Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
3answers
890 views

Establish a secure channel with mutual authentication given pre-shared public keys

Suppose I have a system whereby parties are identified by their public key (with some pre-selected asymmetric key algorithm). Suppose I have a party PUB1 which wants to establish a secure channel with ...
1
vote
1answer
540 views

What user was this spammer trying to authenticate as?

I have a custom application that monitors and logs a user's SMTP session, and came across this spammer trying to use my MTA as a relay. Is it possible to determine what username they are trying to ...
5
votes
3answers
2k views

Delivery Failure Notification spam protection?

My domain (example.com) has recently been targeted by spammers who are sending email (somewhere) but forging the sender as random-name@example.com. I have been getting flooded by delivery failure ...
1
vote
1answer
404 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
1
vote
1answer
103 views

How to detect suspicious tokens collected by a hacker

I previously asked a question here What's the use of adding a challenge in the otp algorithm? Let's suppose that a hacker has succeeded to collect tokens. Is there a way to detect suspicious ...
19
votes
9answers
987 views

What's a good way to trigger a hidden 'distress signal' in instant messaging?

Here's the scenario: Alice and bob use Off-the-record messaging to communicate over IM. The have: Encryption Authentication Deniability Perfect forward secrecy They communicate after ...
1
vote
3answers
297 views

Mass account lockout prevention using CSRF tokens

I'm currently working on reducing the risk of mass account lockout on a site that (unfortunately) issues sequential, numeric user IDs. Changing the structure of the userID is not an option at this ...
22
votes
1answer
5k views

Is there a standard for printing a public key as a barcode?

Is there a standard for storing a public key printed on paper? Say, I want to hand out business cards with my public key pre-printed on them at a key signing party to help build the web of trust. My ...
7
votes
4answers
1k views

Password hashes should run md5 thousands of time: really?

I skimmed through How Companies Can Beef Up Password Security and I thought that several assertions were completely wrong, in particular: Cryptographic hash (like md5) with salt are bad. It isn't ...
1
vote
3answers
617 views

Login System Security Suggestions

I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup: nonce to check if the login originated from our login form session and cookie auth mixed - in ...
2
votes
2answers
97 views

Are there any nice info sites dedicated to explaining how and why to (not) store user passwords in the database?

I keep finding various websites that are able to email me back my password. I try to email them every time, telling them about this. But it can be tricky to be taken seriously - it's just a random ...
3
votes
1answer
407 views

Implementation of Blizzard's Mobile Authenticator

How is the Blizzard Mobile Authenticator implemented? Does it happen to use OATH-TOTP or something similar?
1
vote
2answers
136 views

How do i use a guessable ID for authentication

This question doesn't fit well in many categories but hopefully someone's run into it before. I'm developing a web api that will interact with a physical device. Each new physical device has it's ...
1
vote
1answer
1k views

Google custom Search Engine api key: is it confidential?

Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to ...
1
vote
4answers
66 views

When (if ever) should web app force numerical, generated (hence hard to remember) logins?

Some bank sites force me to use system generated numerical login (ie. 8 digit number). Apart from singnificantly decreasing usability and giving impression of security (to some), does it serve any ...
1
vote
2answers
94 views

How are 2 Open IDs linked on StackExchange?

I have an account with Google & Facebook. Login IDs for them both are same (same gmail id). When logging into StackOverflow using either of Google or Facebook logins would link to same account. ...
1
vote
1answer
398 views

What makes a secure smartcard secure? Is contactless/RFID better?

In short what security features exist that I should look for in a smart card? What physical features exist, which are important? It appears smart cards may exhibit different levels of wear and ...
2
votes
2answers
143 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
3
votes
2answers
847 views

failed login attempts analysis

Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same, the login failure is at windows or unix or mac user authentication ...
2
votes
4answers
2k views

Why does my bank use this verification method?

I hold my business account with Lloyds TSB [UK] and the process for logging in to their online banking service(s) is as follows: Login page Enter customer number Enter password Put debit card into ...
2
votes
3answers
356 views

How should one manage authentication on custom line of business software

I am writing line of business software for a company, and we want to authenticate users, so we can manage workflow and do some auditing. Basically my employers don't want me to piggyback off of ...
1
vote
1answer
552 views

Using Tokens to Keep Users Logged In

I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? ...
-1
votes
1answer
177 views

About important hacks in history [closed]

I would like to know how important hacks happened, because I can figure out how they hacked a website but I can't figure out how did they hacked into NASA International Space Station source code. Or ...
10
votes
4answers
1k views

Can .htaccess and .htpasswd really protect me?

