Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
89 views

Authentication, authorization in native mobile clients (Android)

I am developing native mobile client for store that requires user authentication in order to make purchases available. I have my web store page, authentication is provided by CMS (OpenCart). Now I ...
5
votes
1answer
165 views

How secure is CertiVox M-PIN?

CertiVox have designed a system with the aim of "getting rid of passwords". Essentially the system authenticates users with two factors of authentication: A 4 digit PIN and a token stored within the ...
2
votes
2answers
71 views

Certificate chaining:Intermediate Certificate Authorities

Wikipedia says: For example, if a certificate issued to "example.com" and issued by "Intermediate CA1", and the visiting web browser trusts "Root CA", trust may be established in the following manner: ...
2
votes
1answer
135 views

Why is information obtained from public records considered a secure way of confirming your identity?

Various financial institutions, government agencies, etc., use public records information to confirm people's identities, as touched upon in UPS my choice -- How can I access my public records? The ...
23
votes
2answers
3k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
1
vote
1answer
123 views

Is This DIY Password Authentication Scheme Acceptable?

This is mostly a thought experiment for client/server communication, and I want to know the flaws. When a user account is created (with U as the username and P as the password,) I generate a random ...
1
vote
1answer
44 views

Centralized authorization with distributed service providers

I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization). The ...
3
votes
2answers
322 views

What stops an SSH server from MITMing logins?

When I read this question about what gets signed with the private key by the client I wondered: What stops the following scenario from happening: A client connects to an SSH server. The SSH server ...
1
vote
2answers
102 views

SSL/TLS client authentication - practical client cert validation

How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do ...
2
votes
0answers
59 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 ...
1
vote
1answer
39 views

Locking access to remote DB from a freely downloadable app (that acces the DB)

If I want to publish a software that needs to interact directly with a remote database, I will have to put on the software all the required credentials and logic to have the access from the program ...
4
votes
3answers
61 views

HTTP Server: Response time on login request

I have a site on which I would like to prevent an unauthenticated attacker from knowing if an account exists. On the site, passwords are hashed using bcrypt, so login requests must do a bcrypt ...
0
votes
1answer
44 views

How to manage a custom session in a webapp?

I was reading through the OWASP Cheat Sheet and something mentioned in the "Weak Authentication and Session Management" row did not make sense to me. It is recommended in the Design Column, that ...
1
vote
2answers
97 views

two factor authentication without TLS/SSL

It seems silly to ask about using two-factor authentication without TLS/SSL but, I have a vendor that is using public IP without TLS and asking for login creds. Would the login be more secure if ...
1
vote
1answer
84 views

Why doesn't the OS authenticate itself to me?

Sometimes it occurs to me, when doing something like a brew install, or really anything on a CLI (though I suppose this is also true of GUIs to a marginally lesser extent) that prompts me for a ...
1
vote
1answer
93 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
0
votes
0answers
46 views

Designing a security system for road pricing

It's my first semester with Information Security and I still feel a little lost. Sorry in advance for stupid mistakes I may have made. the examples in round brackets below are my own ideas, wrote ...
4
votes
2answers
70 views

Securing anonymous website posts

Can a website allow users to securely post anonymously, while still allowing these posts to be edited by the original author at a later time and preventing editing by other users? In this context, ...
0
votes
1answer
48 views

QR-code based credential retrieval?

This is a sort of design review question that I'm hoping is suitable for this site. I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile ...
4
votes
1answer
67 views

Purpose for “One Time Use Token”

I'm connecting a Salesforce ORG with a third party vender through a custom API (they basically wrote it just for us). The API requires you to retrieve a "token" that you pass into other calls through ...
0
votes
1answer
129 views

Which systems in a network are able to spoof a TCP handshake?

I am reviewing for my final exam tomorrow, I came across a past exam question. An attacker wants to initiate a TCP handshake with a target to make him think E initiated it, attacker knows IP ...
37
votes
6answers
5k views

Is a website published in an obscure directory comparably secure to being placed behind a login? [duplicate]

Let's say I create a microsite for a client that contains confidential business information. We need to place this in a location the client can access, in order for them to approve for launch. If we ...
0
votes
2answers
61 views

Is injecting a second Authenticity_Token on a login request considered a security threat?

