Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
45 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
1
vote
3answers
87 views

HTTPS client “pairing”

I've been redirected here from SuperUser, I hope the question is appropriate. I need to restrict usage of a certain site to a limited number of customers. More than that, actually: I would like to ...
4
votes
1answer
81 views

Issuing and managing large numbers of certificates for client authentication

I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a ...
0
votes
2answers
107 views

How can I make locally stored data unreadable unless connected (logged in) to server?

I have a chat application built in Java. The chat app stores a log of the user Jimmy's chats locally on his machine. I want this chat log to be encrypted so if someone uses the computer (authorized ...
5
votes
4answers
232 views

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

I was watching a security vid on Irongeek the other day (I immediately lost track of which specific vid, unfortunately) where the creator gave some interesting advice about doing live password ...
-2
votes
1answer
75 views

Unconditionally Secure Authentication

I'm trying to add the authentication for my One-Time Pad implementation. I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication. But I don't ...
0
votes
2answers
69 views

Need to protect passwords (or 1fa) in the context of 2fa

I am trying to get some clarity on this. I am not looking at personal or risk mgmt perspectives. Why do we need to protect passwords (or 1st factor) in the context of 2fa (or multi factor ...
0
votes
0answers
44 views

Is it possible to do Bluetooth pairing without a shared secret?

I was wondering if it is possible to pair a device if it does not have a shared secret key with the device it wants to connect to? I believe authentication is done using challenge response between ...
0
votes
1answer
34 views

Authenticating on the client with OpenID Connect using Authorization Code flow?

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting ...
2
votes
2answers
120 views

What are reasonable alternatives to “Trust this computer” prompts when signing in?

User feedback for a bank authentication website included this comment: It's annoying to get verification codes to my email or phone every time I log in to my Bank account from a new device ...
8
votes
4answers
1k views

Can I replace username and password with a long random text in URL? [duplicate]

Scenario One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
8
votes
2answers
142 views

How can I track someone logged in my gmail account over imap?

Gmail tells me if someone new logged in to the web-interface (device, browser etc.) But what about IMAP logins? If someone has my password can he stealthy read my mails over IMAP?
2
votes
1answer
91 views

What is the difference between key mechanism in wep and wpa

I haven't found the resources explaining about exact authentication mechanism about wpa-psk in the internet. finally i found securitytube videos i found one video regarding the wpa-psk concepts.in ...
0
votes
0answers
29 views

Smartcard authentification: encrypt/decrypt or ECDSA?

I'm implementing a simple door access control with smart keyfobs. At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key. ...
1
vote
0answers
75 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
4
votes
2answers
170 views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
-2
votes
1answer
116 views

Can someone bruteforce my OSX? (Macbook)

Is it possible for someone to bruteforce or perform a dictionary attack on a Macbook? It's very easy to bypass security of a Windows box (Password Protection) , what is the difficulty level of ...
5
votes
3answers
248 views

How do Pentesters approach attacking 2FA (two factor authentication)?

I'm looking for practical ways to attack 2FA. What do you need to consider and how would you go about testing the effectiveness of 2FA? My only thoughts are that you would attack the implementation ...
1
vote
1answer
30 views

SSL/TLS certificates that only certain users can use to talk to my server

are there something like SSL/TLS certificates or other equivalents which could allow only certain trusted users (from the internet) who have my server credentials in their browser to access my web ...
-2
votes
2answers
47 views

Metasploitable: vnc_login - doesn't work with msfadmin:msfadmin

I am quite new to Metasploit and pen testing in general, so apologies for any seemingly noobish references below. I am using auxiliary/scanner/vnc/vnc_login, after seeing that the 5900 port is open ...
0
votes
1answer
45 views

Collect XML files from web server with secure authentication

I need to collect XML files from a 3rd party's web server. These XML files are generated by said 3rd party on a daily basis (e.g. data_2015-11-26.xml) and should therefore be fetched at least daily ...
0
votes
3answers
38 views

enforce some peers to use IPsec and allow others to bypass it when reaching the same server

Lets assume I have a server that owns UDP socket. And then, for some clients, this server would expect to receive this UDP traffic encapsulated over IPsec. While for some others clients (the default), ...
1
vote
0answers
33 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
4
votes
3answers
134 views

Is there a way to prove some content came from a specific website?

I guess we can all agree that a screenshot of a website proves nothing; one can edit the HTML as much as one likes, take a screenshot and show a website displaying false information. As far as I ...
0
votes
1answer
59 views

How should I secure my site for logins? [closed]

I am making my very first site, and I need a way, to secure it. Users must be able to post stuff on my site, but I want to prevent throttling my site or using bots to break it. I thought of making ...
0
votes
1answer
29 views

Authentication using a digital signiture

I'm new to the world of digital signatures and encryption and I'm trying to learn more. I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital ...
30
votes
6answers
4k views

Employee laptops in China

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. This loaner had MS Outlook and was linked to my normal company ...
0
votes
2answers
84 views

Is it secure to return a JWT to an already-logged-in user?

