Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
70 views

Why not use client certificates for premaster key generation

The question is about a very specific SSL handshake scenario. I understand that some servers may request client certificates in order to authenticate connecting clients. However, as far as I can ...
14
votes
2answers
606 views

How does Windows 8's Microsoft Account authentication work?

One of the new features to Windows 8 is the ability to log in to your PC using your credentials from a Microsoft Account. How is this implemented, and what steps are taken to prevent hijacking of ...
1
vote
2answers
161 views

Extracting Facebook ID or E-Mail from Browser History

While i was looking at my browser history i noticed there has been a facebook login from my computer, there are some facebook related messaging and profile links in my browser history (chrome). The ...
14
votes
4answers
382 views

Does two-factor authentication reduce the need for a long password?

I've recently enabled 2-factor auth on a number of web apps, mostly using Google Authenticator. Does this mean that the importance of a strong password on each site is reduced? I would prefer to use ...
2
votes
1answer
66 views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
2
votes
2answers
214 views

Should login pages be cacheable?

I'm considering the relative benefits/disadvantages of making a login page cacheable. Note that here I'm referring to the page containing the form into which the user enters their username and ...
2
votes
2answers
114 views

Ways to authenticate client with a server

I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to ...
1
vote
1answer
34 views

Is it possible to use AH in transport mode on an IPSec channel with mediation?

I understand that it's not possible to have Autentication Header with a regular NAT, because it messes with the IP header protected by AH. How about proxies? Do they change anything in the packet? ...
0
votes
1answer
91 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...
4
votes
4answers
389 views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
4
votes
2answers
142 views

Is authorisation with token secure?

I have a general security question: Let's say there is a client-server application with authorisation by login and password using a secure connection between server and client (https). User can have ...
2
votes
4answers
187 views

Why is it dangerous to stay logged in as root for an extended period of time?

I found the following general advice from WikiHow in an article on changing password: It is very dangerous to stay logged in as root for an extended period of time. Log out immediately after ...
0
votes
2answers
379 views

Attack on old OpenSSL/Debian vulnerability doesn't work on a vulnerable box

DISCLAIMER: The vulnerable box that we are testing on belongs to us, and all the actions are under surveilence, hence we are not doing anything illegal here. I'm testing a Ubuntu 8.04 box, it's known ...
4
votes
4answers
193 views

Why change password? [duplicate]

Why are there recommendations to change passwords with certain intervals? If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
0
votes
1answer
63 views

Advantage Mutual authentication over PSK [duplicate]

I have a client - server setup with TLS communication. I want to be sure of mutual authentication. The safety that certificates can offer assumes that the private key that links to the certificate ...
2
votes
1answer
71 views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...
1
vote
4answers
121 views

search CA for someone's public key

do CAs offer service wherein an application can request someone's public key? i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated): ...
0
votes
3answers
77 views

Can I trust profile data a 3rd party auth provider send to me?

This question may be related to this one, but I think we need to be sure. My website implement login via OpenID (or Google, or Facebook, etc.). On my website, authorization is based on user email ...
0
votes
1answer
113 views

Prevention of netcutter use in the College LAN

I am a student,residing in a hostel,accessing internet,using College LAN,which is protected by Cyberoam Corporate Client authentication,and the bandwidth is equally distributed to all students but a ...
0
votes
1answer
33 views

Multiple login roles over a group role, or 1 login/group role that checks the auth of user? [on hold]

What would be more prefered, for a user based website: 1) A Group role the defines, how new login roles will behave and create a login role for each new user? 2) A group role with one login role that ...
1
vote
0answers
39 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
0
votes
1answer
52 views

What info to log/store about a user login?

Currently I am saving LastLoginAt, LastActionAt, LastLogoutAt, and LastLoginFromIPAddress. I am not so sure about the value of logging/saving details of logouts and IP addresses, as I am not sure of ...
1
vote
2answers
87 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
0
votes
1answer
111 views

Performance of biometric authentication on cell phones as of 2014?

How well do the various biometric authentication methods currently perform in regards to precision and recall? Can anyone cite a relevant research article?
1
vote
3answers
102 views

Privacy-preserving authentication with unique user identification for Web applications

Is it feasible to authenticate users such that they should be prevented from creating multiple accounts, and that their privacy is not impaired (i.e., no personal information should be revealed to the ...
1
vote
1answer
127 views

Sharing login session from one website to another?

