Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

9
votes
6answers
2k views

POP3/IMAP Stronger Authentication

We recently deployed a two-factor-authentication solution in order to strength logon to our web applications (one of them is web based mail, Microsoft outlook web access) Most of the users who have ...
70
votes
3answers
91k views

Token-based authentication - Securing the token

I have developed a backend REST API for a mobile app and I am now looking to implement token-based authentication for it to avoid having to prompt the user to login on every run of the app. What I ...
2
votes
1answer
219 views

Safe User Login Questions

I need help determining how safe the login is. First of all, I have been reading this: The Definitive Guide To Forms based Website Authentication It's really well written, great information most of ...
2
votes
2answers
147 views

Is this login authentication safe?

I have been thinking of a way to authenticate users so as to pick out the users using cracked versions of my game from the people who have actually bought it. I came up with this idea: The client ...
2
votes
1answer
3k views

Should we block all plaintext authentication and require authentication over an encrypted channel?

Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over? I recently configured my servers to ...
7
votes
2answers
7k views

Help understanding basic user authentication with salts and hashing

I for some reason am not understanding how to execute a secure authentication between client and server for a user. I've read many resources, and I understand how to use the hashing and salting tools, ...
18
votes
6answers
7k views

How to verify that someone is who they say they are online?

I am working on an online job application web app and the question has come up about how we will verify that someone submitting an application is who they say they are. For example, we don't want ...
22
votes
4answers
3k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
3
votes
1answer
450 views

How strong are google's Application-specific passwords? [duplicate]

Possible Duplicate: Google Account: implications of using application-specific passwords In 2-step verification of google accounts, we need to use the Application-specific passwords ...
1
vote
4answers
187 views

how to identify whether my page is phished or normal page?

Usually I differentiate phished page and normal web pages by seeing https before the address of the web page, as the lock symbol will help us to identify. Are there any other methods to differentiate ...
6
votes
3answers
578 views

How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?

I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.) I have a 20+ digit password, however there's apparently a new requirement for Microsoft ...
25
votes
4answers
11k views

Are there technical disadvantages in using free ssl certificates?

Note this question is related, except this one is about free SSL certs. There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
8
votes
6answers
2k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
7
votes
5answers
5k views

Is there a reason to protect SIM with PIN?

If the phone would be stolen then the SIM card will be thrown out by thieves just after the theft so that they can't be found. If the phone would be lost then it will be harder to find an owner for ...
5
votes
3answers
8k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
7
votes
4answers
526 views

Should SMS systems warn users of possible spoofing attacks?

The author of this blog post Never trust SMS: iOS text spoofing says that: The sender of an SMS message may provide arbitrary sender information using low level protocol features. Furthermore the ...
-1
votes
2answers
125 views

Should I use salt to authenticate data?

I have a client and a server. The client makes a request containing userId, cardId, position (on the card) A hacker could just do the same http request with the next position. So I think about ...
5
votes
4answers
415 views

Automating Social Engineering Prevention

Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...
2
votes
1answer
190 views

Is Creating a Restricted Database User in Microsoft SQL Server Decent Protocol

Forgive me for the heavy metaphor but it's a situation's complexity kind of goes over my head. Assume I'm Leonard Shelby (My short term memory only lasts 5 minutes). I'm a freelancer that reads ...
10
votes
4answers
7k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
11
votes
5answers
7k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
5answers
3k views

How to secure a server backend

I am developing a server which serves two purposes: it is a CMS for people to use and maintain some data, and a Web Service for a mobile app to get this data. It runs on a Debian server running Tomcat ...
1
vote
2answers
1k views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
20
votes
4answers
9k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
7
votes
4answers
478 views

Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?

