Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
0answers
15 views

Password Managers — Generating Passwords On The Fly a Safe Approach? [duplicate]

Most password managers store user credentials for individual services encrypted on their own back-end databases, so that your passwords are available on multiple devices. So, a DB compromise on these ...
1
vote
1answer
69 views

Pro's and Con's of current 2-step-verification processes?

I am currently working on a project, and we are exploring different types of current industry MFA standards. The most known ones would most likely be HOTP & TOTP pins, which are used in the '...
1
vote
3answers
260 views

why don't we store passwords in a database using encryption instead of hashing? [duplicate]

hashing is a one way method, if a user lost his password he will never be able to get that password from the server, so why don't we store passwords in a database using encryption instead of hashing?
2
votes
1answer
241 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
87
votes
12answers
12k views

Is a 6 digit numerical password secure enough for online banking?

My bank went through a major redesign of their customer online banking system recently. The way security is managed across the platform was also reviewed. The password I am able to set now to log in ...
1
vote
1answer
175 views

How Google Authenticator in Android mobile identifies this is the right SSH server?

I am new to Google Authenticator mechanism. I have gone through the basics of mechanism but I couldn't understood the logic behind it to make a connection to the Linux machine. I have a Linux machine ...
1
vote
1answer
105 views

Everykey (Bluetooth master key) - is it really secure? [closed]

Obligatory disclosure I have no relation to the Everykey company and do not mean to promote them in any way. I came across the product Everykey that claims to be "your only key" by allowing you to ...
0
votes
2answers
98 views

Smartphone 2FA has been broken?

This research states that two factor authentication has been broken by the possibility to remotely install an app on a device. I believe that an attacker can publish an app in the store that is ...
205
votes
17answers
18k views

Passwords being sent in clear text due to users' mistake in typing it in the username field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
1
vote
1answer
36 views

Limiting access to data in a web application from IPs outside the network

My goal is to build a system (PHP + MySQL) where a user will have access to particular data only when logged in locally (from one of the office computers with a local IP), and to all the non-sensitive ...
3
votes
2answers
85 views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
1
vote
1answer
33 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
1
vote
1answer
42 views

What data is sent between an NFC/BTLE FIDO U2F device and Chrome (or other agent)?

I need to explain what "conversation" occurs between a FIDO U2F device (YubiKey NEO) and the agent (Chrome). I want to know if it's a challenge response, and ultimately figure out how much ...
-3
votes
1answer
133 views

Why not just blacklist every IP except yours?

Inspired as a continuation of this question: Is it practical to pre-blacklist certain GeoIP regions? Why would it not make sense to blacklist every single IP address that shouldn't have access to a ...
0
votes
0answers
19 views

Is “full loop” and “half loop” authentication the right word to describe this 2FA sequence?

I'm looking for a term to describe this abstract thought about multifactor devices and how they are implemented. In the examples below, there are different levels of device authentication, but the ...
-2
votes
1answer
68 views

Best way to control who can run my application? [closed]

I am planning to make an application and I don't want everyone to use it (only allowed people). What I was going to do is getting the MAC address of the user and add it to our database "allowed_users" ...
1
vote
1answer
79 views

How important is a static IP address when authenticating with my server?

I am looking to move my business into a small office. I have found somewhere very suitable but unfortunately they cannot provide a static IP address. Currently, to connect to my server from home I ...
0
votes
0answers
27 views

From a credential flow perspective, whats the difference between FIDO UAF and FIDO 2.0 Web Services?

The FIDO Standard allows for devices and authentication schemes to be certified as UAF or U2F. This allows for flexible unified authentication, and optional second factor enrollment and registration. ...
0
votes
0answers
20 views

Key Distribution Center Key Protocol Analysis

http://i68.tinypic.com/fwu92v.png As shown in the image, why is Circle 1 to be B and Circle 2 to be A? Why is not the opposite, that is, Circle 1 to be A and Circle 2 to be B? like this picture ...
433
votes
22answers
92k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
3
votes
1answer
43 views

Relatively simple OTP code generated by SafeNet MobilePass

I noticed something peculiar while logging into the VPN of the company I work for. I generated a one-time passcode from MobilePass, and the code displayed was “010010”. I captured an image of this ...
0
votes
0answers
62 views

OWASP-ZAP and DVWA Login

I need to do a pentest of the DVWA application. To do that, I chose the OWASP-ZAP tool. I followed all the steps of this tutorial. But when I try to run the "spider" the program doesn't find all the ...
1
vote
1answer
51 views

How to secure android REST basic authentication credentials against reverse engineering?

