Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
2answers
93 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
2
votes
1answer
37 views

Choosing a group of symbols that contains a password

My bank employs a step in its authentication process besides [the card itself and] the regular password, where the user has a secondary password (3 small sequences of letters, such as Hy X Ba) ...
-6
votes
1answer
108 views

How to attack on a web page to gain username and password? [closed]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
3
votes
1answer
65 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
2
votes
1answer
42 views

How to verify installed packages [closed]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
1
vote
0answers
39 views

If I have the cell #. switch ID and name, can I locate an physical address? [closed]

Only a PRO can help me! My husband had an affair, said it was over five years ago and I should not be concerned, ever again. Yet, the result was devastating, medically with cancer. I believe people ...
0
votes
2answers
91 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
9
votes
1answer
578 views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
1
vote
1answer
122 views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
2
votes
1answer
50 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
2
votes
1answer
89 views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
2
votes
2answers
108 views

Single-use password as the default authentication method?

The crazy password requirements (joke1, joke2) lead me to a situation where there is no way for me to memorize the passwords to the several sites that make those requirements. The result is that ...
2
votes
1answer
37 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
1
vote
0answers
34 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
3
votes
1answer
103 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
3
votes
1answer
111 views

Enterprise Security : Where to Start? [closed]

I am trying to start self studying of Enterprise Security Context, but always feeling kind of lost among all the specs and standards etc. Unlike software development, this really is a challenge as far ...
1
vote
0answers
54 views

Logging in from one CMS to another

Two websites with different CMS, user should type login & password on one website and needs to be logged in second website automatically. Now i have this method, it works but i want to know - is ...
2
votes
1answer
93 views

Potential attack vectors using Javascript to log in [closed]

I would like to allow users of a website to be able to log in at any page. In order to provide a seamless experience my first thought was to collect user credentials (username and password) in a ...
2
votes
1answer
163 views

Why should canary values be chosen at runtime instead of compile time?

For buffer overflow attacks, my exam review says that there are drawbacks to choosing canary values at compile time vs runtime. Why would it be better to choose the canary value at runtime?
-1
votes
1answer
82 views

Fido U2F Public keys in registration response

What is the deference between the two public keys: user public key (2nd element in Token response) user public key inside signature in U2F Token response for registration ?
2
votes
1answer
94 views

How to implement application-specific passwords using strong hashes?

I am implementing a service where application-specific passwords seem a good choice to improve security. A question on why and when they might make sense has already been discussed here Google ...
1
vote
0answers
60 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
-1
votes
1answer
85 views

How can you use XSS to break this security on a site? [closed]

To delete your account on a website, the following form is used: <form action="/deleteaccount" method="post"> <input type="hidden" name="user" ...
28
votes
6answers
4k views

Silently Limiting Login Attempts

I've seen the following login rate limiting approach used on a web site I worked on, but I can't figure out if it's a good idea: After any failed login attempt, the site locks the user account for a ...
-2
votes
1answer
48 views

designing secure telnet [closed]

i came across this question and have been thinking about it without a final solution. The question is to design a secure telnet. essentially to login using a username and password using telnet. I do ...
2
votes
1answer
73 views

Do I have an SSH password?

I have an Ubuntu server hosted on DigitalOcean, I have been using SSH keys since the very beginning. (You can chose for it to be setup before the server instance has even been created). So I have ...
0
votes
1answer
221 views

FreeRADIUS EAP TLS Authenticate based on client certificate CN

I'd like to run FreeRADIUS for EAP TLS authentication but instead of running my own Certification Authority I'd like to use StartSSL. I've setup EAP TLS with StartCom as the only Trusted Root CA and ...
1
vote
1answer
62 views

What are the implications of using OAUTH? Do the positives outweigh the negatives? [closed]

OAUTH seems like a pretty good idea when it comes to helping people authenticate, cuts down on the # of passwords to remember and in general eases the friction of on-boarding. However it would mean ...
8
votes
4answers
1k views

Is having the username and password fields on different pages more secure?

