Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
3
votes
3answers
317 views
Is this admin area secure enough?
EDIT: Please view the revised question instead
The admin area has special access to the database (modifying orders, etc).
To help explain, I drew a diagram, so here is my process:
Notes:
I ...
3
votes
1answer
222 views
How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?
I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
3
votes
3answers
1k views
What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?
I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional.
My intent is to gracefully ...
2
votes
1answer
608 views
Please explain Time-step in Time-Based One-Time Password Algorithm
I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password)
I have no issues with HOTP. But according ...
2
votes
4answers
601 views
Can SMS text messages be used to verify a person's unique identity through a short code system?
We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
1
vote
2answers
338 views
Signed request vs HTTP digest auth for API authentication?
By signed request I mean something like this (simplified example):
Client creates a sig in his request:
$sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
1
vote
1answer
293 views
Web application software architecture: basic security
I am a complete beginner in the security topic and I know that I should read this, but I have a small question to which I hope exists a short answer.
Let's say I have three components of a ...
0
votes
1answer
246 views
How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?
This document describes how there are 3 ways to constrain a SmartCard certificate
The Enhanced Key Usage field defines one or more purposes for which
the public key may be used. RFC 5280 states ...
13
votes
3answers
521 views
What can I do if my bank thinks my date of birth is “known only to me”?
My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name.
...
9
votes
5answers
505 views
Non-OEM Biometric Software?
Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
8
votes
5answers
215 views
How do RSA fingerprints protect from MITM attacks?
I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site.
Like when you do a git push, it ...
8
votes
4answers
483 views
Is there any reason to show the same message for invalid username as password?
I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
7
votes
2answers
337 views
Is a rand from glibc's rand secure for a login key?
Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
6
votes
3answers
637 views
Is the OpenPGP private key inherently password-protected?
I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key?
Essentially, ...
5
votes
6answers
1k views
Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?
I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
4
votes
2answers
746 views
How is user authentication sent in a public wifi? Radius/802.1x/EAP etc
I visit the airport, I pull out my laptop and connect to a network (no password needed).
I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
4
votes
1answer
353 views
How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?
It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing?
Some examples I'm thinking of ...
4
votes
2answers
394 views
Storing third-party auth info securely
Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
3
votes
1answer
201 views
Is this acceptable login security?
I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2.
I discovered that I could input my password, followed by garbage, and it would be accepted.
How is this considered ...
3
votes
3answers
1k views
Do you need to encrypt session data?
I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
3
votes
2answers
2k views
What is single sign on versus federated login?
What is the difference between Federated Login and Single Sign On authentication methods?
3
votes
7answers
431 views
Biometric authentication in the real world
can anyone give a realistic estimation, based on real-world experience, of how much biometric authentication techniques are being used in the IT field?
2
votes
3answers
147 views
Should email verification links be 'time limited' after user registration?
Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
2
votes
2answers
232 views
Why superuser or administrator account should never locked?
Why should administrator or superuser account never locked regardless how many incorrect login attempts are made?
What should be done instead to alert the staff to the attempted instrusion?
2
votes
1answer
543 views
“Extended Protection” primer and implementation guide to prevent MITM
Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks.
Does anyone have a primer (or explanation in plain English) what this feature is, ...
2
votes
2answers
765 views
Is it possible to change the admin user/password remotely on a router without logging in?
Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
1
vote
2answers
337 views
Appropriate strategy for preventing brute forcing of logins?
I am currently building security into a website. So far, I have the following rules, and am wondering if this seems sufficient.
5 failed login attempts for a particular username will cause that ...
1
vote
2answers
171 views
TCrypto - Comments about design decisions I made?
I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
0
votes
2answers
167 views
What are RealVNC 5.0 Authentication Protocol Security Limitations?
In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
0
votes
1answer
102 views
Authentication methods without trusting 3rd parties unless explicitly indicated
The plan is to have a situation in which no third parties have to be trusted unless you explicitly indicate so. For example CA's are only used when the contact explicitly added the CA as a trusted ...
0
votes
2answers
128 views
Verifying users location & authenticity
I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin).
I need to verify the following:
Business Name
...
