Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
121 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
10
votes
5answers
5k views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
2
votes
1answer
2k views

Web service HMAC authentication/anti-replay

I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows: ...
7
votes
1answer
2k views

What possible use does an iFrame have for security?

I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password. But just before the end </table> tag there's a blank iFrame which ...
5
votes
5answers
652 views

Should an invalid user name be logged?

While authenticating, should attempts with invalid user names be logged? OWASP Logging Cheat Sheet says that authentication failures must always be logged. I can observe several programs doing this, ...
4
votes
1answer
19k views

Setting up Windows laptops to require a smartcard for unlocking

I am looking for details on how to secure a windows laptop using smart cards. The scenario is that we have laptops in vehicles, which remotely connect (via https) to an application server over the ...
4
votes
2answers
923 views

user authentication by decrypting a random blob

Normal user authentication is done by comparing "hash"-values. A simple example of this: The user password is hashed with PBKDF2 on the client using a salt (the salt is the hash of the user password ...
8
votes
4answers
1k views

Why does getting a password wrong takes more time than not

I type my password to login to Win or Linux. Case 1: I get it right. Almost instant reaction. Case 2: I misspelled it. It takes a while, and then rebounds. Why does it takes longer to identify a ...
2
votes
4answers
8k views

Is using Google Voice number for two-factor authentication a big mistake?

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
3
votes
1answer
1k views

When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?

When displaying a page with content only logged in users should see, I simply check if(isset($_SESSION['hasLoggedIn'])) { //show content } else { echo 'you must log in'; } In this article it ...
2
votes
2answers
560 views

How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?

This is a clone of a question I posted on Stack Exchange. Thought I might catch the eye of some different people who could help here. We are trying to implement a hmac-based one time password ...
6
votes
4answers
7k views

Why do APIs use API Keys instead of Usernames?

It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
6
votes
2answers
6k views

How can I prevent people from duplicating my barcodes [duplicate]

I would like to manage my inventory using a barcode system, but I am afraid that people will be able to scan or copy my barcode and make duplicates. I would like to offer a discount card that has a ...
-2
votes
2answers
1k views

How to completely password protect login into Ubuntu 12.10?

I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite easily,...
0
votes
2answers
177 views

Senario:SSL Enabled Online Banking Application. Question: Should card numbers be provided back to a user un-masked, when there is a failed login?

For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login. Would this be a violation of PCI DSS 3.3 or not as the ...
9
votes
6answers
1k views

Is there multi-factor authentication for machines?

Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
0
votes
0answers
52 views

Can double encryption with different key increase the security? [duplicate]

Encrypting the file using same encryption algorithm using different Keys can increase the security or not?
3
votes
3answers
2k views

Proper Linux user authentication through PAM aware applications

Currently I'm building an authentication system using Linux PAM for a python daemon process. It will need to authenticate remote users from a variety of front-ends against the local user list. (...
0
votes
1answer
177 views

Is this a secure method for authenticating clients?

I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy. Client sends a ...
0
votes
2answers
352 views

Where are the private keys stored in Persona/Browser ID?

I'm trying to understand where the private keys are stored in the Persona system, and how they are protected. Can anyone elaborate on where the crypto material is created, stored, and what is ...
7
votes
5answers
412 views

How to support secure creation of a user account over an external API via a queued job?

So this question is delving into security and encryption and the problem potentially hasn't been encountered by many. Answers may be theoretical. Let me outline the scenario... A website frontend is ...
4
votes
2answers
970 views

How can the low-water mark property apply to Bell-LaPadula?

I am taking a computer security class, and have a homework problem which has the following setup: Now assume a dynamic version of the Bell-La Padula Confidentiality model that incorporates a ...
7
votes
1answer
9k views

Web Applications (http): Don't get how token based authentication is secure

See something like this: http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088 Or more specific: Token-based authentication - Securing the ...
25
votes
3answers
2k views

Is authentication using personal pictures more secure than passwords?

