Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
64 views

Risks of letting user know if the username is invalid? [duplicate]

I notice most websites simply say "user name or password is not correct", however some will tell you if the user name does not exist. Are there any security risks letting the user know if they ...
1
vote
0answers
94 views

Passive authentication

I am a relatively new developer to advanced information security related features, hence please pardon me for any mistakes. I came across the concepts of passive authentication and active ...
1
vote
0answers
103 views

Steam two-factor authentication algorithm? [closed]

I'm all on-board that Value is recently pushing for two-factor authentication on Steam accounts. I'm not happy that they force you to use the Steam mobile app because both on iOS and Android, it's a ...
1
vote
0answers
27 views

central auth servers and in-app password changing

BLUF: philosophically, when (if?) should (web) services that use a central auth server add the power to change passwords? Simplified definitions, for the sake of this question: Central Auth Server: ...
1
vote
1answer
126 views

SSH Key vs Complex Password with Fail2Ban & Two Factor Authentication

Normally you hear that using an SSH Key is far more secure than using a regular password. However I've been wondering if this statement is really true. Let's say we have the following variables for ...
1
vote
0answers
188 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
1
vote
0answers
49 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
1
vote
0answers
76 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
1
vote
1answer
79 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
1
vote
0answers
28 views

fakeauthentication is working when my belkin belkin router f7d2301 mac-address filtering enabled

Actually i have enabled mac-filtering in my belkin router and the security policy is none and the authentication is open authentication. Iam(attacker) using kali linux. when i done a fakeauth attack ...
1
vote
0answers
33 views

Is our internal SSO design secure? [duplicate]

We use one primary web app that was built internally and 3 other web apps that we did not build but that we do host. I want users to only have to sign into the primary web app, which uses Google auth. ...
1
vote
0answers
53 views

How are FIDO and NSA (Natural Security Alliance) different in biometric security? [closed]

Fido Alliance and Natural Security Alliance both work on certifications of biometric authentication. How are those different / complementary? What are their targets for making business for themselves? ...
1
vote
0answers
144 views

Peer Entity Authentication and Data Origin Authentication services in OSI layers

What kind of Peer Entity Authentication and Data Origin Authentication services are provided in network layer(L3), Transport layer(L4) and application layer(L7) ?
1
vote
0answers
42 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
1
vote
0answers
25 views

Authenticating requests across a two tier application architecture

Consider the following architecture: Users log into a website and issue commands to the website. In parallel, separate software processes ("agents") on different computers connect to the website ...
1
vote
0answers
43 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
1
vote
0answers
186 views

SimpleWebRTC Server Side Authentication for Room Access

I am trying to do some sort of server side authentication to allow only specific clients to join a SimpleWebRTC Room. Right now, any client that goes to the SimpleWebRTC "demo" page can join the ...
1
vote
1answer
36 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
1
vote
0answers
52 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
1
vote
0answers
21 views

Relationship between the validity of license of an accredited CA (certificate authority and the validity of it's certificate? [duplicate]

To more clear, let's see my example: As I know, in Korea, the validity of a CA's license is only 2 years, but the validity of this CA's certificate is 10 years. Why is the valid time of the license ...
1
vote
0answers
66 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : ...
1
vote
1answer
140 views

Are there any simpler ABAC implementations available for big data systems? [closed]

Can any one suggest simpler Attribute Based Access Control implementations available for big data systems like Hadoop, Hive etc? I have checked Apache ranger they dont have any support for ABAC yet ...
1
vote
0answers
62 views

Time Based Authentication

I need a way of authenticating that a file was generated by a particular machine that has a unique ID and a unique random secret also known to the authenticator, as an added difficulty the file ...
1
vote
1answer
30 views

Authentication between to devices where the same password is used on both

I'm writing two applications that are intended for execution on two separate devices. It is similar to a remote desktop solution such as TeamViewer. What follows below is my proposal for an ...
1
vote
0answers
219 views

JWT for User Authentication + Client App Authentication + User Claims Holder?

