Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
608 views

BitMessage : Key authentication?

Does BitMessage provide key authentication? If so, then how? How would one can be sure that the public key belongs to the right person?
5
votes
1answer
4k views

WCF - Is this a good security Architecture?

I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users ...
13
votes
4answers
4k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
0
votes
1answer
253 views

Protecting Website Static Resources

If I have a website that is only accessible by authenticating at a login page, is it possible for a non-authenticated person to get access to static assets (images, css, javascript, ...)? I imagine ...
11
votes
9answers
2k views

Why do we authenticate by prompting a user to enter both username and password? Does prompting the password only suffice?

I don't know why do we authenticate by prompting the user to enter both username and password. In my mental model, prompting password only suffices. The reason is as follows: Assume there are x ...
8
votes
2answers
901 views

Replacement for One Time Passwords (OTP)

OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
8
votes
3answers
801 views

Which authentication at the end of the Secure Remote Password protocol?

For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this: M = H(A | B | K) --> <-- H(A | M | K) ...
1
vote
0answers
354 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
55
votes
12answers
3k views

How do you log in from an unsecured computer?

Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
2
votes
3answers
226 views

Alternative to charging 2 small amounts for credit cards authentication?

Currently the client I'm working for charge 2 small amounts on adding credit card to authenticate credit card. After that they ask end-users to check the exact amounts on their monthly statements and ...
3
votes
3answers
5k views

SSL verification of host name of https server

I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
4
votes
6answers
376 views

Ban or delete abusive users [closed]

I'd like to hear recommendations on a best practice for handling abusive users (for whatever reason) on an authenticated Website. Is there any point in keeping the user in the database with a ...
5
votes
4answers
647 views

Pin + guid in URL secure for a web app?

We have an ongoing project at work in which the security is a hot topic of debate. The whole site is SSL and proposed auth process is like so: User receives a non-unique 4 digit pin number in ...
11
votes
5answers
3k views

How can I securely authenticate the client application sending me data?

We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
3
votes
1answer
464 views

Will using external OAuth providers for authentication protect users better than custom authentication?

On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
2
votes
1answer
145 views

Extended Basic Authentication

I would like to implement a REST API with Basic Authentication which relies on username and password. Because REST is stateless the user would have to reenter username and password for every request ...
3
votes
2answers
966 views

A protocol to authenticate users without login/password

A casual message exchange on reddit yesterday got me thinking whether it might be possible to design a protocol that removes the need for users to remember a unique password for every service (s)he ...
5
votes
1answer
511 views

Custom web authentication scheme

For a project at work I'm currently implementing a not too large webservice. For reasons of learning something new I tried making it a REST service, which then prompted the issue of authentication. I ...
0
votes
2answers
298 views

Using authentication only one time passwords [duplicate]

I would be interested in advice. Imagine a authentication mechanism where users are authenticated ONLY using some code (e.g., one time password) which they receive (say as SMS) on their mobile phone? ...
3
votes
2answers
2k views

LDAP Security problems?

I have installed many Active Directory (AD) based networks and have applied various standard security templates based on best practices, however I have never really looked at LDAP on a deeper level ...
2
votes
1answer
354 views

Authentication for Mobile Devices

I am looking for ways to Authenticate on a mobile device. The mobile application is connecting to a WCF Service which in turn connects to a Database. Before the application retrieves any information ...
9
votes
1answer
13k views

Security for REST api (user/pass auth vs hmac vs oauth)

I have two servers (one on Hetzner (I am calling it H) and other in my office (calling it O) ). I need to run a basic CRUD web service on O and the only consumer of the service is H. Data on O is ...
-3
votes
2answers
715 views

Why doesn't Google 2 Factor Auth ask for a code? [closed]

I set up Google 2 Factor auth to use 2 Factor Auth with certain sites. But reading over the help suggests that Google 2 Factor Auth is only used to log into Google services like Gmail. But when I log ...
0
votes
2answers
715 views

Do Google 2 Factor Auth backup codes work for logging into Google or other sites?

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device. Are these used only to log into Google, or can they be used to log into other sites?
1
vote
2answers
103 views

How to log into sites that you have set up Google 2 Step Authenticator if you lose your phone?

