Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
0answers
43 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...
0
votes
2answers
120 views

When I reset my password for my Microsoft account, how do they know what password I've used before?

Assumption used: all password that I've used have been salted with some random elements before hashed and stored somewhere in their database. If my previous password exists only as salted-hashes in ...
5
votes
1answer
622 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
1
vote
1answer
133 views

HMAC secret key client storage

I've read numerous articles about using HMAC and the secret key for client authentication in a RESTful client (Javascript) application today. Still, I don't find a single source that is able to ...
0
votes
0answers
32 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
0
votes
2answers
114 views

Is it safe to rely on text messages as a means on authentication?

Many websites, including banks, use text messages as their primary or secondary means of authentication. In theory, it sounds like a perfect method unless the user loses their phone or has it infected ...
5
votes
3answers
225 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
1
vote
1answer
62 views

Are there other ways for a CA to have their certificates included in a browser?

From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser. What if the root certificate of a particular CA is not included in the web ...
0
votes
1answer
63 views

Secure end-to-end when part of conversation must be over HTTP

We have a situation where a user's identity can be verified as follows: the network provider knows the identity of the user and injects secure headers into the HTTP request, which our servers can use ...
-1
votes
1answer
72 views

Prevent someone to login to my website from teamviewer

I have my own suspicions that there are blocked users of my website that use Teamviewer to login to my site from their friends' pc. Is there any way to identify if the one who visit a website is using ...
0
votes
0answers
28 views

Best practices concerning pushing user registrations

Imagine an organization which possesses a lot of personal customer data in their internal databases. This organization creates a web application, and wishes to be able to send a registration link to ...
3
votes
4answers
185 views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
38
votes
2answers
4k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
0
votes
2answers
79 views

RSA for authentication?

Is it possible to use RSA public and private keys to authenticate two computers (or to make sure they're both the right computers)? If so, how? Thanks!
2
votes
1answer
73 views

Does using token-based auth make CSRF checks on login unnecessary?

Based on my understanding, avoiding the use of cookies as an authentication mechanism prevents CSRF vulnerabilities entirely (namely token based authentication in an SPA), when authenticated. Does ...
1
vote
1answer
57 views

How do I migrate users with shared email addresses to an email-based forgotten password process?

I'm migrating users from custom application-level authentication security (built into the app, using username as the unique identifier) to security as a service (using ThinkTecture's Identity Server ...
1
vote
2answers
77 views

Authenticated sessions and Man in the middle

I see a lot of websites (including Stackoverflow) using this authentication mechanism: Client authenticates under HTTPS and gets back a session id. Client drops back to HTTP and accesses secure ...
33
votes
11answers
5k views

Sending passwords to someone remotely

As someone who usually works with people in other countries it has always been a problem to send login information to each-other. For development login details like debug databases etc sure I can ...
0
votes
3answers
139 views

failed Login attempts logic

I want to add security to the system login. So here's my idea: If a user tries to login with a valid username but invalid password, then count it as a failed login attempt and store it in the users ...
0
votes
2answers
287 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
1
vote
1answer
53 views

what are security flaws on providing access to users through a unlisted/private/token/signed URL?

Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which ...
3
votes
3answers
195 views

PHP IP check as security?

Would just like some input on a PHP script I'm writing. It's just a simple script that only myself should be able to access. I don't have a dynamic IP address, so this isn't an issue for me, but I'm ...
2
votes
0answers
107 views

Why is AWS phasing out public/private key authentication? [closed]

I'm working on the authentication strategy for my app (again). My current strategy is a clone of the AWS strategy of issuing public and private keys and using them to sign requests sent to my API. My ...
6
votes
4answers
404 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
0
votes
1answer
56 views

Using encrypted data in session key instead of random

I am writing a service-oriented (REST) application that is (nearly) totally stateless: it can authenticate by API keys, but for web UI it uses the session where it stores nothing but an authenticated ...
1
vote
1answer
89 views

Challenge-response login without storing a password equivalent

A problem with many challenge-response login systems is that the server has to store a password equivalent. For example, if the server stores SHA1(salt + password), and an attacker captures that hash, ...
-1
votes
3answers
52 views

How would authentication when depositing, and withdrawing money from a fund, differ?

I have to do a presentation on developing an authentication plan for a financial services application used to manage an investment portfolio. I have to develop use scenarios for the 2 functions ...
4
votes
1answer
150 views

Is it a security risk for users not to logout of a website?

Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause ...
0
votes
2answers
73 views

Creating port-specific SSH authentication for the same user

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...
1
vote
4answers
236 views

Log in with email is more secure than a username?

Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
1
vote
2answers
333 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
0
votes
2answers
130 views

Determining the accuracy of a biometric system

How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?
0
votes
3answers
48 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
1
vote
3answers
58 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
2
votes
2answers
54 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
2answers
112 views

What's the meaning of the term “ad-hoc MAC” (Message Authentication Code)?

In SSL literature, I've noticed the use of the term "ad-hoc MAC". I understand the meaning of MAC (Message Authentication Code) and how it works, but what does the term Ad-hoc MAC mean? Note: With ...
0
votes
1answer
82 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
2
votes
1answer
115 views

SAML and OpenID, centralized and decentralized

I'm learning SAML, which is said to be centralized. To understand the difference with decentralized, I'm reading about OpenID. I find it difficult to understand the difference between the two, ...
7
votes
1answer
265 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
2
votes
5answers
324 views

What is the most credible timestamp I can create for a digital file?

Is it possible to create a timestamp that is so hard to fake, that it could be used as proof or simply strong evidence in a court of law, that something was not created after a certain point in time? ...
2
votes
4answers
276 views

how secure is rsa encryption for a web login without https?

I have a server running rstudio. This is basically a web application, and it is currently only accessible over the local network. The web app takes your Linux username/password in order to log you ...
0
votes
2answers
60 views

Is it safe to use a ECDSA public key as a password seed for GCM/AES?

Two peers already exchanged their ECDSA (curve secp256k1) public keys using a secure channel. They want to establish an authenticated encrypted channel between them. They will use CCM mode and with ...
1
vote
2answers
118 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
7
votes
3answers
400 views
+50

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
2
votes
1answer
185 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
1
vote
1answer
105 views

Securing Javascript plugin

My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on ...
0
votes
2answers
62 views

Can session data be manipulated without access to source code

When implementing a web-based application, how secure are any session variables against manual manipulation beyond the scope of my code? i.e. when a user is authenticated, if I were to initialise a ...
0
votes
1answer
78 views

What is a AUTH-KEY in the security of the computers?

I don't know if this is the right section to post my question and if it is not I apologize. I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL ...
1
vote
1answer
111 views

SSL Handshake random number?

I realized all of the phase of the handshake but I do not understand how it does that from the two randomly generated numbers are unable to generate a session key that the client and the server uses ...
1
vote
1answer
84 views

Amazon Turk - How secure is it? Strange behavior

I just had this really strange experience with Amazon Turk, where suddenly I was logged into someone else's account. I was logged into the company's Turk account, left my computer for a while, ...