Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
154 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
0
votes
0answers
97 views

Brute-forcing a RSA private key password vs. LUKS volume

I need to store various private keys for my clients. Given these options, what would be the least prone to brute force attacks: Encrypt the private keys using a separate RSA key (each user get its ...
0
votes
0answers
50 views

Implementation of AEAD_AES_256_GCM and AEAD_AES_128_GCM ciphers in secure RTP

I am in the process of implementing AEAD_AES_256_GCM and AEAD_AES_128_GCM ciphers in secure RTP. There is a mechanism in RFC 5116 to implement the algorithm, but I am not able to find any sample code ...
0
votes
0answers
80 views

What to use to encode JSON Web Token?

I'm using JWT to create access tokens for a Sinatra API. My question is, what should I use to sign the token? Right now I'm trying to use the user's password hash, but bcrypt-ruby changes the ...
0
votes
0answers
65 views

Guidance on Login using Digital Signature DSC (PKCS12 and x509 certificate)

I'm interesting in exploring possibility to authenticate user using their Digital Certificate. The methodology is to first register the DSC from the user and keep their Public key along with Serial ...
0
votes
0answers
20 views

Chrome/Youtube says incorrect certificate for host? [duplicate]

Why my Youtube always ask me: Incorrect certificate for host. The server presented a certificate that doesn't match built-in expectations. These expectations are included for certain, high-security ...
0
votes
1answer
151 views

SSO software – where is symmetric key stored?

In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ? When using smartcard, I can understand that ...
0
votes
0answers
35 views

Authentication API that just returns ID with right email / password combination a security problem?

Two companies. MegaSocialPlatform CorporateCompany. CorporateCompany wants that their employees can reuse their current login credentials of CorporateCompany.com on MegaSocialPlatform, so ...
0
votes
0answers
153 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
0
votes
0answers
127 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
0
votes
2answers
157 views

WinForm Application Security

I wanted to create a winform application that have a centralized security database. This application is portable, can be save to any PC and simply run the .exe to use, hence there will be many copies ...
0
votes
0answers
58 views

Help with SAML 1.1 token request and response

I need to communicate with a service with SAML 1.1 based security and have a number of very basic questions. First I'm supposed to send a token request to the STS with a "Assertion token" in base 64 ...
0
votes
0answers
40 views

how can I authenticate a process from kernel side?

I would like to authenticate and integrity check a single process before its execution. That authentication and integrity checks should be on kernel side for obvious reasons. I was thinking to add ...
0
votes
0answers
68 views

Federation Service to Azure with users from trusted domain.

I want to set up a website on Azure according to the following requirements and are wondering if it is even possible? As a internal team member, I must be able to login to the site with Windows ...
0
votes
0answers
32 views

How does WebID fit in the SAML picture?

How does WebID fit in the SAML picture? Are they related or completely unrelated? Can they work together? If yes, what are the benefits?
0
votes
0answers
39 views

Preventing “existing accounts” data leak during account creation [duplicate]

It is common practice for web apps to prevent mining of existing user accounts for logins (with "username and/or password does not exist" rather than "user does not exist"), and for password resets ...
0
votes
0answers
26 views

Client side ssl auth by signing with server key [duplicate]

So I followed this for setting up client ssl certs using openssl: http://drumcoder.co.uk/blog/2011/oct/19/client-side-certificates-web-apps/ It basically walks through creating a new CA key, and then ...
0
votes
2answers
59 views

Application Authentication [duplicate]

We are developing an Android/iOS app. This app tracks the user's GPS coordinates and send them to the server along with other data. The integrity of the sent data is too critical for our service. We ...
0
votes
2answers
65 views

Is address information sensitive for companies or individuals during registration?

I am designing a web site that contains external suppliers to register and keep their information with the company up to date. We already have a db with EIN, SSN numbers and their addresses. One of ...
0
votes
0answers
131 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
0
votes
0answers
110 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
0
votes
1answer
76 views

Better way to store user authentication on phone app

We are creating an app and registration of user happens in following way. User sends via app: email-id/phone and username. Server sends a pin to enter in app via phone/email. User enters the pin in ...
0
votes
4answers
110 views

Recommendation for identity system

I want to develop a system, something like a comment system for a website, that ensures I know who is posting comments. The content that is exchanged is not valuable and does not need to be encrypted, ...
0
votes
1answer
288 views

USB Token Authentication Security Issues

First of all, I should mention that I read this thread and it was useful in my case, but I need more comments and reviews about this authentication method.USB Token authentication which I want to talk ...
0
votes
2answers
454 views

When I reset my password for my Microsoft account, how do they know what password I've used before?