I'm using JWT to handle an SSO scheme where two systems (let's call them A and B) both require authentication, but the user datastore is in one system only (let's say A). Everything I've seen about ...
0
votes
3answers
60 views

Hostname validation for server-side certificate

I have a reverse proxy which connects to an application which presents a certificate used for PKI based validation. I was wondering if I should enforce the condition that the common name (or ...
2
votes
2answers
120 views

I delete cookies file in chrome but i'm still logged in after I restart Chrome

I'm using linux and google chrome as browser. I know that cookeis are stored at /home/my_name/.config/google-chrome/Default/Cookies. I deleted this file but it seems like when I restart Chrome and ...
1
vote
2answers
134 views

Keepass - password paranoia

How do I know that the Keepass app isn't behind the scenes at some point sending my master password over internet to some secret site whose job it is to collect them and use them for evil means?
6
votes
1answer
193 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
0
votes
2answers
70 views

Two-factor authentication methods: password + SMS/voice message vs. password + app-generated code?

I am thinking which methods of two-factor authentication are most reliable and secure when using Pebble as an user end who has the capability of seeing his or her SMS messages but not answer phone ...
0
votes
1answer
133 views

Tie key to computer

I have client server application. Is it possible to tie an encryption key to some computer (say my client) such that is key is stolen attacker won't be able to use that key from another computer? ...
1
vote
3answers
74 views

How to verify that a host applied a firewall ruleset as is?

I have a service that sends rulesets to a fleet of hosts. Each host in its turn is expected to apply its ruleset to its firewall (iptables) and then send an acknowledgement back to the service. I ...
3
votes
3answers
72 views

Implement a passcode to authenticate app users [duplicate]

This question is related to this one. We're busy implementing 5 digit passcode authentication for our app (Android, iPhone), but we're running into a complexity. We're unsure how we can safely ...
0
votes
2answers
57 views

Does X.509 standard claim to check client certificate's expiration date on server side?

Does the X.509 standard claim to check client certificate's expiration date on server side? Consider an expired client certificate in the trust store of web server. If some client tries to ...
2
votes
1answer
44 views

Does TrustManager PKIX (or RFC 3280/X.509) really check client certificate expiration date?

It was noticed that default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check expiration date of client's certificate during ...
4
votes
0answers
20 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
1
vote
0answers
51 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
4
votes
2answers
84 views

Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys)

I often ssh into servers for work and play using dynamic dns with ssh keys that are password protected. Twice now (shame on me!) I have mistyped the dyndns.org part of the address and been greeted ...
0
votes
1answer
122 views

multi tenancy and microservices API authentication/authorization

I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
1
vote
1answer
61 views

Encryption that service provider themselves cannot decrypt?

I recently saw the following message verbatim on an online application I use. The login is simply a login/password combination. There is no oauth, no two factor authentication, etc... This sounds ...
1
vote
1answer
132 views

Client authentication successful when using a pfx with Java, fails using OpenSSL. Why?

I've been trying to troubleshoot issues with client authentication and am seeing different behaviour when connecting from a Java application vs OpenSSL. A third party has provided me with a pfx, I've ...
1
vote
1answer
63 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
9
votes
3answers
634 views

Do client certificates need to be trusted by the client?

I'm looking for some clarification around the trust requirements (if any) of client certificates. I'm working with a third party to access their services via Mutual TLS. I generate a CSR, send it ...
2
votes
1answer
62 views

SSH Server Authentication

I know this question was asked several times in several ways, for example: Can an SSH server fingerprint be spoofed? What stops an SSH server from MITMing logins? However, none provided the ...
2
votes
1answer
87 views

How to achieve authentication using symmetric cryptography

Here, message authentication is defined as A MAC authenticates a message. If Alice sees a message and a MAC and knows the associated secret key, she can verify that the MAC was produced by a ...
1
vote
3answers
330 views

Prevent or detect key copy

This question can be classified as somewhat two interrelated questions - or two goals. Main aim is basically to authenticate client to server, but remain secure even if someone steals the key from ...
1
vote
0answers
26 views

fakeauthentication is working when my belkin belkin router f7d2301 mac-address filtering enabled

Actually i have enabled mac-filtering in my belkin router and the security policy is none and the authentication is open authentication. Iam(attacker) using kali linux. when i done a fakeauth attack ...