Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
10
votes
3answers
424 views
Multiple CAs signing a single Cert/CSR?
Just saw this suggested on Slashdot
So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
10
votes
2answers
214 views
“Pulled from public record” security questions
Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
10
votes
1answer
658 views
Is there a standard for printing a public key as a barcode?
Is there a standard for storing a public key printed on paper?
Say, I want to hand out business cards with my public key pre-printed on them
at a key signing party to help build the web of trust.
My ...
9
votes
5answers
865 views
How can I securely authenticate the client application sending me data?
We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
9
votes
2answers
432 views
My bank makes me enter my password using the mouse. What's up with that?
Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
9
votes
2answers
916 views
Secure communication between applications using SSL Certificates
I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the ...
9
votes
4answers
390 views
How should I tell an organisation that they are vulnerable when I wasn't given permission to check?
I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
9
votes
1answer
221 views
Configure SSL Mutual (Two-way) Authentication
A lot of tutorials, a lot of pages, a lot of question and they differ in implementation of this issue "Configure SSL Mutual (Two-way) Authentication". I have to do it with Linux, and I don't know from ...
9
votes
5answers
214 views
I need ideas for blocking a single malevolent user
Let me throw out this problem I'm having to some of my technical peeps and see if you guys have any new suggestions:
We have a website that sends text messages and voice mails for our clients. ...
9
votes
4answers
941 views
What are the disadvantages of single sign-on authentication?
We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication.
Advantages
Users ...
9
votes
2answers
341 views
Security of unencrypted wireless networks with authentication page
Some wireless networks, such as those offered by hotels and hotspots, are not encrypted (they don't require a pass phrase to connect) but have an authentication web page. For example, you connect to ...
9
votes
5answers
519 views
Non-OEM Biometric Software?
Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
8
votes
8answers
869 views
Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?
I don't know why do we authenticate by prompting the user to enter both username and password.
In my mental model, prompting password only suffices.
The reason is as follows:
Assume there are x ...
8
votes
7answers
293 views
Aren't permanantly logged in accounts inherently insecure?
The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
8
votes
5answers
272 views
How to verify new accounts against a known persons database?
I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
8
votes
3answers
1k views
What common products use Public-key cryptography?
I want know what common use products are there that use public key/private key cryptography?
8
votes
3answers
789 views
How does an SSL server prove its identity?
This document says that a challenge response authentication proves the servers identity. But is a man in the middle attack still possible if the client does not verify domain name ? Please help me ...
8
votes
4answers
1k views
How can an access point spoof me into connecting?
I was reading through the answers of the question "How can I ensure that I connect to the right wireless Access Point?" and was wondering how it is possible for an access point to imitate another wifi ...
8
votes
5answers
232 views
How do RSA fingerprints protect from MITM attacks?
I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site.
Like when you do a git push, it ...
8
votes
3answers
1k views
Any flaws in this security model for a REST web service?
I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
8
votes
6answers
4k views
One Time Passwords. Using OTP at Windows, Ubuntu and internet sites
my question is this:
Is there a way (software,hardware/token or web-ware) to use One Time Passwords in the following scenarios:
Logon to my pc/laptop (windows or ubuntu)
Logon to sites with OTP ...
8
votes
2answers
307 views
BCrypt's 72-character limit and using it as a general digest algorithm
Goal: have token/cookie-based authentication that doesn't require keeping sessions on the server
TL;DR: What, if any, is the accepted mechanism to work around the 72-character limitation of BCrypt?
...
8
votes
4answers
496 views
Is there any reason to show the same message for invalid username as password?
I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
8
votes
4answers
347 views
Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?
This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
8
votes
1answer
320 views
How secure is Windows 8 email authentication?
I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email ...
8
votes
3answers
348 views
Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?
It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
8
votes
1answer
523 views
What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?
I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...
8
votes
2answers
514 views
Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email
Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance
MSFT even went to far as create ADMINSDUser rights to put ...
8
votes
1answer
224 views
What shell binary should I use for the root account on a Linux system?
Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
8
votes
1answer
272 views
When authenticating ciphertexts, what should be HMACed?
Some have argued for using AES-256-CTR with HMAC-SHA-256 for authenticated encryption over AEAD-specific modes like EAX and GCM.
However, when doing, this, what should be HMAC'd? And how? ...
8
votes
3answers
268 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
8
votes
2answers
723 views
Keeping user session alive - security considerations
We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
8
votes
5answers
244 views
How to support secure creation of a user account over an external API via a queued job?
So this question is delving into security and encryption and the problem potentially hasn't been encountered by many. Answers may be theoretical. Let me outline the scenario...
A website frontend is ...
7
votes
4answers
824 views
Why does getting a password wrong takes more time than not
I type my password to login to Win or Linux.
Case 1: I get it right. Almost instant reaction.
Case 2: I misspelled it. It takes a while, and then rebounds.
Why does it takes longer to identify a ...
7
votes
6answers
1k views
Is denying login after incorrect attempts ineffective?
Generally denying logon attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicous logon attempts.
Yet, surely doing this is ...
7
votes
5answers
2k views
Email forgotten password or send reset link, both just as insecure?
I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
7
votes
8answers
580 views
Is the following authentication scheme secure?
I was trying to design an authentication system that would make it much harder to guess a password via brute force, and reduce the risk to a user if the hashed password was stolen through a snooping ...
7
votes
2answers
338 views
Why do some online banking sites (and others who desire secure login pages) sometimes add autocomplete=“off” on their login page input fields?
For example: http://www.natwest.com/x-user.ashx?redirect=trusteer.interstitial.url&condition=trusteer.enabled2%3Dtrue
<input name="...." type="text" maxlength="10" ...
7
votes
4answers
561 views
How to protect ftp account information in the source code of a program
I wrote a game which stores high score information on an ftp server.
In the the source code I need to write out the ftp link with the account name and password in it.
For example:
url = new ...
7
votes
4answers
400 views
Is using a flash drive as a base for security a safe thing to do?
I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
7
votes
2answers
1k views
Why does HTTP Basic authentication encode the username and password with base64?
RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64.
To receive authorization, the client sends the userid and password,
separated by a ...
7
votes
4answers
1k views
Is Facebook Connect or Twitter OAuth PCI Compliant?
We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter.
Obviously this wouldn't be secure if we were trusting just any old ...
7
votes
3answers
287 views
zero knowledge proof and its protocol
In Zero-Knowledge Proof where we take the analogy of Peggy (Prover) and Victor (Verifier):
In this story, Peggy has uncovered the secret word used to open a magic door in a cave. The cave is ...
7
votes
2answers
354 views
Is a rand from glibc's rand secure for a login key?
Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
7
votes
2answers
338 views
How does external authentication work?
For example, I can log in to stackexchange websites by logging in to external websites such as OpenID, Yahoo, etc. How does this work? How do the websites (SE and Yahoo!, for example) communicate? How ...
7
votes
4answers
216 views
Candidate authentication in large scale assessment
First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes.
We're ...
7
votes
5answers
353 views
Should a user have the ability to be logged in from multiple locations at the same time?
In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time.
What are the security ...
7
votes
2answers
323 views
Should user be allowed to save password in browser?
The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
7
votes
1answer
394 views
What possible use does an iFrame have for security?
I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password.
But just before the end </table> tag there's a blank iFrame which ...
