Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

13
votes
3answers
2k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
20
votes
4answers
8k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
18
votes
5answers
945 views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
33
votes
4answers
4k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
21
votes
5answers
2k views

Should usernames be kept secret?

Help me settle an discussion among colleagues and guide future design: Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
14
votes
6answers
910 views

Is This Login Security Enough?

I'm coming up with my next login system for admins of an ecommerce website to have login form is SSL secured password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
5
votes
6answers
713 views

How do I secure my login page?

The login page is the starting point to any web site and the most important thing to authenticate the user. When I begin to build any web application, I take a lot of time to think about how to ...
15
votes
4answers
4k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
14
votes
4answers
3k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
20
votes
4answers
6k views

How secure is Windows 8's Picture Password login?

The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
17
votes
6answers
3k views

How to verify that someone is who they say they are online?

I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are. For example, we don't want ...
11
votes
3answers
383 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
18
votes
12answers
2k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
14
votes
4answers
3k views

Three-Factor Authentication for Windows

This HowToGeek article... http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/ ...got me thinking. Is there any software (or combination of software) that ...
1
vote
3answers
2k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
26
votes
3answers
814 views

What is this authentication method/approach called?

Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
18
votes
1answer
597 views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
16
votes
4answers
842 views

Biometric versus other Two Factor Authentication Mechanisms

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
15
votes
5answers
764 views

Safe way to authenticate (multi-factor authentication?) while being monitored?

(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.) ...
9
votes
1answer
4k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
9
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...
8
votes
1answer
393 views

Build a secure channel without SSL/TLS

I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service). 1. ...
8
votes
2answers
420 views

How is an HTTPS login secure when pages use HTTP?

When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
7
votes
3answers
1k views

Is my session-less authentication system secure?

So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
6
votes
4answers
3k views

HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?

We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
5
votes
4answers
1k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
5
votes
3answers
16k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
5
votes
2answers
2k views

Dealing with expired or revoked signing certificates with Infopath documents

Suppose I have an Infopath form that is digitally signed today by a valid, and active user. When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
18
votes
6answers
2k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
16
votes
5answers
2k views

How many Stack Exchange logins should I have?

On Stack Exchange's Add a login page, one can add logins with Google, Facebook, Yahoo, etc. How many logins should I have to provide the least chance of a hacker gaining access to my Stack Exchange ...
12
votes
4answers
7k views

Preventing deauthentication attacks

I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network. I captured and analyzed the network traffic on my Wifi work ...
12
votes
3answers
328 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
10
votes
3answers
304 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
10
votes
4answers
730 views

What is the key when facial recognition is used as a password?

I get the basics of what face recognition is and the fact that it is used to protect PC's and as a login replacement. However, if it was to be used for encryption, where the role of the key is played ...
10
votes
2answers
4k views

How does deauthing work in aireplay-ng?

I have a question of how aireplay-ng works when it deauths. I mean, it is really easy to disconnect another client from an AP: you just need to run the deauth command (in aireplay-ng) once, specifying ...
9
votes
3answers
4k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
8
votes
3answers
5k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
8
votes
3answers
11k views

What is single sign on versus federated login?

What is the difference between Federated Login and Single Sign On authentication methods?
7
votes
2answers
1k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
7
votes
4answers
310 views

Candidate authentication in large scale assessment

First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes. We're ...
7
votes
6answers
3k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
6
votes
2answers
792 views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
4
votes
2answers
449 views

user authentication by decrypting a random blob

Normal user authentication is done by comparing "hash"-values. A simple example of this: The user password is hashed with PBKDF2 on the client using a salt (the salt is the hash of the user password ...
4
votes
3answers
4k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
4
votes
2answers
473 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
4
votes
1answer
788 views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
12
votes
5answers
1k views

Is there any reason to show the same message for invalid username as password?

I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
8
votes
2answers
2k views

Role Based Authorization vs. Claim Based Authorization

What is the difference between "role based authorization" and "claim based authorization"? Under which circumstances would it be appropriate to implement each of these authorization models?
8
votes
4answers
3k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...