Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
0answers
973 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
1
vote
0answers
235 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
1answer
927 views

SSO via HMAC and shared key. Can this be improved?

Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic: A.com and B.com both share key S. ...
1
vote
1answer
177 views

Is authentication through proxy sites safer?

usually in office or wherever whenever we are blocked with gmail and facebook websites,we used to browse the site with the proxy sites,we used to pass our login data through proxy sites,my question is ...
1
vote
1answer
62 views

If a site says its API for login can't be made available for “Security Reasons” should I be worried

Stack Exchange API 2.2 is finally out, (Yay!) Reading through the linked blog post, i notice the line: Login methods that don’t use OAuth can’t be made public for security reasons. Is this ...
14
votes
2answers
3k views

How does Windows 8's Microsoft Account authentication work?

One of the new features to Windows 8 is the ability to log in to your PC using your credentials from a Microsoft Account. How is this implemented, and what steps are taken to prevent hijacking of ...
1
vote
0answers
106 views

how to implement 4-legged authentication for mobile application?

I have a REST web service which already implements oauth authentication mechanism via browser. I would to expose my API to a number of mobile clients programmed by third parties. In this scenario 4 ...
0
votes
1answer
1k views

Hash the signing key of an authentication token in database

I have clients which are all browsers. All clients render just a single page application getting data from a Web API. The design of the API follows REST principles. I use token-based authentication ...
0
votes
1answer
153 views

Performance of biometric authentication on cell phones as of 2014?

How well do the various biometric authentication methods currently perform in regards to precision and recall? Can anyone cite a relevant research article?
0
votes
1answer
700 views

Ensuring security in Token url authentication

I am trying to make provision for resetting password if the user forgets his password. What I did is make a html page(say email.html) where the user will enter his email address. When the user submits ...
3
votes
1answer
310 views

What are industry-standard recommended practices to protect user information in an Android app?

I am developing an Android app that will potentially handle sensitive user data, and some of it may be even considered medical data (for example user height, weight, alergies, etc). What would be the ...
1
vote
3answers
214 views

Privacy-preserving authentication with unique user identification for Web applications

Is it feasible to authenticate users such that they should be prevented from creating multiple accounts, and that their privacy is not impaired (i.e., no personal information should be revealed to the ...
1
vote
5answers
693 views

VPN Authentication over WiFi — Is it secure?

Count this question as part of my ignorance on how authentication scheme is done on your typical VPN session. But here goes: We often advise the security-conscious user that if one must use an ...
1
vote
1answer
151 views

Protecting data on an embedded device

I am to release a system-on-chip device that, during its lifetime, will come to store sensitive data. I want to make that data hard to extract or duplicate. Encrypting is good for dealing with MiTM, ...
2
votes
2answers
255 views

Website doesn’t always log me out – Privacy concern or am I overreacting?

I’ve been applying to for some jobs and use one certain careers page somewhat regularly. I’ve started to notice that I don’t always get logged out even if I do click “log out” and see a message that ...
2
votes
3answers
554 views

Can authentication in social networks through VPN defeat the purpose of the latter?

If a person uses VPN and authenticates herself to some social network through the VPN, doesn't she lose her anonymity for as long as the VPN session is used ? By losing her anonymity, I mean that her ...
0
votes
2answers
116 views

Email rejected by the server [closed]

Emails from site such as Gmail and Yahoo are rejected from secureserver.net server and treated as a spam. Can you help me?
16
votes
4answers
1k views

Does two-factor authentication reduce the need for a long password?

I've recently enabled 2-factor auth on a number of web apps, mostly using Google Authenticator. Does this mean that the importance of a strong password on each site is reduced? I would prefer to use ...
25
votes
3answers
2k views

Is authentication using personal pictures more secure than passwords?

Statement 1 There is a start up called PixelPin. On the web site it reads: The PixelPin solution is simple and quick to use, yet very secure. PixelPin eliminates the traditional alphanumeric ...
2
votes
2answers
751 views

Ways to authenticate client with a server

I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to ...
1
vote
1answer
85 views

Is it possible to use AH in transport mode on an IPSec channel with mediation?

