Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
113 views

JWT for email validation of an account

I am thinking of using the this registration flow for my site: 1) User registers by entering email and password. 2) Enter the email and hashed password into my database 3) I then construct an ...
0
votes
1answer
88 views

QR-code based credential retrieval?

This is a sort of design review question that I'm hoping is suitable for this site. I am designing a system that uses a cloud service to establish a secure connection between a PC and a mobile ...
0
votes
1answer
146 views

Tomcat Client authentication

I want to make sure that my webapp is secured: I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed). ...
0
votes
1answer
54 views

Would Poly1305-PBKDF2 be secure

I have a Poly1305-implementation (not Poly1305-AES) in my library. The difference: Poly1305-AES uses a key and a nonce and then uses AES to generate a one-time-key from key + nonce. This is ...
0
votes
1answer
1k views

FreeRADIUS EAP TLS Authenticate based on client certificate CN

I'd like to run FreeRADIUS for EAP TLS authentication but instead of running my own Certification Authority I'd like to use StartSSL. I've setup EAP TLS with StartCom as the only Trusted Root CA and ...
0
votes
2answers
86 views

Is PIN-protected token with login certificate a two-factor authentication if the token is controlled solely by the user?

I know it isn't since the service the user is authenticating to cannot check the PIN correctness or existence. I need, however, to explain this to people who are convinced this actually is a ...
0
votes
1answer
89 views

Google Accounts login - is it good enough for financial services?

I am wondering - is using Google Accounts login (in a setup similar to this) secure enough for financial services (you can assume that if someone logs into your account, your money gets stolen)? On ...
0
votes
2answers
173 views

Is CAPTCHA necessary when I use token?

I wonder is it a good idea using captcha when using token on login page? I think it's impossible for robots to mess with login page because token changes on every request. Thanks.
0
votes
1answer
62 views

MD5 before PBKDF2 on legacy software

I am mantaining a legacy software that uses MD5 in the following way: The client asks for a 16 byte salt when authenticating an account. The server generates a 16 byte salt, links it to the account ...
0
votes
1answer
161 views

Security tradeoffs while designing a mobile Web Service API

I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps. It is an API which tracks users' locations so yes, the data is reasonably sensitive. ...
0
votes
1answer
142 views

How Google Authenticator in Android mobile identifies this is the right SSH server?

I am new to Google Authenticator mechanism. I gone the basics of mechanism but I couldn't understood what logic behind that to make a connection to the Linux machine. I have a Linux which have no ...
0
votes
1answer
546 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
0
votes
3answers
157 views

Two factor authentication(Mobile)

Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
0
votes
1answer
193 views

Mechanism used for offline authentication of software

To prevent user from downloading bootleg copies of software , users often have to enter a string of hexadecimal numbers which would be used to authenticate the user. I think the basic idea would be ...
0
votes
1answer
77 views

Client authentication [closed]

Assume a server which offers some information which must not be exposed publicly. A client of this which may be e.g. a windows service (or at least something executing headless) needs to access the ...
0
votes
1answer
66 views

How secure is internal data on the internet with IP authentication?

I am a app developer and working with another software group at my MEGACOMPANY. Said group wants to put confidential information on the internet and they are very happy with their authentication ...
0
votes
1answer
45 views

Could it be insecure to suggest linking accounts to other identity providers based on their email address?

Let's say I have a site where users can log in with Google+ or Twitter. Now imagine a user called Bob going through the following steps: Sign in to my site using their twitter account. I request ...
0
votes
2answers
70 views

Current standard of authentification

What is the current standard of authentification? I thought it is server and client authentification. But I typed for e.g. https://www.google.com/ and checked the packages in wireshark. And there ...
0
votes
3answers
167 views

When to set security questions for a web application?

For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating. When would we be the right time to ...
0
votes
2answers
840 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
0
votes
1answer
28 views

How to make sure that only files I generated pass?

I have the following situation: I have an app on a User device, and my main server. The app can send the main server pdf-files and jpg-files. Now my problems are: -> What is the best way for the ...
0
votes
3answers
232 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
0
votes
1answer
163 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
1answer
131 views

Why do private networks use both X.509 and User/Password authentication

For example, the school network I am on requires both a name & password to log in along with having its X.509 certificate installed in my browser. Why does it need both? Shouldn't name and ...
0
votes
1answer
270 views

Revoke and regeneration in FIDO U2F / FIDO UAF

One of the benefits of using Software based Strong Authentication apps (e.g. RSA SecurID Software Tokens) is that if the device that is running the Token generation app is compromised or lost, the ID ...
0
votes
1answer
95 views

Mobile Game Auth Token Stolen [closed]

Basically someone sniffed my packets and stole my auth token/cookie for a mobile game I have played on for a year and spent thousands on (crazy I know) and now they are controlling my account through ...
0
votes
1answer
67 views

Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript?

Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication? Is there any ...
0
votes
1answer
501 views

What are the pros and cons of enabling 2 factor authentication on internal user workstations of an organization?

An organization has all the regular controls you can think of for network and systems protection from the 10 security domains. External login access to the organization's services is protected with 2 ...
0
votes
1answer
153 views

Is a Cloud-Connected Door Lock More Secure Than a Traditional Lock and Key?

Now that app based door lock replacements are getting more popular in the market, I'm wondering what the security risks are and why or why not this is more secure than an old fashioned lock with a ...
0
votes
1answer
142 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
0
votes
1answer
294 views

How does the Dell Sonic wall Authentication works?

My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged ...
0
votes
1answer
317 views

How do you log into Amazon Web Services if you lose your phone which has Google 2-factor authentication set up?

And if it is possible, how do you prevent other people from claiming they are you and lost their phone? Amazon only directs you to a page which does not exist. http://aws.amazon.com/iam/faqs/ If ...
0
votes
1answer
71 views

Securing access tokens?

Preface: I have no experience with securing applications whatsoever. I'm building a web app that uses Google Plus authentication to sign users in. My initial thought is to save the access token that ...
0
votes
1answer
81 views

User-friendly public/private manual authentication protocol

I have a remote service which allows users to SSH login to the machine and they're automatically sent to the (command line) application (without access to a bash prompt, for instance). In the course ...
0
votes
2answers
116 views

OTP vs. Keyfile

I have been wondering what are the benefits and cons of using an OTP (one time password) versus a keyfile to, for example, decrypt a keepass database, connect to a server via SSH, or other uses. ...
0
votes
1answer
168 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
0
votes
2answers
55 views

Ubuntu backup to only specific devices

I am looking into setting up a secure Ubuntu server with daily backups to two different external hard drives that will be swapped with the external hard drive that is stored in a safe deposit box. ...
0
votes
1answer
92 views

How to maintain validity of user credentials?

In an example scenario consider that; I am a customer of organisation and I have two separate accounts with two different departments X and Y. I can login in to each department's website by using ...
0
votes
1answer
195 views

Securing login form in a desktop app

I currently have a desktop application which requires the user to have a username and a password. These credentials are stored on a webserver (myserver.com), so when he types the username and the ...
0
votes
2answers
174 views

How to transfer securely a file between servers?

Let's say I have two Linux servers. One containing a desktop app database (running on a local network) and a webserver. I want to automatically transfer each hour a database file (with a size of a ...
0
votes
1answer
108 views

Authentication of temporary worker without a badge (physical security) [closed]

In our company we have a procedure to verify internal worker but we cannot use it for temporary worker. We cannot use badges and because of privacy reasons we cannot use any photos. Is there any other ...
0
votes
1answer
1k views

security in banking app with 4 digit pin code and social security number

The new banking app (for norwegian bank Gjensidige bank) for my android handset allows me to log in using only my social security number, and a 4 digit pin code. The social security number in norway ...
0
votes
2answers
3k views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
0
votes
1answer
143 views

Single sign on - is this a secure way to log in?

I am fiddling about with a sort of single sign on procedure. Let's say there is site1 and site2 and both use an SSL certificate. Users are signed in on site1. I was wondering what the experts think ...
0
votes
2answers
202 views

Showing CAPTCHA

I'd like to show a CAPTCHA to prevent brute forcing attempts, but I was thinking of showing it whenever a user fails for an invalid username/password combination after X attempts, regardless of ...
0
votes
1answer
443 views

How can I handle user authentication and sessions in my app?

I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. ...
0
votes
1answer
1k views

Security with Single Page application

I am creating SPA application using Angular. This will serve my two purpose for middle layer on mobile as well website. Now trying to security my application from XSS, CSRF and also wanted secure ...
0
votes
2answers
239 views

How does HTTP Basic Auth persist across pageviews?

I am familiar with the basic workings of HTTP Auth, but how does it keep track of authentication between page views? I see there is no cookie created when the initial authentication takes place.
0
votes
1answer
117 views

Mobile authentication

I'm currently working on an Android app in which I want to authenticate someone against an REST API. I want to do this as secure as is (cost-)effective/possible/userfriendly. I've been looking around ...
0
votes
1answer
179 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...