An online bank I use requires inputting your username, navigating to a second page and then entering the password to login. What actual security advantage does this provide, if any?
2
votes
1answer
63 views

How to reset a second factor authentication without compromising the authentication process

I am designing a system that uses two-factor authentication. Where the user can only granted access only if the two authentication factors passed the verification. Let us assume that the first ...
1
vote
1answer
82 views

Designing a password auth/reg system

I'm designing a user reg/auth system for a website and came up with this design for password based authentication. I'd like to know if this is reasonable. (ignoring cookies for caching credentials, ...
0
votes
1answer
96 views

Can I trace a spoofed text message? [duplicate]

Someone is texting me threats and I have no idea who. Is there a way to "unspoof" the number? I know for a fact that they are spoofing as a legit number, because I called it. Thanks in advance.
1
vote
0answers
100 views

Identify the attestation certificate (X.509) in Fido U2F registration response

I'm trying to identify the attestation certificate (X.509) in Fido U2F registration response as described in fido-u2f-raw-message-formats-v1.0-rd-20141008.pdf document: An attestation certificate ...
0
votes
1answer
75 views

Decrypting encrypted traffic with hacking an app [duplicate]

I am thinking how does telegram ensure that messages are secret. I understand they use the public key to encrypt and private key to decrypt. Why is it not possible for an attacker to download the ...
1
vote
1answer
93 views

Secure point to point remote access to NAS drive

This question is very similar but also distinctly different (How do I ensure data encryption on Samba transmission on *NIX systems?) I'm looking to set up remote access to a NAS unit locally sharing ...
2
votes
1answer
130 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
0
votes
1answer
283 views

How to build a secure stateless authentication system for a client-side JavaScript application

i'm building a stateless authentication system for a Dart application (Dart gets compiled to JavaScript, so the whole application is an index.html file which loads JavaScript and runs in the browser) ...
1
vote
1answer
53 views

Best practices for encryption from web<-> specific client

If we want to allow sensitive data between a web server and specific client only, is there anything more that can be done besides the following? Note that this is potentially a duplicate of ...
1
vote
0answers
104 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
2
votes
1answer
96 views

Why does WPA2 need a 4 way handshake?

If client and AP both have the Pairwise Master Key (PMK) available, why do we need a 4 way handshake again to derive some other key (PTK)? Why can't we use PMK for further security process?
3
votes
1answer
124 views

How is JWT implemented?

I'm using django-rest-framework-jwt in one of my APIs. As you might know, the concept is simple: you send username and password and you get a token back. The token is not stored anywhere on the ...
2
votes
0answers
76 views

OpenID Connect: Why use authorization code flow?

I have a question about implementing OpenID Connect I was hoping I could get some help on. I understand the different flows and get that the authorization code flow is good because it allow client ...
12
votes
1answer
658 views

Why is the truncate function for HMAC one time passwords so complicated?

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define ...
1
vote
1answer
45 views

Is CAST5-CBC as supported by OpenSSL an authenticated encryption method?

I'm looking to encrypt some files using a simple cipher plugin. I have access to using AES-256 in CBC mode, but this doesn't offer message authentication and I'd have to build my own HMAC for it. ...
0
votes
2answers
59 views

Is PIN-protected token with login certificate a two-factor authentication if the token is controlled solely by the user?

I know it isn't since the service the user is authenticating to cannot check the PIN correctness or existence. I need, however, to explain this to people who are convinced this actually is a ...
0
votes
1answer
46 views

Framework behind password reset mechanism

I have always seen those "Forgot password" links from web sites that requires some form of user login. Can I get a deeper understanding of how this works? What tools/framework do I need to use because ...
0
votes
1answer
59 views

Google Accounts login - is it good enough for financial services?

I am wondering - is using Google Accounts login (in a setup similar to this) secure enough for financial services (you can assume that if someone logs into your account, your money gets stolen)? On ...
11
votes
3answers
330 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
4
votes
3answers
504 views

SSH Public Key Authentication vs Username/password for API Access

I have a linux device that will be making periodic call to an API server, say everytime the system boots up. Everytime then it should authenticate itself and then do its thing. I can either store the ...
0
votes
3answers
76 views

Is there any way to check the certificates in a client's root CA store?

When a client connected to a web server, is there any way the check to see what root CAs the client has? Edit: Could I use JavaScript to send a GET or POST request to the server, providing a ...