Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
33 views

Why is calculating the checksum of an IP Datagram header and then encrypting it not appropriate to provide Data Origin Authentication?

So assuming Alice and Bob have agreed to use a particular symmetric cryptosystem and share an appropriate key, they want to achieve data origin authentication by computing the header checksum of an IP ...
6
votes
2answers
142 views

OAuth2 and Authentication

I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points : What is the difference ...
-2
votes
1answer
83 views

Public key encryption for initial challenge-repsonse

I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
0
votes
0answers
19 views

Cyrus-Imap (v2.3.16) local logon attack

CentOS-6.7 Cyrus-IMAP-2.3.16 The host inet07.hamilton.harte-lyne.ca is our IMAP server host. It offers imap and pop3 publicly. I uses local accounts (/etc/passwd) for imap/pop3 authentication ...
1
vote
0answers
27 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
2
votes
1answer
68 views

How to get around hard coding a PFX password

I've got an application that acts as a SSL server. I've got the pfx file and in code, I've had to hard code the password to use in the following way PKCS12_parse(p12, PFXPassword, &pkey, ...
1
vote
1answer
44 views

What is the drawback of allowing multiple accounts on a single email?

I run a website where users authenticate using email and password. Some users would like to have two or three accounts using the same email address. I see the use case in their situation, and am ...
6
votes
3answers
192 views

Authenticating a user via SMS

I'm involved in a project that's building a chat-bot that users can communicate with via SMS from their mobile phones. We'd like the users to be able to use the bot to do some basic account-management ...
2
votes
1answer
50 views

Is installation id secure enough to authenticate device's user against a Web Service API?

...or interactively asking for password / or having some certificate is inevitable? Context My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my ...
2
votes
1answer
91 views

How to protect my server from continous login attempts (Ubuntu)

This is the log of my server: Mar 25 16:49:51 f4arelay sshd[10831]: input_userauth_request: invalid user git [preauth] Mar 25 16:49:51 f4arelay sshd[10831]: pam_unix(sshd:auth): check pass; user ...
1
vote
3answers
80 views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
3
votes
1answer
61 views

Increased security from separating username and login name?

I seen this question: Does username length/complexity positively impact security? which got me thinking about usernames/passwords from a developer-aspect. If a developer for an application were to ...
3
votes
3answers
177 views

Mitigating Login CSRF on 3rd party websites

I'm working on a project that requires to have a signup/login functionality exposed to partners who manage their own website. For some of these websites they reuse our own backend, and just change the ...
26
votes
7answers
4k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries ...
4
votes
2answers
210 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
0
votes
0answers
138 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data ...
3
votes
2answers
178 views

Should ability to access login page after authentication be considered a security flaw?

On one of the recent engagements, I bumped into something I have not seen before: after successful authentication attempt the user still can access the login web page and login as another user. It ...
1
vote
1answer
26 views

Network authentication using router firmware scripting [closed]

To connect to internet in our institute, you need to login with your credentials on a page and then approve the IP address for proxy less usage. On a router, if one device authenticates, all the other ...
0
votes
1answer
171 views

Authorization on complex ownership

I have problem with object ownership in my web application. In my web application. There are object types: 1. Faculty 2. Student 3. Student Group 4. Student Lesson The following user roles are ...
1
vote
0answers
162 views

Check if user is logged in on other ADFS authenticated site

I've been looking around for this specific situation, but so far no good.. We have multiple websites that use ADFS WSFederation, and we would like for a user to always pass through one, before being ...
3
votes
1answer
177 views

How to get TOTP password with hmac sha 512 as hashing function?

ive never learned about javascript and network security before, but lately ive taken on some programming challange but i have to send my project link via http post request, and i have to figure the ...
15
votes
6answers
2k views

What's the point of the CA?

So a Certificate Authority certifies that a website corresponds to a given organization. Why is this necessary? When I interact with a business or organization, I do it one of a couple ways: I ...
3
votes
3answers
342 views

Is this authentication and encryption solution secure?

I need to communicate over insecure TCP sockets where SSL/TLS is not available. Does the following solution provide a secure means of authentication and encryption? - Client sends: username Server ...
4
votes
1answer
126 views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
3
votes
1answer
46 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
1
vote
1answer
26 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
1
vote
1answer
48 views

What are the advantages of a ZKP authentication system?

