Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
142 views

MySQL authentication, how to pad the 20-byte salt

Im authenticating with a mysql server with the authentication method listed here. I observed the salt and hash using wireshark, and I know the password, but I am having trouble reproducing the hash I ...
1
vote
1answer
439 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...
1
vote
2answers
149 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
1
vote
1answer
201 views

Is there any way to restrict multiple access to my server at the same time using one client certificate?

My Server is Windows 2008. Mr. X is accessing my web server using Mr. X's certificate. In that time, an outsider is also trying to access my server using Mr. X's certificate (somehow he got it). Is ...
1
vote
1answer
286 views

Use TLS certificate as both server and client?

For a federated server-to-server protocol with domain-based identities, I am thinking of using TLS client certificates as authentication mechanism. I figured that re-using each peer's TLS server ...
1
vote
1answer
63 views

If a site says its API for login can't be made available for “Security Reasons” should I be worried

Stack Exchange API 2.2 is finally out, (Yay!) Reading through the linked blog post, i notice the line: Login methods that don’t use OAuth can’t be made public for security reasons. Is this ...
1
vote
1answer
91 views

Transport Layer Security for multiple persons

I know that TLS protocol is used to authenticate two persons and when a secure channel is established we can perform a key exchange. My question is if TLS can be used to establish a secure channel ...
1
vote
1answer
331 views

Can I use a CDN for static content without sacrificing SSL keys?

I would like to use a CDN for the static content of a website. But obviously I do not wish to share my SSL key with any external service. What are my options? An ideal solution would be to link to ...
1
vote
4answers
145 views

Are there any web services which use any other form of authentication, than passwords? [closed]

Out of curiosity and interest I was wondering if anyone had come across any web based services which offer users other forms of authentication, other than the standard password or PIN? Or if ...
1
vote
1answer
125 views

Certificate Mapping in IIS

When pasting the certificate blob in the configuration editor in IIS 7.5 for one on one authentication, is this the server certificate or the client certificate?
1
vote
3answers
1k views

Can Paypal be used to verify a user's identity?

As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments. I also noticed that Paypal offers a "...
1
vote
1answer
345 views

What is the purpose of Rb in the 3rd step of the 3-pass mutual authentication in ISO/IES 9798-2?

Recently I am studying ISO 9798-2 Three-pass mutual authentication. There are 3 steps, as following: B -> A: NB // B sends to A a "nonce" value NB A -> B: {NB||NA}K // A's identity is proven ...
1
vote
1answer
900 views

Secure API access over SSL using oauth token

On the project that i'm currently working, we authenticate the clients by username and password. In this system each user has a key which is calculated from his password. However, we want to provide ...
1
vote
1answer
615 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
1
vote
1answer
284 views

Do I need logging enabled in my rules in IPFW for sshguard-ipfw to work/blacklist ip's?

From the FreeBSD handbook: Even with the logging facility enabled, IPFW will not generate any rule logging on its own. The firewall administrator decides which rules in the ruleset will be logged,...
1
vote
1answer
204 views

What manufacturers create OATH HOTP cards now that InCard Technologies is no longer in business?

I purchased the following OAUTH HOTP card from Verisign. I'm intrigued by the security possibilities that this form factor provides and what customizations to the circuit logic are possible. On ...
1
vote
1answer
509 views

What is the origin of the three factors of authentication?

The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the ...
1
vote
1answer
988 views

Browser cache, cookies, active logins and other data

This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure. I'm seeking to know how secure it is to let the ...
1
vote
1answer
1k views

iOS auth/auth with a REST Webservice

we're currently in the design phase of a new "Gateway-Server" which we want to develop. Our server has a REST-Service. My task is to find viable options to protect the access to the aforementionend ...
1
vote
1answer
99 views

Should Framebusting be used (not used) on an IdP login page?

I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary. On the other hand, if I ...
1
vote
3answers
178 views

Central authentication

I am designing a system composed of several services. Some can be hit only from inside our network and a few can be hit externally. One of these services is a "login" or "authentication" service. My ...
1
vote
2answers
899 views

Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?

It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
1
vote
1answer
695 views

RADIUS proxy chains

RADIUS is a widely deployed remote authentication protocol. I'm looking here at its use in wireless roaming. The RADIUS protocol allows for proxies and chains of proxies: |CLIENT|<->|Access ...
1
vote
1answer
574 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
1
vote
1answer
2k views

How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
1
vote
1answer
529 views

OpenSSO and Basic Auth together

Our project is moving towards OpenSSO, but we have some CGIs that are accessed via web services. For example, one CGI locates files on the server and supplies them to the client. I understand that ...
1
vote
0answers
12 views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
1
vote
0answers
17 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
1
vote
0answers
59 views

Azure AD B2C vs Auth0

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct comparison?...
1
vote
0answers
44 views

How can I authenticate securely to an internal website from an iPad without an strong password?

I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities: Credentials stored in the iPad (like Gmail credentials). Using ...
1
vote
0answers
32 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
1
vote
0answers
27 views

Dynamic Key Management in WPA through Radius server

Can anybody tell me in detail (or provide good links), how the dynamic key management is done by the authentication server in WPA? In other words, let's say I gave my credentials to the authentication ...
1
vote
0answers
41 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
1
vote
0answers
46 views

Vulnerabilities of using a token based authentication such as this

I'm developing a backend REST API for one of my mobile apps. I'm looking to create a token-based authentication system that would allow for a persistent login and I'm wondering if there are any ...
1
vote
0answers
26 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
1
vote
0answers
35 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
1
vote
0answers
75 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
1
vote
1answer
66 views

Secure WebApp authentication

I know there are many questions about hashing passwords on the client side out there, but none of them, which I found, address my use case. My app will be end-to-end-encrypted and it is not an option ...
1
vote
1answer
101 views

Is it secure to refesh a JSON Web Token (JWT) auth token using the user credentials?

As I understand the answers to this question JWT: Is refresh an expired token is a good strategy?, one should use a refresh token to refresh an expiring auth token. Since my web app should be ...
1
vote
0answers
38 views

Migration problem between different machines using TrouSerS TPM library

My question coincides with the question posted by Maximiliano Ezequiel. Below is a question. I could make migration process work in one single machine. I can: Export SRK public key. ...
1
vote
0answers
73 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels (...
1
vote
0answers
29 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
1
vote
0answers
30 views

Change NTLM hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass Windows login? For example, I have the NTLM hash of a Windows machine and I have physical access. Is possible to write the NTLM hash in ...
1
vote
1answer
136 views

Secure HttpOnly Cookie or Header field for auth token securing an API?

I have an API to secure. There will potentially be two types of consumers of this API - our own Single Page Application, and third party services that will integrate with it. I have read that in ...
1
vote
0answers
37 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
1
vote
0answers
170 views

Check if user is logged in on other ADFS authenticated site

I've been looking around for this specific situation, but so far no good.. We have multiple websites that use ADFS WSFederation, and we would like for a user to always pass through one, before being ...
1
vote
1answer
33 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
1
vote
2answers
165 views

Pin delivery: SMS, mail, or pin mailer?

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists: Pin mailer (this seems to be standard according to ISO 9564-1) SMS Email Email ...
1
vote
0answers
49 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
1
vote
0answers
50 views

How Do I Create a Production Client Authentication Certificate for Azure Key Vault?

I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here. The samples do a great job of explaining how to make a self-...