I'm running a security test on a website. The login request looks like this: POST /sessions HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) ...
0
votes
2answers
116 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
0
votes
0answers
80 views

Social game authentication exploit

We're running a popular social game and we have a security problem that is growing more and more popular these days. We have the following product requirements: There should be no registration to ...
5
votes
4answers
446 views

Bad password policy at my bank

I logged in to my bank tonight and was prompted that all customers were being forced to change their passwords for "security reasons". The policy for new passwords is: 6 to 10 characters, no special ...
1
vote
1answer
115 views

Secure key generation and authentication in PHP

I'm not sure how to phrase this so I'll just explain my scenario and hopefully you can help. I have to create a site that will have 50-100 students all selecting courses they would like to take for ...
0
votes
1answer
62 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H but only if it is authorized to do so. Permissions are stored on server. Technically I could ...
0
votes
1answer
66 views

Tomcat Client authentication

I want to make sure that my webapp is secured: I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed). ...
2
votes
5answers
167 views

Does publishing the md5sum of a private key compromise the private key in any meaningful way?

If I have a 4096 DSA private key used for signing binaries, and I want to ensure that a partner has an identical server using the same private key, can I send the md5sum of the private keys over an ...
0
votes
0answers
41 views

How are the sequence numbers generated in an 802.11 frame?

An 802.11 frame consists of sequence number in it. How are these sequence numbers generated? How random is it? Do these sequence numbers follow any particular pattern for the management frames in the ...
2
votes
1answer
117 views

How safe is Two Factor Authentication (TOTP)?

If someone gets my phone and saves the values my authenticator generates, will that person be able to find out the shared key, which he/she will be able to generate codes himself/herself? If so, how ...
0
votes
1answer
41 views

Would Poly1305-PBKDF2 be secure

I have a Poly1305-implementation (not Poly1305-AES) in my library. The difference: Poly1305-AES uses a key and a nonce and then uses AES to generate a one-time-key from key + nonce. This is ...
4
votes
0answers
78 views

Deal with number changes in a phone number based authentication/login system

Twitter Digits (https://get.fabric.io/digits) provides an authentication/login system based on phone numbers for mobile apps, and several other mobile apps (e.g. Square Cash, ...
-3
votes
2answers
81 views

Is there any benefit to login to a website as anonymously as possible, if you've already been there from an identifiable IP address?

Here's a basic example of the situation I am in: 1.Friend downloads full-length, new release movie on shady internet site (felony). 2.Uploads it to a randomly created, cloud hosting service account ...
6
votes
1answer
92 views

Does iPhone home button act as Secure Attention Key?

On an iPhone, does pressing the home button act as a Secure Attention Sequence? The home button is a physical button. You can press the home button whereever you are and go back to the home screen. ...
2
votes
2answers
161 views

token based authentication attacks

JSON Web Token seems to be a very good tool to authenticate users. But I wonder if an attacker can take the token used by another user and use it for his own attacks. And to be more precise what makes ...
6
votes
3answers
316 views

Is Twitter digits login (sms auth code) insecure?

Twitter released(some time ago) a new kit named Digits which allows the client to login with a phone number and an authorization code (received through sms). I find it great for the user experience ...
1
vote
3answers
90 views

Securing a secondary login page for inputting a multi-factor auth token

I would like to implement the following use case: User lands on the login page User submits login credentials Credentials are validated and they are redirected to another page for inputting the ...
1
vote
2answers
101 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
2
votes
1answer
40 views

Choosing a group of symbols that contains a password

My bank employs a step in its authentication process besides [the card itself and] the regular password, where the user has a secondary password (3 small sequences of letters, such as Hy X Ba) ...
-6
votes
1answer
127 views

How to attack on a web page to gain username and password? [closed]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
3
votes
1answer
71 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
2
votes
1answer
50 views

How to verify installed packages [closed]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
1
vote
0answers
44 views

If I have the cell #. switch ID and name, can I locate an physical address? [closed]

Only a PRO can help me! My husband had an affair, said it was over five years ago and I should not be concerned, ever again. Yet, the result was devastating, medically with cancer. I believe people ...
0
votes
2answers
104 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
9
votes
1answer
601 views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
1
vote
1answer
158 views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
2
votes
1answer
53 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
2
votes
1answer
121 views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...