If you use Google Authenticator to log into sites using 2 Factor Authentication, how do you log in after you lose your phone? Can you install Google Authenticator on another device?
2
votes
1answer
701 views

API authentication without Oauth2 server

I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login ...
-3
votes
1answer
914 views

What are some good user login/authentication libraries or protocols to use with Python on Google App Engine? [closed]

I've read elsewhere (http://forums.udacity.com/questions/6028436/bcrypt-not-suitable-for-pythongae) that bcrypt is not suitable for use on Google App Engine. What are some good ways to create a user ...
5
votes
4answers
719 views

User password as key instead of hashing it

I was reading here on Hashes and Salts and I thought about another method to do user authentication. I need your thoughts on this as I might be overlooking something. Scenario: For web application ...
3
votes
2answers
2k views

If a login/session cookie is stolen,does changing the password void it?

Considering the scenario where a Gmail session/login cookie is hijacked or stolen and it is discovered my means of Gmail last account activity,will changing my password immediately void the cookie or ...
3
votes
2answers
733 views

Store private key on server, then use k1 to log in, k2 to verify HMAC and k3 to decrypt private key

I'm working on a proof-of-concept program to encrypt email with less difficulty for end-users with a process like: To create an account: Generate a random salt and IV, and get a password from the ...
12
votes
7answers
29k views

Can my email account be accessed without the password? How secure is it?

Can my email account be accessed without the password, and how secure is email if I store my personal documents on it? And how come Yahoo Mail asks me to tell them my friends and folders names to ...
-1
votes
2answers
8k views

Want to authenticate oracle login using encrypted password…how to?

We are connecting to Oracle using korn shell scripts, which use sqlplus to connect to Oracle. The Oracle database is on the same Solaris box. Currently, we are storing the Oracle user id and ...
8
votes
2answers
788 views

NFC used in place of contact based smart card two-factor authentication

My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
2
votes
2answers
309 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
10
votes
1answer
408 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change ...
36
votes
3answers
2k views

Am I wrong to believe that passwords should never be recoverable (one way hash)?

I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
1
vote
2answers
2k views

Asynchronous vs. Synchronous authentication process

I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database). I'm at the stage where I have to design the authentication and I had a question about ...
2
votes
2answers
342 views

Can unencrypted keys & logins be kept out of program memory?

No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will ...
2
votes
1answer
2k views

Why can I see the Basic Auth credentials in plaintext when using SSL

I just read this about the security about Basic Authentication over SSL: Is BASIC-Auth secure if done over HTTPS? And I don't get it. I just installed ProxyDroid (http proxy) on my rooted android ...
5
votes
3answers
1k views

How can salted, hashed password storage be combined with a plaintext, nonce and hash based authentication?

My understanding is as follows: To securely store a password (e.g. in a database), you use a hashing algorithm designed for this purpose (designed to be slow, e.g. bcrypt), and you use a unique salt ...
6
votes
3answers
560 views

Should password be cleared after unsuccessful logon attempt?

Lets assume following workflows a) On a device with keyboard: I type my username and password Press enter [realization] I made a typo Password field is cleared: not a big deal, I can type ...
1
vote
1answer
2k views

How to secure database table of users for an application?

I am working on a Windows application that utilizes a MySQL database for its user authentication and data storage. Within the application, the highest level of user (Administrator) can create and ...
7
votes
4answers
429 views

Candidate authentication in large scale assessment

First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes. We're ...
-1
votes
2answers
12k views

How to get an NT hash from registry? [closed]

I want to manually get the NT hash from the registry (without any tool). Let's say just for the administrator. I know that it must be stored in the SAM area of the registry somewhere so I tried to ...
1
vote
3answers
861 views

NTLM security and password complexity

A client that allows to respond to the server with LM and NTLM, with a password which is simple,, is it insecure. Isnt a more secure way is to have all the communication with NTLMv2 scheme? and in ...
7
votes
2answers
1k views

Any advantage to securing WiFi with a PSK, other than to keep out unauthorized

As I understand WiFi with a PSK, such as WPA(2)-PSK or WEP, anyone on the same network can decrypt anyone elses packets because everybody has the same key. In which case, if you are not going to ...
4
votes
3answers
5k views

Role vs Identity based authentication? What is the difference?

What is the difference between role-based authentication and identity-based authentication? If a system uses ONLY a password mechanism to authenticate operators (different PIN for Admin and User) it ...
0
votes
1answer
363 views

What are the performance and security tradeoffs when selecting “ECC” or “Subgroup” in a U-Prove token?

In one of the U-Prove documents, I remember reading something that compared Subgroups versus ECC and it went something like this (paraphrased): Subgroups Requires a bigger key to achieve equivalent ...
8
votes
6answers
1k views

Logging in a user after password reset via link

Lets say password reset functionality flow is the following: User submits email address used for his account. An email is sent to that email address with a link with a password reset hash. Upon ...
2
votes
0answers
64 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...