Given two companies managing two separate websites, the client wants the user to be able to log in to one website, and then click a link to navigate to a certain part of the second website. The client ...
0
votes
1answer
54 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
8
votes
3answers
480 views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
2
votes
1answer
122 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
1
vote
2answers
235 views

How to write a rock solid TOTP implementation?

I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered? After reading the ...
1
vote
1answer
677 views

Why is a CA certificate required for EAP-TLS clients?

When setting up clients with WPA2 EAP-TLS, most clients (ie: my phone, my computer) require both a client public/private keypair (for obvious reasons) and a certificate authority certificate. It's ...
1
vote
2answers
429 views

Website login protection with chrome extension

Right so I'm developing very private systems recently, and I'm looking into admin login protection. I'm a PHP dev with essential knowledge of js/jq. While I handled most of the stuff so far, I'm ...
34
votes
6answers
1k views

Is the concept of Authenticated Anonymity possible?

Or is authentication essentially incompatible with anonymity? If we have the idea that authentication is proving that someone is who they say they are and anonymity is essentially having an unknown ...
0
votes
2answers
487 views

How does Authy works?

I think I knew how does two-factor authentication works. I enter the password. Server generate random number and send me it me by sms. I enter this number. Server check number I entered with ...
2
votes
5answers
251 views

Is asymmetric encryption vulnerable to man-in-the-middle attacks?

I'm looking for ways to send private messages over a public channel, and in doing this I stumbled in asymmetric encryption, which is just perfect for what I was looking for at first - A and B ...
9
votes
7answers
424 views

Authencity of information displayed on an untrusted device

Suppose I have a (bluetooth/usb) device which needs to displays information on an external pc/phone. Is there a simple and effective method to garantuee that the information displayed hasn't been ...
2
votes
1answer
75 views

Does it make sense to use two factor authentication with password protected wp-admin folder?

I've finished building my wordpress website and now, I'm concerned about the security of the website. To improve security, I'm using Google two factor authentication plugin while also ...
0
votes
2answers
347 views

Look over my Web API Authentication Scheme

I want some advice on my Authorization/Authentication scheme that I will be using for my Web API that I am writing. Firstly the Authentication : 1) When a user first logs in and they are authorized, ...
0
votes
2answers
96 views

Do I need to password protect [web] services that are only accessible internally?

I have transmission-daemon setup with RPC enabled using a whitelist. The whitelist contains only 127.0.0.1 and my virtual private network range of IP addresses. I connect most of my devices through an ...
2
votes
2answers
117 views

How bad is exposing valid user names?

Today like many other times in the past, signed for a new service and got a common error message: Your user name or password is invalid This time I am wondering how useful it is to notify ...
3
votes
1answer
106 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
7
votes
2answers
270 views

What's wrong with this authentication system?

I'm a software developer with an interest in and basic level of knowledge about security. I've come across an authentication system that "smells bad" to me however I lack the expertise to know what if ...
0
votes
2answers
182 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
3
votes
2answers
539 views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...
4
votes
1answer
157 views

'Remember Me' combined with Auth Token

I've developed a client application which talks over a REST API to a server. The way the application works is to send the username/pwd pair in the initial login to the server and then respond with an ...
1
vote
1answer
75 views

When is it appropriate to challenge with a secret word?

Lets say a secret word is say, the name of your first pet. Mother's maiden name is also a common one. When does it make sense to challenge the user with this? Or, what actions should be secured by a ...
0
votes
2answers
57 views

Challenges in authentications

I have a case where I have a set of low compute capable processors connected to a gateway processor. I need a way of authenticating these processors to gateway processor. The main things are: I need ...
3
votes
3answers
253 views

Does Google/Dropbox/Github Two-Step Verification count as Two-Factor?

This considers the route where somebody does not use the SMS option, but rather using TOTP, and the site offers a generated seed to input. Two factors questionably at use: password: something KNOWN ...
3
votes
3answers
116 views

How to make authenticity of text verifiable without third party services?

There is a person who wants to establish a system which allows her/him to publish texts anywhere and make it verifiable that s/he is the true origin of that text. Only the first message is not ...
0
votes
3answers
113 views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in, a year ago we used to close the shop and arm the alarm using a key fob this means the worst case scenario was that I get ...