prepared statements in PHP

I've been studying prepared statements and implemented it in my first login. I used a prepared statement for the SQL query and am wondering if this is enough to ward off most SQL injections? Since ...
31
votes
5answers
2k views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
-7
votes
1answer
85 views

Is webkey a reasonably secure authentication system?

I just created Webkey in the last couple days. It's built to do client-certificate auth without using the (in my opinion unusable) client-cert functionality built into browsers. It would allow ...
2
votes
2answers
54 views

Does having multiple 'memorable info' answers reduce secuity?

I use a website that on top of requiring a username and password also requires 'memorable information'. When signing up I provided multiple pieces of memorable info as answers to multiple questions ...
5
votes
1answer
95 views

Simple, Secure PHP API Design

I'm trying to design a secure RESTful API web service with as few moving parts as possible. I have some questions, and want to make sure my design is secure. For the data transmission level of ...
6
votes
1answer
245 views

Cascaded Sudo for privilege elevation

I intend to use the least privileged user to do a given task. The issue is that it involve a kind of responsibility chain and translate as a sudo chain in my scripts, spreading the overall task in ...
6
votes
2answers
140 views

OAuth2 and Authentication

I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points : What is the difference ...
0
votes
1answer
33 views

Why is calculating the checksum of an IP Datagram header and then encrypting it not appropriate to provide Data Origin Authentication?

So assuming Alice and Bob have agreed to use a particular symmetric cryptosystem and share an appropriate key, they want to achieve data origin authentication by computing the header checksum of an IP ...
-2
votes
1answer
83 views

Public key encryption for initial challenge-repsonse

I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
2
votes
0answers
263 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
0
votes
0answers
19 views

Cyrus-Imap (v2.3.16) local logon attack

CentOS-6.7 Cyrus-IMAP-2.3.16 The host inet07.hamilton.harte-lyne.ca is our IMAP server host. It offers imap and pop3 publicly. I uses local accounts (/etc/passwd) for imap/pop3 authentication ...
1
vote
3answers
80 views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...