I understand that it's not possible to have Autentication Header with a regular NAT, because it messes with the IP header protected by AH. How about proxies? Do they change anything in the packet? ...
0
votes
1answer
358 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...
1
vote
2answers
108 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
23
votes
4answers
12k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
4
votes
2answers
414 views

Is authorisation with token secure?

I have a general security question: Let's say there is a client-server application with authorisation by login and password using a secure connection between server and client (https). User can have ...
0
votes
2answers
3k views

Attack on old OpenSSL/Debian vulnerability doesn't work on a vulnerable box

DISCLAIMER: The vulnerable box that we are testing on belongs to us, and all the actions are under surveilence, hence we are not doing anything illegal here. I'm testing a Ubuntu 8.04 box, it's known ...
3
votes
4answers
463 views

Why is it dangerous to stay logged in as root for an extended period of time?

I found the following general advice from WikiHow in an article on changing password: It is very dangerous to stay logged in as root for an extended period of time. Log out immediately after ...
1
vote
4answers
297 views

search CA for someone's public key

do CAs offer service wherein an application can request someone's public key? i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated): ...
6
votes
4answers
573 views

Why change password? [duplicate]

Why are there recommendations to change passwords with certain intervals? If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
0
votes
1answer
628 views

Advantage Mutual authentication over PSK [duplicate]

I have a client - server setup with TLS communication. I want to be sure of mutual authentication. The safety that certificates can offer assumes that the private key that links to the certificate ...
5
votes
1answer
1k views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...
1
vote
3answers
180 views

Can I trust profile data a 3rd party auth provider send to me?

This question may be related to this one, but I think we need to be sure. My website implement login via OpenID (or Google, or Facebook, etc.). On my website, authorization is based on user email ...
14
votes
5answers
1k views

Safe way to authenticate (multi-factor authentication?) while being monitored?

(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.) ...
9
votes
6answers
1k views

Is there multi-factor authentication for machines?

Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
0
votes
1answer
441 views

Prevention of netcutter use in the College LAN

I am a student,residing in a hostel,accessing internet,using College LAN,which is protected by Cyberoam Corporate Client authentication,and the bandwidth is equally distributed to all students but a ...
8
votes
2answers
6k views

How reliable are device IDs provided by PhoneGap on Android and iOS?

I have a web application that allows users to add mobile devices to their accounts (using mobile app). Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
27
votes
8answers
3k views

Share certain information only after death

After your death, you want to make sure that a special someone gets a vital piece of information (like the password to your bank account), but: You don't want anyone else to be able to get that ...
2
votes
2answers
382 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
1
vote
1answer
286 views

What info to log/store about a user login?

Currently I am saving LastLoginAt, LastActionAt, LastLogoutAt, and LastLoginFromIPAddress. I am not so sure about the value of logging/saving details of logouts and IP addresses, as I am not sure of ...
3
votes
2answers
337 views

BOTs C&C channels

Can someone please explain the C&C for bots ? im reading a paper about Android bot , and its explaining something called URL flux as method of C&C . however i couldn't really get it , so ...
5
votes
2answers
655 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
10
votes
2answers
6k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
3
votes
2answers
530 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
38
votes
6answers
2k views

Is the concept of Authenticated Anonymity possible?

Or is authentication essentially incompatible with anonymity? If we have the idea that authentication is proving that someone is who they say they are and anonymity is essentially having an unknown ...
32
votes
2answers
4k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
3
votes
1answer
1k views

Sharing login session from one website to another?

Given two companies managing two separate websites, the client wants the user to be able to log in to one website, and then click a link to navigate to a certain part of the second website. The client ...
3
votes
1answer
133 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
0
votes
1answer
150 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
2
votes
1answer
164 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
2
votes
2answers
2k views

How to write a rock solid TOTP implementation?

I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered? After reading the ...