Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

4
votes
3answers
617 views

Security for home server, wiki

I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, ...
3
votes
2answers
958 views

Efficient and simple way of securing home pc with hardware token

I am looking for a simple but reasonably safe way to secure my home pc (and laptop, nas, etc.) with a hardware token. I would like the system to be secure, but practical enough to be used on a day to ...
6
votes
2answers
258 views

What to consider when generating random code as part of two-factor authentication?

I want to write a patch for a two factor authentication system that someone else has started. The code is a module for a PHP content management system and sends an SMS message to a user's phone, after ...
2
votes
1answer
421 views

Tomcat IP restriction vs Two Legged OAuth

We have a server side API that is completely REST based. We are coding to secure them with two legged oAuth type authentication. We are planning to iPhone and Android apps in the future, but for now, ...
5
votes
3answers
5k views

Are fingerprint scanners easy to bypass?

Thinking about adding a fingerprint based authentication layer, but then I recalled the MythBusters beat fingerprint security system episode -- is this a common issue, and if not, how do you tell if a ...
5
votes
2answers
2k views

How does multi factor authentication modify the AD authentication process?

I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication. Possible things that might have to be modified: Active Directory / Domain ...
2
votes
1answer
123 views

Should the email server/application be protected by 2 factor authentication? What applications should be protected?

When should email be protected by 2 factor authentication? Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it ...
66
votes
7answers
21k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
4
votes
4answers
432 views

sha512 as no-login-necessary token

My site has a news subscription system. When an item is updated, a notification email goes out to everyone subscribed to that item. You can un/subscribe via a form on each item's page. I wanted to ...
9
votes
2answers
958 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
3
votes
2answers
383 views

Computer-level logging by financial institutions

I am looking for the best approach to recognizing a specific computer and saving that computer as a "safe" login machine. My intuition points me to using cookies, but what value do I store in there to ...
3
votes
1answer
804 views

DRY API Authentication Design Between Services

I am creating an API service that is going to require authentication. this will be the first part of a project that will include a front-end service for my website, and also open up the api for 3rd ...
0
votes
1answer
883 views

PAP and CHAP implementation using Java

I want to implement PAP and CHAP based authentication in my Java project how can I implement ? is there any API available in Java for using that protocol ?
2
votes
1answer
737 views

Token Based Authentication & Pass-the-hash Attacks

Do token-based authentication solutions (such as RSA SecurID) mitigate tools like incognito and/or pass-the-hash tools?
2
votes
2answers
394 views

Does secure remote password verifier transmission need to happen out of band?

With relation to the necessity of a verifier being transmitted from the client to the server prior to any handshake steps, I was wondering how this is supposed to happen securely? To me this seems ...
7
votes
2answers
179 views

role based site security - the nuclear missile condition

So I'm in the process of working on part of our new role based site security system and have come up to the "nuclear missile" condition. The system is based around the idea of grouping, with the ...
11
votes
6answers
13k views

Difference between authentication and identification [Crypto and Security perspective]

I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification. ...
2
votes
1answer
244 views

Is 90 day expiration for unique URL too long?

A web application I've been developing has a new use case that has me searching for something easier than username/password authentication. Current users don't sign up for the service themselves ...
6
votes
3answers
440 views

What is the most secure way to lock a Linux Distros Desktop?

So it's an everyday thing... people don't want to turn off their computer while their going out to the toilet..., etc. So they hit "ALT+CTRL+L", and the GNOME-screensaver locks their Desktop. After ...
2
votes
2answers
606 views

Restrict user login to a specific machine

How do you restrict user access to a corporate web site to a particular machine ? including the following conditions : Each user is meant to use his credentials ONLY from the assigned machine. The ...
31
votes
5answers
6k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
1
vote
1answer
1k views

How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
23
votes
7answers
7k views

How to prevent cheating (extra votes) in online contests?

