Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

4
votes
2answers
3k views

what is the difference between a mac and a digital signiture

I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
4
votes
3answers
1k views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
1
vote
3answers
796 views

Use Authentication using 2 encrypted strings

So, basically I am trying to log a user in with a cookie and do not query DB to improve performance. Here is a brief idea: Transmit everything via SSL Set a Global secret key A and secret key B ...
202
votes
17answers
17k views

Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
2
votes
1answer
679 views

What is the cost of SSL encryption?

So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an ...
5
votes
1answer
220 views

Authentication by Signing or MAC?

I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
3
votes
4answers
1k views

FireFox's restore previous session restores logins authenticated by server's sessions

In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
1
vote
1answer
456 views

Key authentication with ssl

Can i authenticate myself in SSL with a key, just like in SSH?
12
votes
3answers
590 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
3
votes
7answers
574 views

How to provide security for passwords stored in Database? [duplicate]

Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
3
votes
3answers
5k views

static vs dynamic vs challenge response

I am taking a security class. The slides say that smartcards usually use one of three types of authentication protocols: static, dynamic and challenge response. What is the difference between these?
1
vote
1answer
1k views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
4
votes
6answers
2k views

How to “demonstrate” man-in-the-middle attack?

I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project). Over the years a bunch ...
2
votes
2answers
803 views

How high is the entropy of this salt-generating code? (No code-reading actually necessary)

What is the best method? Assumption: I have a function that generates a number of medium-high entropy bytes Step1: I generate 3 of these medium-high entropy bytes. Step2: I hash these bytes using a ...
-3
votes
1answer
508 views

When logging into a web page what exactly happens when a user types the wrong password?

I have two related questions as to what happens when a user tries to log in to a website If the entered password is wrong what should happen? I have two ideas: Redirect to a page saying "wrong ...
1
vote
2answers
108 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
1answer
99 views

Should Framebusting be used (not used) on an IdP login page?

I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary. On the other hand, if I ...
2
votes
1answer
764 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
3
votes
3answers
407 views

Is this a good way to handle login process

Just wanted to know if this would be considered a good way to handle login process. It doesn't matter which language it is written in. I will use this fellowing format. - Event (Where it happened) ...
5
votes
1answer
600 views

Are there risks of using the same OpenID provider for sites with different security levels?

I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
0
votes
1answer
224 views

What type of attack should be used in order to pass this authentication

I am practicing the Astalavista Wargames and i came across this challenge. The question is: Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to log ...
2
votes
3answers
145 views

Is password authentication worse that signed messaging if done over SSL?

Let there is a public API: HTTP-based via SSL there are no browsers, just connections between custom written programs The first authentication scheme that came to my mind was... client signs their ...
3
votes
1answer
191 views

Exporting data beyond a cryptographic boundary

Scenario We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
8
votes
6answers
2k views

Logging in a user after password reset via link

Lets say password reset functionality flow is the following: User submits email address used for his account. An email is sent to that email address with a link with a password reset hash. Upon ...
6
votes
1answer
805 views

How does SRP prevent man-in-middle attacks?

SRP is designed to resist both active and passive attacks, how does SRP prevent man-in-middle and packet modification attacks?
-1
votes
1answer
140 views

What makes EAP-SRP-256 better than SRP? [closed]

What is the advantage of the EAP-SRP protocol? Is it only used in wireless?
3
votes
3answers
193 views

Is it safe to mix authentication methods?

Is it a good idea to "combine" authentication methods? Example we can use username/password method to authenticate a user from a server. What if we used this as a first authentication step to get ...
1
vote
2answers
855 views

Brute force a GUI login?

I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button ...
12
votes
3answers
2k views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
7
votes
5answers
2k views

Preventing online voter fraud

As part of a promotional campaign, my company wants to launch a site where users (and potential users) of our product will be required to register and vote for certain choices. Depending on how ...
1
vote
2answers
858 views

What security issues are there when reading cookie with .htaccess?

I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
3
votes
2answers
894 views

Is there a reliable way to simulate “Evil Maid Attack” boot path tampering when using bitlocker?

Suppose you have a system whose OS drive is encrypted with bitlocker and uses TPM + PIN authentication to authenticate the boot path against tampering. As I understand it, this setup theoretically ...
3
votes
3answers
2k views

How to use USB-Stick instead of passphrase?

I wanted to know if something exists that would allow the following. Whenever I use my RSA key(when using ssh for example) I'm prompted for my passphrase. I would like to, instead of being prompted ...
1
vote
2answers
375 views

certificate based network authentication

In certificate based network authentication, is the user tied to just the system the certificate has been installed on such that if he tries to authenticate using another system access is denied?
1
vote
3answers
374 views

Requirements for a smartphone anti-theft App

I recently installed Cerberus in my [personal] Android device to get some protection against theft (I'm not really interested in protecting its data, but rather in increasing the odds the device will ...
3
votes
1answer
692 views

Pure SRP authentication without TLS

IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
34
votes
4answers
21k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
3
votes
6answers
431 views

Protecting an admin area from the public

We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site. Now I'm not very interested at just leaving the admin out in the open ...
2
votes
3answers
262 views

Authentication system against the user

I try to search articles on the internet in this category, but no result. In generally we use authentication of the user against the system. So, we want to authenticate the user before he\she use our ...
0
votes
2answers
916 views

OpenID without SSL certificate

Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed? Just to make things clear, ...
1
vote
3answers
177 views

Central authentication

I am designing a system composed of several services. Some can be hit only from inside our network and a few can be hit externally. One of these services is a "login" or "authentication" service. My ...
18
votes
2answers
12k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
2
votes
3answers
989 views

Using RADIUS for host authentication

Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a ...
1
vote
1answer
272 views

Are there any solutions available which conform to AAA protocol?

According to Wikipedia (http://en.wikipedia.org/wiki/AAA_protocol) In computer security, AAA commonly stands for authentication, authorization and accounting. It refers to a security architecture ...
1
vote
5answers
1k views

Good ways to prevent spammers from registering [duplicate]

Possible Duplicate: Is there a true alternative to using CAPTCHA images? Since everyone hates captchas what are good alternatives? I'm looking to prevent the automated creation of accounts ...
1
vote
1answer
2k views

Picking an encryption algorithm for auth tokens passed via AJAX

I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens. As an example: The user will login in to the website (via OAuth, whether by the site as ...
2
votes
1answer
985 views

Loki How to crack the password hash OSPF?

I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF. Now,by Loki penetration testing, I found that routers are the feature authentication. Using wireshark, I ...
3
votes
4answers
258 views

Securing opensource web application

I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
19
votes
9answers
4k views

is there a safe way to login to my gmail account from a public pc?

Sometimes i need to use a public pc to access my gmail account, is there a safe way to login and keep my password safe in case there was a keylogger or a trojan on that pc? are there tools that could ...
2
votes
2answers
457 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...