First, I have a private delegate set up on my web site for OpenID and pointed my SE account at the URL on my web site; SE has no knowledge of the actual OpenID provider endpoint until my delegate ...
8
votes
2answers
901 views

Replacement for One Time Passwords (OTP)

OTP may known as new generation of password security techniques, but I want to know does it still safe enough after several years of appearance or it will deprecate soon? & what would be the ...
5
votes
2answers
1k views

Encrypting/decrypting information in database

So, let's say I have a secret message I want to encrypt and store in my database, from where an authenticated user can retrieve, decrypt, read, update the message. EDIT: the issue I'm encountering is ...
20
votes
4answers
9k views

Password resets - what practices should web services follow?

Many of you may have seen How Apple and Amazon Security Flaws Led to My Epic Hacking, where a Wired reporter's Amazon, Apple, Gmail, and Twitter accounts were successfully hacked. The hacker followed ...
4
votes
1answer
621 views

How to verify the authenticity of Facebook users?

While I was not surprised at all by Facebook stating that "8.7 percent of accounts belonging to its 955 million monthly active users are fake"; link is a news story that providers a summary of their ...
0
votes
1answer
363 views

Can I export my digital certificate to this emtec usb

It is said here http://www.emtec-international.com/sites/default/files/s530_aes_en_0.pdf 2048 bit RSA module: ready for PKI application SHA256 data hashing: ready for digital signature Does it ...
15
votes
2answers
17k views

Creating user specific authentication methods in SSH

I have configured sshd on an Ubuntu server to use key authentication and it is working fine. I had to disable password authentication for key authentication to work. Server is always accessed via ...
15
votes
4answers
575 views

Why aren't digital signatures the standard way to authenticate web clients?

The web is a mess of incompatible cookie schemes, asinine requirements ("your password must contain letters, numbers, and at least one symbol from !()-_., and must begin with a letter, and once you ...
2
votes
1answer
587 views

How can passwords be stolen from Yahoo?

I always understood that servers don't actually store user passwords. Instead, they store hashes of passwords and then they validate the user input by applying the hash function, then compare the ...
2
votes
3answers
286 views

Why would it be a good idea for someone to get or not to get a Yubi key [closed]

In what uses would it be smart to get a Yubi key?
3
votes
0answers
104 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
13
votes
4answers
4k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
81
votes
11answers
15k views

“Username and/or Password Invalid” - Why do websites show this kind of message instead of informing the user which one was wrong?

Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something ...
7
votes
3answers
36k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
9
votes
3answers
7k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
5
votes
1answer
5k views

Facebook page receiving improbable amount of likes from unknown users

A bit of an odd problem, but I'm not totally sure where to post this. I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
0
votes
1answer
60 views

Considerations when displaying OpenID and WS-* output to an end user

I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure. I would like to create a page that decryption the current session's OpenID or WS-* token, ...
13
votes
2answers
8k views

What is the benefit of the scope in OAuth2?

In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless. This question refers to ...
0
votes
1answer
479 views

Implementing an invitation process for user setup

In a new ASP.NET MVC application I'm working on we'd like an administrator user to be able to set up other user accounts by creating invitations which will be emailed to the new user. That email will ...
3
votes
2answers
1k views

SASL Authentication Protocol with No Cleartext passwords

As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL. The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
5
votes
1answer
2k views

Comparing the standard HTML form POST for user authentication vs Javascript/AJAX

Are there any security implications with POSTing a authentication request with the use of javascript/ajax, as opposed to POSTing an HTML element by pressing the submit button? thus <form ...
4
votes
1answer
361 views

Custom EC2-style user authentication system - how secure is it?

At work I'm trying to design a user authentication system that is session-less (including session based tokens such as those used in OAuth2) due to client software requirements. The services are REST ...
9
votes
4answers
587 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
3
votes
4answers
2k views

Authentication between web services within the same project

In our project, we have several web services. Some of them are meant to be used only by the other services and the system administrator. We already have a global authentication system for users, this ...
-1
votes
2answers
111 views

What happens when and attacker changes the installed public keys in browser

I was reading about SSL. I understood that each browser comes with a predefined set of known public keys,which is then used to authenticate the messages. I was wondering what will happen when a virus ...
9
votes
3answers
1k views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...