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer ...
1
vote
0answers
59 views

Azure AD B2C vs Auth0

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct comparison?...
0
votes
2answers
46 views

SSL protocol analysis

1) What is the use of Cert B in this protocol? 2) What does it prove to Alice? 3) Is it okay if we remove Cert B in this protocol? Even without Cert B, isn't the fact that Bob used his private key ...
1
vote
0answers
44 views

How can I authenticate securely to an internal website from an iPad without an strong password?

I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities: Credentials stored in the iPad (like Gmail credentials). Using ...
-1
votes
0answers
64 views

HMAC Signature Based authentication for REST APIs

We are building publicly available RESTful APIs for eCommerce where clients can place logistics requests with us. We want stateless authentication on these APIs. While on-boarding, every client will ...
2
votes
1answer
53 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
1
vote
0answers
32 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
15
votes
6answers
10k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
47
votes
10answers
5k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
1
vote
0answers
27 views

Dynamic Key Management in WPA through Radius server

Can anybody tell me in detail (or provide good links), how the dynamic key management is done by the authentication server in WPA? In other words, let's say I gave my credentials to the authentication ...
0
votes
0answers
32 views

Use MDC to provide origin authentication for public key encryption?

Why can't we use an manipultation detection code (MDC) to provide origin authentication when using public-key encryption?
0
votes
0answers
24 views

Providing identity verification via confirmed contact info to unconfirmed address w/o leaking information?

I emailed a known e-mail address for my local telecommunications/internet company about a complaint with their service. It appears the person I emailed forwarded this to somebody else in their office ...
3
votes
0answers
944 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
1
vote
1answer
682 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
0
votes
2answers
41 views

Is there any added security/vulnerabilities if you allow a “trusted-party” to vouch you are legit, if you were locked out of your account?

I was reading this answer on a question. http://security.stackexchange.com/a/498/106817 Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at ...
1
vote
4answers
376 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
6
votes
4answers
321 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
2
votes
0answers
42 views

What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?

The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include third party legacy services which need a login/...
0
votes
0answers
51 views

Framework to authenticate web API requests from legacy application

I have a legacy ASP.NET MVC application that uses pretty standard forms authentication which validates logins against an application database. The scope to change this application is limited, however ...
0
votes
1answer
83 views

Handling user login using asymmetric cryptography

Is it possible to implement a login protocol with asymmetric cryptography instead of the hashed password method? For example, while creating an account, the client generates a private/public key pair ...
0
votes
1answer
125 views

Why is storing usernames in cookies bad? [duplicate]

A commonly repeated advice over the web is not to store usernames in cookies. However, I don't really understand the problem. What I'm doing in my web application is: I generate a 16-byte (converted ...
0
votes
0answers
39 views

Would encrypting a signed JWT prove viable to secure claims payload?

I am working on a server-client web application, and as an authentication scheme, I am issuing base64 encoded json web tokens. Consider the following token... eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9....
0
votes
0answers
115 views

Secure Handshake and register for Auth

The registration The Start - pre-authentication Let's assume there are Alice and Bob. They know each others public keys and each of them generates a random string - Bob's Bobkey and Alice's Alicekey....
0
votes
1answer
45 views

Why is CBC-MAC insecure for variable length input?

Can anyone explain why CBC-MAC is not secure for variable length message? I read many books, but there are still some confusion. Like the highlighted parts in following pictures Slide 32: Slide 33:...
0
votes
1answer
63 views

Authentication scheme security: unique link and birth date

Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details. ...
1
vote
1answer
88 views

How is github 2FA personal access token more secure than passphrase?

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
5
votes
2answers
1k views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
5
votes
1answer
101 views

Why does Android care about differentiating multiple fingerprints?

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this ...