Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
0answers
150 views

How does disabling sign in upon confirmation make devise any more secure?

Referencing reasons given in this question http://stackoverflow.com/questions/18655334/avoid-sign-in-after-confirmation-link-click-using-devise-gem Devise does not allow the immediate sign-in of a ...
1
vote
0answers
48 views

Some very (very) strange issues in wpa handshake [closed]

I have a router (actually it is an android phone as an access point) with wpa2 AES encription, and I'm trying to crack the password with a very small word list. Strangest thing is, when I use ...
1
vote
0answers
57 views

Best way to authenticate for Funding balance with API call [closed]

I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API. What would be a good ...
1
vote
1answer
211 views

Domain socket authentication as in MySQL and PostgreSQL secure?

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure? The background for my ...
1
vote
0answers
344 views

NFS IP spoofing

I am using VirtualBox: where the guest is an Arch ISO and the host Windows/Cygwin or a generic Linux. For sharing host folders, VB native shared folders is not an option (since the setup requires ...
1
vote
0answers
133 views

Security considerations for RESTlike HTTP API of an embedded system

I'm designing a HTTP service for an embedded device and wondering if the following security concept is good enough: SSL(Up to Version 3) is enabled by default, TLS is not by limitations of the ...
1
vote
0answers
127 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
1
vote
0answers
53 views

Does Ally Bank's trusted image system actually make login safer? [duplicate]

Ally Bank uses a 'trusted image' system to supposedly make login more secure. I can't find evidence that this is standard practice, so I'll explain it. When creating an account, you choose an image ...
1
vote
0answers
315 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
1
vote
0answers
26 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
1
vote
0answers
217 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
1
vote
0answers
179 views

Security for message queue in ActiveMQ

I am using ActiveMQ and WSO2 for my application. I need to protect my queue to restrict posting of messages by anonymous users(I need to protect my queue with some password). I know, there is a ...
1
vote
1answer
1k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
1
vote
1answer
100 views

Amazon Turk - How secure is it? Strange behavior

I just had this really strange experience with Amazon Turk, where suddenly I was logged into someone else's account. I was logged into the company's Turk account, left my computer for a while, ...
1
vote
0answers
336 views

Can the device seed be recovered from the iPhone/Android RSA SecurID app?

The Windows RSA SecurID app allows the device seed to be determined and cloned from one machine to another (see this blog post). Do either the iPhone or Android RSA SecurID apps suffer from the same ...
1
vote
0answers
222 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
1
vote
0answers
340 views

Client-server authentication protocol suggestion

I'm designing an authentication methods for my client/server system consisting of: a windows desktop client application (.NET) windows/linux servers (C++) one "security server" which authorizes the ...
1
vote
1answer
109 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
0answers
104 views

Considerations when implementing a key based SSH-like auth scheme

I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
1
vote
0answers
256 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
1
vote
0answers
307 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
646 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
222 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
1
vote
0answers
63 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...
1
vote
0answers
133 views

Yet another newbie security paranoid user authentication [closed]

I am building yet another website which requires user and session authentication. This time I want to be complete security paranoid and actually care if the passwords or sessions are stolen. I have ...
1
vote
0answers
243 views

How should I authenticate my SPA frontend with my API since I´ve got no authentication process in the site?

We are designing a web site for selling financial products online. The following is a high level description of the components: Our frontend will be a SPA built with AngularJs. The frontend will ...
1
vote
0answers
256 views

Does Diffie-Hellmann (DH) key exchange protocol lower Off-The-Record protocol (OTR) security level?

Off-the-Record protocol employes Diffie-Hellman key exchange protocol (DH). DH protocol does not provide authentication of the communicating parties and, according to many sources, is vulnerable to ...
1
vote
0answers
819 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
1
vote
0answers
2k views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
1
vote
0answers
980 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
1
vote
0answers
238 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
0answers
108 views

how to implement 4-legged authentication for mobile application?

I have a REST web service which already implements oauth authentication mechanism via browser. I would to expose my API to a number of mobile clients programmed by third parties. In this scenario 4 ...
1
vote
0answers
159 views

Putty Event Log

Can anyone explain me the Step by step process of Key Exchange that takes place while accessing Linux machine using Putty ? I found the Event Log of Putty but the Various Key Exchange didn't make very ...
1
vote
0answers
28 views

Get Service_key in the course of kerberos authentication [closed]

Built environment 1) Exchange server: The operator system of Exchange server is Windows Server2008R2, We configured it as Active Directory (primary domain controller) used for client authentication (...
1
vote
0answers
63 views

How to get Service_key and the corresponding function call interface from the Samba source TGS_REP part

1, My existing configuration environment are as follows: (1), Server_side, Redhat5.5 Enterprise with samba4.0.0 installed, Ip Address: 5.5.5.149; domain name: EXAMPLE.COM; (2), Client_side: windows ...
1
vote
0answers
61 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
1
vote
0answers
97 views

Is what flexi_auth does with its use of its $this->auth object good practice?

I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used Like this: `$this->auth =...
1
vote
1answer
735 views

Google's Mobile Authentication for REST APIs

So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using PhoneGap/...
1
vote
2answers
2k views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
1
vote
0answers
183 views

Remote desktop connection different networks password non VPN [closed]

I'm looking for a solution to bring support to users from a big network to other users into little networks. The idea is to keep control of content (no VPN). Also it's important that always users who ...
1
vote
0answers
439 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
1
vote
0answers
63 views

What are the security implications of (not) expiring login screen session? [duplicate]

I manage a single sign on solution (CAS) for a group of related web applications. The CAS specification states that Login Tickets are associated with every login attempt which can only be used once. ...
1
vote
1answer
518 views

How can I allow local pop3 but enforce remote pop3s on my ubuntu/postfix/dovecot OS/MTA/MDA

I would like to allow local clients to access email via any of pop3, pop3s, imap, or imaps if they so choose but restrict remote clients to pop3s and imaps only, simililarly to how I already do for ...
1
vote
2answers
865 views

What security issues are there when reading cookie with .htaccess?

I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
1
vote
2answers
923 views

What are RealVNC 5.0 Authentication Protocol Security Limitations?

In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
1
vote
1answer
893 views

Public web server and AD- based Kerberos authentication

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses (...
1
vote
0answers
315 views

Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]

I have installed openssl and now the rsa_test.c is running fine. What I want to do is: Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey. The public key contains the ...
1
vote
2answers
95 views

Can You Prove a Chat Happened Online? [closed]

With so much communication happening online nowadays the needs to verify information is obviously an essential. However, let's say something was said in an online chat room/or private chat client, ...
1
vote
2answers
248 views

TCrypto - Comments about design decisions I made?

I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
0
votes
3answers
819 views

Securing REST API with HMAC and basic auth

I was wondering if giving users choice of a method for securing their access to API would be a good idea. Background: We are creating and deploying applications for our customers, which help them do ...