I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
5
votes
4answers
365 views

Voting System, is there a hole here?

I had this idea a few years ago and improved it today as I notice a hole or two. I believe I have the system down right but If there was a hole the first time there may be a hole this time. I believe ...
2
votes
1answer
401 views

Authentication for a batch script

It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of): What is the most secure way for a batch script, a program needing to ...
2
votes
2answers
370 views

Why superuser or administrator account should never locked?

Why should administrator or superuser account never locked regardless how many incorrect login attempts are made? What should be done instead to alert the staff to the attempted instrusion?
2
votes
3answers
239 views

Emerging Standards for file transfer and integrity check?

What are the emerging standards for file transfers (including online transactions)? How about for file integrity checks?
14
votes
2answers
4k views

Hiding user account names from unauthenticated RDP sessions

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
5
votes
1answer
1k views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
4
votes
3answers
464 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I ...
3
votes
1answer
461 views

Cookie based session variables

I have a situation in which I cannot use a server-side session, but must allow users to log in, and for their logged in state to be persistent between queries. As with anything that involves crypto ...
3
votes
2answers
259 views

RDP - Same login sufficient?

I just authorized remote access to my Windows 7 machine (not using NLA, since I run a mainly Linux network). I diabled Remote Assistance. My user (JoeBlow) is protected with password 123456 and ...
2
votes
1answer
802 views

Implementing 2-step verification via email for web apps?

I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
1
vote
2answers
258 views

X509 mutual authentication: is there a security flaw?

On the client side, my application accepts the server's certificate in case of the client certificate being signed by this server cert. Is this correct or may it be dangerous? Is it better to ask a ...
0
votes
1answer
228 views

Authentication methods without trusting 3rd parties unless explicitly indicated

The plan is to have a situation in which no third parties have to be trusted unless you explicitly indicate so. For example CA's are only used when the contact explicitly added the CA as a trusted ...
1
vote
1answer
124 views

Viable way to authenticate certificate without a web of trust?

For SSL certificates we have a web-of-trust principle. If we are allowed to make alterations to the certificate format, are there viable ways to automatically or semi-automatically authenticate the ...
6
votes
2answers
4k views

Full disk encryption and multi-factor authentication

All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
3
votes
2answers
2k views

Is leaving the root user enabled in Mac OS X a security risk?

To those unfamiliar, the Mac OSX has the root account disabled by default. In order to enable the root user you have to go deep into System Preferences and authenticate yourself with an administrator ...
1
vote
2answers
732 views

Appropriate strategy for preventing brute forcing of logins?

I am currently building security into a website. So far, I have the following rules, and am wondering if this seems sufficient. 5 failed login attempts for a particular username will cause that ...
3
votes
2answers
528 views

What algorithms can be used for device pairing?

I am to implement a system where android devices connect to a central server and have to register with different user accounts, so I have decided to create a pairing dance similar to what can be ...
3
votes
1answer
404 views

Hybrid key management doing it wrong?

I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
1
vote
1answer
228 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
4
votes
3answers
1k views

Are Three attempts to block login a good idea?

In the company that I work there is a security rule: If you enter your password 3 times wrong, your login will be blocked! Then I have to go to mainframe program and re-register my new password. ...
5
votes
2answers
1k views

Is DIGEST-MD5 secure if done over HTTPS?

If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?: Digest access authentication is intended as a security ...
1
vote
1answer
2k views

What are the potential vulnerabilities in a SAML-based SSO approach?

What level of access would an attacker need to obtain to compromise a SAML-based SSO system? Would stealing the private key used to sign SAML requests be enough? What if an attacker had root on the ...
5
votes
3answers
3k views

What are some good ways to verify user identity for password resets?

I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
7
votes
5answers
636 views

Should a user have the ability to be logged in from multiple locations at the same time?

In the past, I've always used a single session per user setup, but I'm working on a project now where a user can be signed in from multiple locations/browsers at the same time. What are the security ...
14
votes
3answers
761 views

What can I do if my bank thinks my date of birth is “known only to me”?

My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name. ...
4
votes
1answer
1k views

How secure is TOTP key on phones?

Our company is considering several options in moving to MFA with software OATH TOTP or yubikey OATH OTP. In regards to where the secret is stored, I'm aware that a yubikey or similar hardware device ...