Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
0answers
39 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
8
votes
6answers
604 views

Easy explanation of SSL client certificates for a developer

I've been thinking about using client certificates for my web apps, desperately hoping for security-conscious users to put their private key on HSMs so they don't get stolen even if the machine is ...
11
votes
3answers
298 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
0
votes
2answers
51 views

Is PIN-protected token with login certificate a two-factor authentication if the token is controlled solely by the user?

I know it isn't since the service the user is authenticating to cannot check the PIN correctness or existence. I need, however, to explain this to people who are convinced this actually is a ...
12
votes
1answer
630 views

Why is the truncate function for HMAC one time passwords so complicated?

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define ...
1
vote
1answer
35 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
4
votes
1answer
77 views

Challenge Response with a Tan Book?

i am trying to secure a connection between a Mobile Device (Client) using a webApp and a Home Device (Server) in a potentially unsafe Wifi Network. The communication is asynchronous and i am trying ...
0
votes
1answer
48 views

Google Accounts login - is it good enough for financial services?

I am wondering - is using Google Accounts login (in a setup similar to this) secure enough for financial services (you can assume that if someone logs into your account, your money gets stolen)? On ...
0
votes
1answer
42 views

Framework behind password reset mechanism

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because ...
0
votes
3answers
58 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...
4
votes
3answers
312 views

SSH Public Key Authentication vs Username/password for API Access

I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing. I can either store the ...
1
vote
5answers
11k views

Wifi deauth attack - Difference between Aireplay and MDK3

I am currently working on some Wifi related security issues, and something appeared to me. I have an Open Wifi network, to which a client connects. I try the Deauth attack from Aireplay ...
50
votes
9answers
8k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
6
votes
3answers
937 views

How were resources shared before OAuth?

With OAuth 2.0, it is pretty straight forward for a developer to authenticate a user via another service in order to obtain its data, e.g. get tweets from a Twitter user or fitness data via RunKeeper, ...
1
vote
1answer
120 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
22
votes
4answers
1k views

Why do some sites block pasting into username or password input fields?

I use a few websites that prevent me from copying & pasting into the username or password fields. It's quite frustrating when using a password manager, and if anything I'd think it discourages ...
3
votes
2answers
113 views

Obscure username input on login forms?

Not (necessarily) a duplicate of: Should both user ID and Password be masked for online banking? Definitely not a duplicate of: Should usernames be kept secret? I can sense your finger on the "mark ...
0
votes
2answers
69 views

Is CAPTCHA necessary when I use token?

I wonder is it a good idea using captcha when using token on login page? I think it's impossible for robots to mess with login page because token changes on every request. Thanks.
25
votes
6answers
10k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This ...
0
votes
0answers
19 views

Combining Hash Visualisation (VisualHostKey) and SiteKey to prevent MITM

TL;DR Skip to the No SiteKey + Plugin if you don't want to read this whole thing. VisualHostKey shows an SSH hash like this: # Host github.com found: line 53 type RSA 2048 ...
1
vote
1answer
21 views

Purpose of Initialization Vector in File Encryption and Authentication (FEA)?

I came across this schematic of FEA implementation using RSA and AES: Suppose that PKB is Bob's public key, PKA is Alice's public key, SKB is Bob's private key, SKA is Alice's private key, Ks is the ...
22
votes
3answers
8k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
6
votes
2answers
389 views

Does the secure attention key really increase security?

Are there any statistics on whether requiring the secure attention key to be pressed on login actually increases security ? I personally don't see the point of that : if you're after credentials, ...
2
votes
3answers
142 views

Is it okay to only use username/password to secure an admin page for moderating a website?

Is there a standard practice to securing an admin page for an application written in angular and nodejs or just in general? The admin page would approve/ban users and moderate comments. Should it be ...
2
votes
2answers
231 views

Temporarily save failed logins password hashes for using against brute force attack

My question is about online brute force attacks, that try to authenticate in the website. 1) For the first case if the requests are coming from the same ip, I think this are relatively easy as after ...
0
votes
1answer
76 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
236
votes
7answers
183k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
3
votes
1answer
125 views

How can I successfully perform an xss attack on a dummy website? [closed]

in my security course, we were told to practice an xss attack using firefox on this website; http://permalink.co/ No worries, this is a website specifically setup for us to practice ...
3
votes
2answers
108 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...
3
votes
3answers
748 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
3
votes
2answers
69 views

Why would you decouple your resource and login servers?

As described on this link, OAuth specifies that a login server and a resource server should be decoupled. The idea is that if one of your resource servers gets hacked, no password data is lost. All ...
3
votes
1answer
92 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
0
votes
1answer
44 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
0
votes
1answer
60 views

Security tradeoffs while designing a mobile Web Service API

I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps. It is an API which tracks users' locations so yes, the data is reasonably sensitive. ...
22
votes
4answers
7k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
101
votes
8answers
41k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
3
votes
2answers
162 views

Are AWS security groups sufficient to authenticate communication between instances? (HIPAA)

Say I have a private service that exposes sensitive information (PHI) via a REST API, and that I want to permit access to it from only one other service. Is it enough to partition these services ...
0
votes
0answers
19 views

Difference between Kerberos and GDOI?

What is the difference between Kerberos and GDOI, I know first is more toward authentication and latter is more toward multicast key management, can I use Kerberose protocol in GDOI for server and ...
1
vote
1answer
124 views

Risk of keeping OAuth2 client_secret in application

As an exercise, I'm developing a desktop application with which users need to log in to a web service. A logical use-case for OAuth2 one would say, but I'm beginning to doubt its usefulness. I am ...
0
votes
0answers
16 views

Difference between Kerberos and GDOI

What is the difference between Kerberos and GDOI, I know first is more toward authentication and latter is more toward multicast key management, can I use Kerberose protocol in GDOI for server and ...
1
vote
1answer
633 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
1
vote
1answer
215 views

Is this a good approach to secure my REST API?

My application consists of a nodejs back end API but I am also developing a "reference" implementation of a JavaScript client, which is a backbone SPA. First of all; the API accepts only HTTPS ...
0
votes
1answer
83 views

SSO software – where is symmetric key stored?

In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ? When using smartcard, I can understand that ...
5
votes
3answers
2k views

OAuth2 - Resource Owner Password Credentials grant

The OAuth2 spec describes the Resource Owner Password Credentials grant type and authorisation flow here. I understand that only 'trusted' client applications would be allowed to use this grant, for ...
37
votes
7answers
7k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
9
votes
2answers
928 views

How does Google detect new devices for two factor authentication

When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device. How do they ...
1
vote
1answer
74 views

Limiting Login Attempts [duplicate]

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
0
votes
1answer
62 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...
3
votes
1answer
950 views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
1
vote
1answer
91 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...