Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
1answer
149 views

Why recommend “letters, numbers, and special characters” in a User ID?

Why do some sites recommend "letters, numbers, and special characters" in a username or User ID? When creating a User ID at the www.discovercard.com website, the "User ID Strength" indicator meter ...
2
votes
3answers
3k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
2answers
318 views

Determining the accuracy of a biometric system

How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?
10
votes
4answers
5k views

What are the disadvantages of single sign-on authentication?

We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication. Advantages Users ...
8
votes
2answers
2k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
8
votes
4answers
1k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new ...
6
votes
2answers
789 views

Storing third-party auth info securely

Suppose there's a multi-user web application that requires access to user's mailbox (on third-party service, like gmail, etc.). This access needs to be persistent. Which means we'd have to store user ...
5
votes
2answers
3k views

When using symmetric key encryption, do we need to sign?

Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
5
votes
3answers
1k views

storing the third party credentials in the database/some secure place

This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user. Our system connect to the third party system using ...
4
votes
2answers
803 views

Is HTTP Digest + MD5 still an alternative to consume my own api?

I'm reading a lot about implementing security constraints to a REST API. There are a lot of methods, some better than others for 3party applications or to consume my own API. HTTP Basic + TLS (with ...
3
votes
2answers
189 views

How does my bank knows my second and forth chars of my password [duplicate]

I see that the new login mechanism used by some banks in UK and also used by visa debit authentication is to ask for three random characters from your password at login (for example second, ninth and ...
1
vote
3answers
229 views

Should I trust my bank after this [closed]

I have just discovered that I can login to my bank with passwords that is not mine. Example: My password is "1234" but I am authorized with all possible post characters. For example "12345" or ...
1
vote
3answers
206 views

Are subdomains a cure for phishing?

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
0
votes
2answers
248 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
0
votes
1answer
198 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
164
votes
7answers
28k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
42
votes
5answers
7k views

What are the downsides of BrowserID/Persona compared to OpenID/OAuth/Facebook?

Mozilla went live with a new service called BrowserID/Persona (announcement, background). It is intended to replace current single-sign-on solutions such as OpenID, OAuth and Facebook. One advantage ...
56
votes
6answers
6k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
20
votes
3answers
5k views

What are the main advantages and disadvantages of webid compared to browserid?

What are the main advantages and disadvantages of webid compared to browserid? This question is inspired by this answer which got a number of upvotes despite being very vague on the topic of that ...
39
votes
6answers
5k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
33
votes
9answers
2k views

Use additional “password” in Referer to hide private site?

I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain). I don't want anyone to know that there is anything at example.com, ...
32
votes
4answers
7k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
54
votes
12answers
3k views

How do you log in from an unsecured computer?

Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
17
votes
1answer
108k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
14
votes
3answers
3k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
39
votes
4answers
7k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
19
votes
5answers
1k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
22
votes
5answers
2k views

Should usernames be kept secret?

Help me settle an discussion among colleagues and guide future design: Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
19
votes
3answers
5k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
15
votes
4answers
4k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
14
votes
6answers
1k views

Is This Login Security Enough?

I'm coming up with my next login system for admins of an ecommerce website to have login form is SSL secured password is converted to sha256 before being transmitted (bcrypt is too slow still for ...
5
votes
6answers
779 views

How do I secure my login page?

The login page is the starting point to any web site and the most important thing to authenticate the user. When I begin to build any web application, I take a lot of time to think about how to ...
19
votes
4answers
6k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
19
votes
4answers
1k views

Biometric versus other Two Factor Authentication Mechanisms

Over the years biometrics is the go-to movie authentication mechanism, but in the real world I'm getting conflicting opinions about it. Everything I've learned shows that biometrics are flawed ...
13
votes
4answers
9k views

why a client authentication is not commonly performed in the TLS protocol?

Is there any reason for this other than key/certificate management on the client-side?
12
votes
3answers
456 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
9
votes
4answers
4k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
9
votes
3answers
6k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
1
vote
3answers
4k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
14
votes
8answers
6k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
14
votes
4answers
4k views

Three-Factor Authentication for Windows

This HowToGeek article... http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/ ...got me thinking. Is there any software (or combination of software) that ...
12
votes
3answers
6k views

How does deauthing work in aireplay-ng?

I have a question of how aireplay-ng works when it deauths. I mean, it is really easy to disconnect another client from an AP: you just need to run the deauth command (in aireplay-ng) once, specifying ...
9
votes
2answers
3k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
6
votes
3answers
6k views

help understanding client certificate verification

I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
4
votes
3answers
5k views

How to distribute client certificates without exposing private key?

I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication. I'm ...
3
votes
3answers
350 views

Can a zero knowledge proof of voting be made using a trusted auth server (without client side crypto)?

Questions: Can one implement a secure voting system having all the features described below? e.g. without disclosing any individual's vote to the government server (or the third party), preserving ...
18
votes
6answers
2k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
18
votes
1answer
722 views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
15
votes
3answers
18k views

What is single sign on versus federated login?

What is the difference between Federated Login and Single Sign On authentication methods?