Mitigating Cheating & Voter Fraud in Online Contests… We run online contests of various sorts that involve users voting on entries (usually one vote per user per day). The prizes range from ...
3
votes
4answers
2k views

Can SMS text messages be used to verify a person's unique identity through a short code system?

We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
4
votes
4answers
1k views

Is this non-cookie based session scheme horribly vulnerable to some attack?

I am working on a large web application that runs entirely within a single web-page. For various reasons we do not want to use cookies in this web application, at all, but we need to keep track of ...
3
votes
1answer
570 views

Apple Developer Account Hacked?

I just did a fresh install of Snow Leopard on a newly-formatted hard drive. Logged into the iPhone Developer Page with Google Chrome (latest build) here: ...
2
votes
2answers
3k views

Synchronous and Asynchronous physical security tokens: which is stronger? pros/cons?

I'm thinking about the differences between physical authentication tokens such as RSA's synchronous physical tokens or asynchronous challenge/response, like Google's gmail direct-to-phone codes. At ...
4
votes
1answer
740 views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
5
votes
2answers
3k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
7
votes
4answers
7k views

How secure is Windows Auto-Logon?

Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question. The question is, when I enable auto-logon for my Windows 7 box, will there ...
3
votes
1answer
260 views

Should you have full account access when you forget your password?

Imagine the following scenario: I go to login to MyApp.com, but realized that I forgot my password. I request a new password sent to my email. The email arrives with a link to change the password ...
55
votes
7answers
9k views

Are passwordless SSH logins more secure?

I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
2
votes
2answers
3k views

Is it safe to transfer Facebook access token via TCP?

Is it safe to transfer Facebook access token via TCP? What is the worst that can happen if someone gets the token?
9
votes
4answers
878 views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
3
votes
1answer
459 views

Security for a low latency online multiplayer game

I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
7
votes
2answers
3k views

ssh public/private key pair

I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
-1
votes
1answer
919 views

IIS won't forward the logged on user credential to webservice request?

Ive enabled Windows authentication in my IIS. for the sample lets assume my Active directory username is \domain\John My task flow is like that : Iis won't forward the loged on user credential ...
1
vote
3answers
890 views

Three Message Authentication Protocol

I have a protocol where "A" initiates communication with "B". "B" then sends a challenge to check if "A" is really "A". "B" does not remember sending the challenge so "A" has to respond by sending the ...
6
votes
2answers
276 views

How should hospitals handle the use of sharing credentials to access sensitive information, especially in critical situations?

Most organizations today hold individuals accountable for their actions on systems and networks by unique user IDs and passwords. However, imagine working in a hospital environment where access to ...
5
votes
2answers
528 views

System for Mutual authenticaion and confidentiality

I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
7
votes
1answer
545 views

OpenPGP Encryption / Decryption Process Using GnuPG

I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
8
votes
2answers
2k views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting ...
2
votes
1answer
109 views

Is there a drawback for local log in compared to server log in?

For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have ...
5
votes
2answers
940 views

What flaws lie behind HttpContext.Current object i .NET?

I'm into extend a authenticating service and like to ask about the security perspective of HttpContext.Current. Let say you have a authentication serve websites / wcf and such (where http is ...
5
votes
3answers
4k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language ...
33
votes
5answers
13k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
7
votes
3answers
3k views

Why banking websites always ask me to authenticate my PC even after I'd chosen to “Remember my Computer”?

Why banking websites always ask me to authenticate my PC even after I'd chosen to Remember my PC? This is the case with all banking websites
1
vote
1answer
503 views

What does a Yadis / XRDS discovery session “look like” to the end user? How does it work? Is it relevant?

I can't wrap my head around how Yadis / XRDS would be used by a typical end user, or how it works so transparently? Considering that this technology isn't adopted by mainstream IDPs that makes me ...
7
votes
1answer
694 views

Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?

I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages. ...
10
votes
3answers
365 views

Is there any conceivable reason to prevent a password change in an authentication system?

I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...