I would like to switch the security layer of my API from Basic Auth over HTTPS + claims-based infrastructure (w/ claims populated in a delegatinghandler) to a more robust mechanism and support client ...
1
vote
0answers
257 views

How to secure requests to my API from my web widget embedded in third party website

Background I'm designing a web widget for a new SaaS for embedding in a password-protected CMS. This would allow the customer to add something like the following to all the pages in their CMS to ...
1
vote
1answer
202 views

Centralized authorization with distributed service providers

I'm thinking about implementing a single sign on service with a centralized permissions management for a distributed network of service providers (so authentication as well as authorization). The ...
1
vote
1answer
864 views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
1
vote
1answer
317 views

Secure key generation and authentication in PHP

I'm not sure how to phrase this so I'll just explain my scenario and hopefully you can help. I have to create a site that will have 50-100 students all selecting courses they would like to take for ...
1
vote
1answer
140 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I ...
1
vote
0answers
59 views

If I have the cell #. switch ID and name, can I locate an physical address? [closed]

Only a PRO can help me! My husband had an affair, said it was over five years ago and I should not be concerned, ever again. Yet, the result was devastating, medically with cancer. I believe people ...
1
vote
0answers
174 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
1
vote
0answers
63 views

Logging in from one CMS to another

Two websites with different CMS, user should type login & password on one website and needs to be logged in second website automatically. Now i have this method, it works but i want to know - is ...
1
vote
0answers
173 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
1
vote
1answer
244 views

Identify the attestation certificate (X.509) in Fido U2F registration response

I'm trying to identify the attestation certificate (X.509) in Fido U2F registration response as described in fido-u2f-raw-message-formats-v1.0-rd-20141008.pdf document: An attestation certificate ...
1
vote
0answers
234 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
1
vote
0answers
52 views

authentication token not stored in DB

I am implementing a webserver and the guideline I am following suggests: - to create token by a Serializer that takes the IdUser, a symmetric key and an expiry date - provide it to the user but not ...
1
vote
0answers
230 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
1
vote
1answer
246 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
1
vote
1answer
201 views

User Authentication for a public website in 2015 [closed]

I am creating a new website for online shopping in .net and was wondering if i have another option beside Forms authentication to validate the users in a safe and secure way (this has been around for ...
1
vote
0answers
108 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
1
vote
1answer
445 views

Correct auth method using oAuth 2.0?

Been trying to wrap my head around oAuth 2.0, but I'm struggling figure out the correct way to implement it for our system, as there are so many different approaches. Our specifications are: Secure ...
1
vote
0answers
146 views

How does disabling sign in upon confirmation make devise any more secure?

Referencing reasons given in this question http://stackoverflow.com/questions/18655334/avoid-sign-in-after-confirmation-link-click-using-devise-gem Devise does not allow the immediate sign-in of a ...
1
vote
0answers
48 views

Some very (very) strange issues in wpa handshake [closed]

I have a router (actually it is an android phone as an access point) with wpa2 AES encription, and I'm trying to crack the password with a very small word list. Strangest thing is, when I use ...
1
vote
0answers
56 views

Best way to authenticate for Funding balance with API call [closed]

I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API. What would be a good ...
1
vote
1answer
196 views

Domain socket authentication as in MySQL and PostgreSQL secure?

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure? The background for my ...
1
vote
0answers
332 views

NFS IP spoofing

I am using VirtualBox: where the guest is an Arch ISO and the host Windows/Cygwin or a generic Linux. For sharing host folders, VB native shared folders is not an option (since the setup requires ...
1
vote
0answers
131 views

Security considerations for RESTlike HTTP API of an embedded system

I'm designing a HTTP service for an embedded device and wondering if the following security concept is good enough: SSL(Up to Version 3) is enabled by default, TLS is not by limitations of the ...
1
vote
0answers
115 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
1
vote
0answers
52 views

Does Ally Bank's trusted image system actually make login safer? [duplicate]

Ally Bank uses a 'trusted image' system to supposedly make login more secure. I can't find evidence that this is standard practice, so I'll explain it. When creating an account, you choose an image ...