Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

34
votes
3answers
19k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
27
votes
9answers
15k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
18
votes
3answers
5k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
28
votes
7answers
3k views

What is a good way to authenticate a user to a smart phone?

What would be a good way to authenticate a user to a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be ...
17
votes
4answers
6k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
14
votes
1answer
9k views

Why use an authentication token instead of the username/password per request?

The author of http://stackoverflow.com/a/477578/14731 recommends: DO NOT STORE THE PERSISTENT LOGIN COOKIE (TOKEN) IN YOUR DATABASE, ONLY A HASH OF IT! [...] use strong salted hashing (bcrypt / ...
11
votes
4answers
7k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
26
votes
2answers
7k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
22
votes
4answers
2k views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...
19
votes
4answers
26k views

What is the difference between authenticity and non-repudiation?

I'm new to infosec and doing some reading. Not surprisingly one starting point was wikipedia. In this article, authenticity and non-repudiation are listed as 2 separate 'Basic concepts'. My ...
16
votes
5answers
8k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesnt even have support for SHA or other algorithms. But I can think of quite a few advantages, ...
25
votes
10answers
6k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
12
votes
3answers
587 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
9
votes
3answers
1k views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
22
votes
4answers
8k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
18
votes
6answers
8k views

How to verify that someone is who they say they are online?

I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are. For example, we don't want ...
15
votes
2answers
2k views

Password and Generated number - How does it work?

In my company, they don't allow accessing the company email or servers from outside the company network. To access the email from outside the network, you have to use: Username, password and a number ...
50
votes
1answer
3k views

What's the risk if I accidently type my password into a username field (Windows logon)?

I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
20
votes
3answers
2k views

How to replace an old password hashing method with a newer one in software? [duplicate]

The software that our company builds just went through a security audit. The auditors flagged our use of MD5 for hashing passwords that users can set if they want a password on their files. Having ...
27
votes
3answers
1k views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
11
votes
6answers
6k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
10
votes
1answer
413 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change ...
10
votes
3answers
5k views

How does an SSL server prove its identity?

This document says that a challenge response authentication proves the servers identity. But is a man in the middle attack still possible if the client does not verify domain name ? Please help me ...
7
votes
3answers
1k views

Is it possible to have authentication without state

In order to login to most websites you need a username and password which is often stored in a SQL database. You are storing per-user information that can change, this is state. Can you prove that ...
4
votes
1answer
49 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
4
votes
1answer
1k views

Blackberry + RIM Bluetooth-based Smart Card Reader

Has anyone used this Bluetooth based smartcard reader? (scroll to bottom) If so, what are your experiences with it? Can you tell me if it's possible to require only the presence of the card + card ...
1
vote
3answers
284 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
17
votes
7answers
2k views

Taking password letters not whole one, is this secure? [duplicate]

I found a site which is taking password letters from their users not the whole password. Is this secure? Or do they have saved password as salted hash (MD5)?
16
votes
5answers
1k views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
15
votes
5answers
2k views

Is there any reason to show the same message for invalid username as password?

I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
7
votes
2answers
3k views

ssh public/private key pair

I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
3
votes
1answer
350 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
3
votes
2answers
921 views

User authentication + database encryption with same password

I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
10
votes
2answers
1k views

My bank makes me enter my password using the mouse. What's up with that?

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
9
votes
3answers
615 views

Does Gmail 2-factor auth increase security on smartphones?

So I have enabled 2-factor authentication on Gmail, which means that if I log in on a new machine, it sends a token to my phone. Now, if I access Gmail from my phone, it seems like I have only one ...
7
votes
4answers
2k views

How to prove Bob has received Alice message

I have read up on Digital signature and it is stated that it provides non-repudation. Assuming Alice signs the message using her private key and sends it to Bob, Bob can use Alice's public key to ...
7
votes
2answers
5k views

When using symmetric key encryption, do we need to sign?

Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
7
votes
1answer
4k views

Does NIST really recommend PBKDF2 for password hashing?

We hesitated between BCrypt and PBKDF2 for password hashing. In many forums and blogs people say something like "In their Special Publication SP 800-132 NIST basically recommends using PBKDF2 for ...
6
votes
5answers
747 views

Should a closed source website keep a secret key in its source?

Various APIs (such as Facebook or Amazon S3) require a secret key to authenticate access to the service. Obviously, if source code is public, the key should not be in the source! What about for a ...
5
votes
3answers
415 views

Session vs Cookie Authentication

Here what I means by the two : Session Authentication : Stored "Is authenticated" state in a session variable. Cookie Authentication : Stored "Is authenticated" state in a cookie protected from ...
5
votes
1answer
255 views

Security protocol for NFC stickers/cards

Lets say I'm using NFC cards for access control. NFC cards/stickers are easily readable and writable, so my worry is that the data on them could easily be cloned onto another card/sticker and bypass ...
4
votes
1answer
119 views

Issuing and managing large numbers of certificates for client authentication

I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a ...
2
votes
3answers
4k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
3answers
2k views

Determining the accuracy of a biometric system

How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?
1
vote
1answer
2k views

How to secure database table of users for an application?

I am working on a Windows application that utilizes a MySQL database for its user authentication and data storage. Within the application, the highest level of user (Administrator) can create and ...
0
votes
2answers
906 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
11
votes
4answers
10k views

What are the disadvantages of single sign-on authentication?

We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication. In the words of ...
11
votes
2answers
3k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
8
votes
4answers
2k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new ...
6
votes
3answers
238 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...