So, I read somewhere that Zero Knowledge Proof based authentication is good because it makes sure that the server does not store your password and neither is your password being transmitted over the ...
1
vote
2answers
90 views

Can You Prove a Chat Happened Online? [closed]

With so much communication happening online nowadays the needs to verify information is obviously an essential. However, let's say something was said in an online chat room/or private chat client, ...
3
votes
1answer
67 views

How can I enforce that an SSH private key has a passphrase?

My company is serious about security and willing to move to SSH key-pairs. Users can generate their SSH key pairs independently and I worry if they set a pass-phrase. Can I enforce this? Does signing ...
-2
votes
1answer
100 views

How does Windows 7 login work? [closed]

Maybe the question can be considered ambiguous, so: how does Windows 7 work for its login authentication? What are the involved processes and what do they do?
1
vote
1answer
47 views

Trying to build an open authentication controled authorization website for multiple domain users

I'm not sure that this is possible but I figure at worst, I'll be told you cannot do that. Our organization has a report server that sits in a DMZ accessible by multiple units that have their own ...
0
votes
0answers
21 views

HAWK authentication vs. API tokens (shared secret)

I regularly find myself designing HTTP-APIs. My goto solution for authentication / network security is forcing HTTPS and using HAWK since it seems to be the only open standard for that. When I look ...
6
votes
1answer
128 views

How does Google store passwords for remote IMAP/POP services?

It is possible to add non-Google accounts to Gmail and retrieve their mail messages via POP or IMAP. As part of the setup process, one has to provide the login username and password for these ...
6
votes
1answer
177 views

When I register on a website, is there a way to know whether or not the site admin will be able to see my password? [duplicate]

It seems to me that whenever I register on a website, there is absolutely no guarantee that the administrator will not be able to decrypt and view my password (if they even bother encrypting my ...
1
vote
1answer
41 views

Mutual SSL - Using Public CA for Client Auth CSR signing

I have been reading a lot of articles regarding Mutual SSL, Two-Way Authentication or Client Authentication and I have a general enquiry which may have been answered in content that I've read but if ...
3
votes
1answer
66 views

What are the security implications of having a dummy user account representing unauthenticated users?

In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
1
vote
1answer
83 views

How specifically should I implement CSRF protection?

There are a ton of articles explaining what CSRF is and that I should use a CSRF token to prevent CSRF. A few of them mention details such as using SHA256 over MD5. However, none of them explain how ...
2
votes
1answer
91 views

How does MailChimp authenticate emails?

Keeping it short, MailChimp states that: Authentication Should Be Simple Email authentication is useless if it's too hard to implement. Many email service providers require server setup in ...
2
votes
1answer
116 views

Why refresh tokens are used

Reading about JWT I see it is common practice to include a refresh token along with the short lived token. So commonly it seems you have a short lived token which lasts for a short time such as 15 ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
3
votes
1answer
87 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
5
votes
2answers
149 views

Best practices for automatic login URL's?

An automatic login URL is a mechanism whereby an existing but logged out user of your website or application can click a link with a random token and be automatically recognized and logged-in to your ...
5
votes
1answer
54 views

Use OpenId Connect for authentication only

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it ...
0
votes
1answer
50 views

I can't connect to OSSIM server [closed]

I installed OSSIM in VMware workstation.The installation was successful.But when I entered the login and the password I have this message " incorrect login" I know that la login must be "root". ...
3
votes
1answer
80 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
0
votes
2answers
32 views

Bookmark UUID Link

I noticed the following site: nightchamber.com A user account is automatically generated on first visit and keyed against a uuid, the id is then stuffed into the session and used to make a link the ...
5
votes
2answers
284 views

Website login using database credentials

Is it secure to login to a website by using database usernames, for each user? Is it a bad practice? What can be the issues? The idea is to create the users and permissions at database level. EDIT: ...
1
vote
2answers
39 views

Client verification with PKCS#7

When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there ...
3
votes
1answer
58 views

2 Step login: Memorable word reset via Email OR Security Questions?

Background We have a system in place which requires employees to login using a 2 step verification process ( password & Username) + (a defined number of characters from a chosen Memorable word). ...