Assumption used: all password that I've used have been salted with some random elements before hashed and stored somewhere in their database. If my previous password exists only as salted-hashes in ...
0
votes
2answers
352 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
0
votes
1answer
135 views

Using encrypted data in session key instead of random

I am writing a service-oriented (REST) application that is (nearly) totally stateless: it can authenticate by API keys, but for web UI it uses the session where it stores nothing but an authenticated ...
0
votes
2answers
128 views

Can session data be manipulated without access to source code

When implementing a web-based application, how secure are any session variables against manual manipulation beyond the scope of my code? i.e. when a user is authenticated, if I were to initialise a ...
0
votes
2answers
299 views

How to detect authenticity Of Client and Server Certificate?

How its possible to detect authenticity Of Client and Server Certificate. For example, If server A has certificate and someone C stolen its certificate and send it to B then How we decide that it's ...
0
votes
2answers
2k views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
0
votes
0answers
753 views

Why do you need to login after you change a password? [duplicate]

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
0
votes
1answer
102 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
0
votes
0answers
51 views

Can double encryption with different key increase the security? [duplicate]

Encrypting the file using same encryption algorithm using different Keys can increase the security or not?
0
votes
1answer
69 views

Relative costs involved in making changes to the current organisational security

I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures". Am I to compare the cost ...
0
votes
2answers
732 views

What are RealVNC 5.0 Authentication Protocol Security Limitations?

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
0
votes
0answers
22 views

Facebook Login security concern with the javascritp JDK [duplicate]

Possible Duplicate: Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint? I have some real concerns about how to use facebook login for my wabb-app. I have a ...
0
votes
0answers
79 views

Pages restricted to certain IPs, safe? [duplicate]

Possible Duplicate: In what scenarios is relying on source IP address as a security control acceptable/unacceptable? If a website has a page which only renders for certain IPs, is there ...
0
votes
1answer
119 views

WLAN Router authentification [duplicate]

Possible Duplicate: How can I ensure that I connect to the right wireless Access Point? Is it true, that WLAN routers aren't authenticated by clients? The only "authentication" is SSID and ...
0
votes
0answers
287 views

Is there software available for two-factor, biometric authentication to the OS?

Many fingerprint readers and other biometric authentication devices come with software for single-factor authentication to the OS. Is there any third-party software (F/OSS or otherwise) available for ...
0
votes
1answer
190 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
0
votes
1answer
122 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
-1
votes
2answers
107 views

Log in security - saving a session [closed]

I am creating a log in system. The easiest system would simply check a database for a log in and password, then same a session var which states login=true I am interested in other things that I can ...
-1
votes
4answers
184 views

How secure is this login page? [closed]

Unfortunately I cant link to the page (it internal). But I can describe it! This is a lightspeed systems policy enforcement login page (content filter). The page is http and there is no iframe with ...
-1
votes
1answer
3k views

How can I avoid sending passwords in plain text when logging into a website?

Suppose that I login to a website. When I type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can ...
-1
votes
2answers
866 views

How can Facebook 2FA mechanism be hacked? [closed]

two-factor authentication process that uses one-time random code,I think season hijack can be used, I would like to know if there are more techniques to crack it. With season hijack, I think that if ...
-1
votes
1answer
59 views

Is telling user that he is already signed in while signing up vulnerable?

I am making a site's authentication system in which the sign up form isn't located at index and it isn't going to be at index. If a user is already signed in and wants to fill sign up form, the script ...
-1
votes
2answers
109 views

user identity certificate

I want to create a new scheme for user identification, like X.509 certificates, but not X.509. Is it possible to use this new certificate over the existing Internet? and if yes, what are basic ...
-1
votes
2answers
7k views

Want to authenticate oracle login using encrypted password…how to?

We are connecting to Oracle using korn shell scripts, which use sqlplus to connect to Oracle. The Oracle database is on the same Solaris box. Currently, we are storing the Oracle user id and ...
-1
votes
1answer
177 views

About important hacks in history [closed]

I would like to know how important hacks happened, because I can figure out how they hacked a website but I can't figure out how did they hacked into NASA International Space Station source code. Or ...
-1
votes
1answer
56 views

What are relation between security services? [closed]

message confidentiality message integrity message authentication non-repudiation The 4 services are related in the sense that one services often implies/provides another. Indicate for each service ...