Statement 1 There is a start up called PixelPin. On the web site it reads: The PixelPin solution is simple and quick to use, yet very secure. PixelPin eliminates the traditional alphanumeric ...
11
votes
3answers
1k views

How much information about the reason for an unsuccessful login should a web application give?

After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application give?...
2
votes
2answers
624 views

MySQL Access Control?

I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
61
votes
8answers
14k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
5
votes
1answer
324 views

Security and authentication problem

We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes. First of all, lets imagine a real world scenario: Imagine that a user ...
5
votes
3answers
3k views

HMAC What is secure manner to distribute shared secret between client and server?

I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
2
votes
4answers
846 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
2
votes
1answer
924 views

Improving Digest Authentication using PBKDF2

For a variety of reasons, I need to use digest authentication for a REST server that I have created. I have come up with an "improvement" that I believe strengthens the algorithm against MD5 attacks ...
5
votes
2answers
3k views

what is the difference between a mac and a digital signiture

I understand that a MAC algorithm takes a message and a private key as input and hashes them to a value. I understand that senders and receivers often use MACs to authenticate a message and check the ...
4
votes
3answers
1k views

Is Username/Display Name Login more secure than email login?

I recently started playing Star Wars: The Old Republic, which for those of you who don't know, is an MMO. Before playing the game, I would always log in with my email/password combo. However, I got an ...
1
vote
3answers
803 views

Use Authentication using 2 encrypted strings

So, basically I am trying to log a user in with a cookie and do not query DB to improve performance. Here is a brief idea: Transmit everything via SSL Set a Global secret key A and secret key B ...
205
votes
17answers
18k views

Passwords being sent in clear text due to users' mistake in typing it in the username field

Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
2
votes
1answer
704 views

What is the cost of SSL encryption?

So, I've been looking over various websites that don't handle confidential information per se, but do accept user authentication tokens (i.e. you can create accounts with them and associate an e-mail/...
5
votes
1answer
223 views

Authentication by Signing or MAC?

I'm still new to security, so I'm sorry if this question doesn't make sense or if I'm completely off base with something. I've got some messages I want to encrypt (probably with AES-256-CBC) and send ...
3
votes
4answers
1k views

FireFox's restore previous session restores logins authenticated by server's sessions

In a website I'm building when I login, close FireFox, open FireFox and try to go to the website again I must login again (as expected) BUT if I select "Restore Previous Session" I am logged in again. ...
1
vote
1answer
469 views

Key authentication with ssl

Can i authenticate myself in SSL with a key, just like in SSH?
12
votes
3answers
593 views

Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?

On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
3
votes
7answers
577 views

How to provide security for passwords stored in Database? [duplicate]

Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
3
votes
3answers
5k views

static vs dynamic vs challenge response

I am taking a security class. The slides say that smartcards usually use one of three types of authentication protocols: static, dynamic and challenge response. What is the difference between these?
1
vote
1answer
1k views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
4
votes
6answers
2k views

How to “demonstrate” man-in-the-middle attack?

I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project). Over the years a bunch ...
2
votes
2answers
818 views

How high is the entropy of this salt-generating code? (No code-reading actually necessary)

What is the best method? Assumption: I have a function that generates a number of medium-high entropy bytes Step1: I generate 3 of these medium-high entropy bytes. Step2: I hash these bytes using a ...
-3
votes
1answer
511 views

When logging into a web page what exactly happens when a user types the wrong password?

I have two related questions as to what happens when a user tries to log in to a website If the entered password is wrong what should happen? I have two ideas: Redirect to a page saying "wrong ...
1
vote
2answers
108 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
1answer
99 views

Should Framebusting be used (not used) on an IdP login page?

I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary. On the other hand, if I ...
2
votes
1answer
782 views

What is more secure for voice and SMS OTP: A random number or generated similar to HOTP?

Many providers are creating OTP authentication for their sign in. However I noticed that all the voice and SMS OTPs I've come across are a series of 6 digits... similar to the HOTP RFC Standard ...
3
votes
3answers
417 views

Is this a good way to handle login process

Just wanted to know if this would be considered a good way to handle login process. It doesn't matter which language it is written in. I will use this fellowing format. - Event (Where it happened) ...