Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
1k views

Asymmetric crypto to store credentials in HTML LocalStorage

We are developing a Mobile web app where the users want (and it is a non relaxable requirement) to be logged for a very long time. The solution we are developing has a web-client part in HTML+JS and ...
5
votes
3answers
382 views

Mutual authentication for humans

Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...
0
votes
2answers
248 views

Verifying users location & authenticity

I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin). I need to verify the following: Business Name ...
2
votes
2answers
258 views

is RDP7.0 authentication process secure enough?

Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is ...
3
votes
1answer
242 views

Is this acceptable login security?

I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2. I discovered that I could input my password, followed by garbage, and it would be accepted. How is this considered ...
64
votes
4answers
54k views

What is the difference between an x.509 “client certificate” and a normal SSL certificate?

I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
4
votes
2answers
8k views

Disabling authentication via DSA keys in OpenSSH?

How can I disable DSA and ECDSA authentication on my server with OpenSSH 5.9? Sifting through the documentation material and doing a web search didn't yield any results - only an old bug report for ...
14
votes
5answers
2k views

Is there a digital “safety deposit box” equivalent?

Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy? There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
2
votes
3answers
4k views

Dealing with untrusted administrators in a Windows domain

I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
3answers
341 views

Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?

Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP. Should banks offer integration with services like OpenID, WS-Fed, or ...
14
votes
3answers
4k views

Should security question answers be case-sensitive?

Question In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers? Scenario An ...
3
votes
2answers
665 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
2answers
2k views

UNION SQL Injection

I'm trying to demo SQL Injection with a UNION query but I'm not getting results. This is the C# code and the database is SQL Server 2008 R2: string cString = "server=.\\sqlexpress; ...
0
votes
1answer
361 views

Does PayPal support a backup code for two-factor auth? [closed]

Google and DropBox have backup codes in case you can't get access to one of the devices you have registered. Does PayPal have a backup code?
1
vote
1answer
313 views

How to verify data from localStorage on a server

This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit. On my mobile app, I am ...
4
votes
2answers
595 views

Any real world examples of GPS location data being used with authentication?

Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations? Specifically Highlighting new or unusual ...
0
votes
1answer
112 views

WLFriends encrypted login risk

I recently had created on WLFriends.org which is presented by Wikileaks, I noticed a big thing there that the process of signing up at WLFriends was very distinct from the other normal sites. There, ...
2
votes
3answers
229 views

Whether certificates can be used for regulating access

I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose. My ...
0
votes
1answer
674 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states ...
1
vote
1answer
678 views

Storing Private Keys Generated on Server with specific User's Password Securely

I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
1
vote
2answers
447 views

Can I use hardware token OTP to stop piracy?

Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
6
votes
1answer
284 views

How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?

One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
0
votes
3answers
127 views

Lowest possible threshold for smartphone app login

I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game. Testing shows some ...
0
votes
3answers
3k views

Is it possible to change the wifi password with a script?

I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
2
votes
1answer
4k views

Wifi login redirect applications

This may sound a bit naive questions as i am a beginner. But I do my best to put it into words. You may have experience when sometimes you want to use the internet in a cafe for example (with your ...
6
votes
1answer
679 views

Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)

I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
2
votes
1answer
872 views

How does the YubiKey Validation Server work from an encryption perspective?

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
3
votes
2answers
238 views

Should the serial number of multi factor devices be removed?

I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it. I don't want to blindly assume that the serial number is just ...
2
votes
1answer
4k views

Is it secure to install RSA SecurID Software Tokens on the same computer that will be used to access the VPN?

My office switched from using the old hardware RSA SecurID key tokens to the RSA SecurID Software Tokens and most users have them installed on the same machines they use to access the VPN. I asked ...
10
votes
3answers
10k views

help understanding client certificate verification

I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
4
votes
1answer
694 views

Trying to figure out Gmail login in Wireshark

In my pentesting lab I'm using ettercap for do a mitm to a XP VM. I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
9
votes
1answer
624 views

How secure is Windows 8 email authentication?

I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email ...
6
votes
1answer
8k views

How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?

I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
0
votes
2answers
282 views

Security concern to implement a web based remote desktop

I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class. I can configure the ...
7
votes
5answers
670 views

Are we concentrating too much on password complexity?

As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
1
vote
1answer
133 views

Reasonable computationally lightweight security?

I've read a bunch about how one should use bcrypt or PBKDF2 as a good middle ground between tunable workload and acceptable time to make brute force and collision attacks unfeasible. What if the ...
0
votes
0answers
23 views

Facebook Login security concern with the javascritp JDK [duplicate]

Possible Duplicate: Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint? I have some real concerns about how to use facebook login for my wabb-app. I have a ...
1
vote
2answers
258 views

Authentication without saving password

Are there any security problems with following authentication protocol? when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = ...
6
votes
4answers
4k views

HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?

We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
1
vote
1answer
814 views

Public web server and AD- based Kerberos authentication

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
7
votes
2answers
1k views

Does having a passphrase and SSH key qualify as two factor authentication for PCI?

I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
6
votes
5answers
1k views

Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?

The typical set of multi-factor categories is as follows: Something you know (e.g. a password) Something you have (e.g. a hardware token, or key file) Something you are (e.g. a fingerprint or retina ...
14
votes
6answers
18k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
0
votes
1answer
166 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
7
votes
3answers
2k views

Is my session-less authentication system secure?

So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
1
vote
1answer
602 views

RADIUS proxy chains

RADIUS is a widely deployed remote authentication protocol. I'm looking here at its use in wireless roaming. The RADIUS protocol allows for proxies and chains of proxies: |CLIENT|<->|Access ...
3
votes
1answer
5k views

what is the role of RADiUS server and Active Directory to increase the security in wireless networks?

In the CBT Nuggets Video Training, one slide about Wireless networks : i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and ...
4
votes
4answers
2k views

Client Certificate in SSL HandShake insecure?

Imagine we have an application which is trying to establish a secure connection to a server by using SSL. Now we want the user to authenticate himself with a client certificate which he stores in an ...
18
votes
6answers
3k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
6
votes
1answer
2k views

What is the opaque field in HTTP Digest Access Authentication used for?

Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value ...