Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
2answers
86 views

Legality of cookie(set by other sites) tracking

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to ...
0
votes
3answers
481 views

How is chase mobile deposit verified? [duplicate]

I read this but it didn't ask the question I want answered. How is Chase Mobile Deposit Secure? What I want to know is how do they avoid accepting a Photoshopped check? When someone gives me a ...
0
votes
3answers
597 views

Is a console application with NT Authority/System rights dangerous?

A developer managed to open a console application with NT Authority/System rights at the startup screen before logging in. From that command prompt it is possible to execute arbitrary programs like ...
0
votes
2answers
753 views

Do Google 2 Factor Auth backup codes work for logging into Google or other sites?

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device. Are these used only to log into Google, or can they be used to log into other sites?
0
votes
3answers
80 views

Is it a good idea to let a database do a password check?

Setup A server running a PostgreSQL database and an Apache with several php applications. Access to db is over the loopback interface. The db contains a table with the username and SHA-512-CRYPT ...
0
votes
2answers
83 views

Access to system32 [closed]

Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
0
votes
2answers
167 views

Computer Security vs Privacy

Probably this is a redundent post but in fact I have been searching online about a precise clear distinction between computer security and privacy. I'd like to know the difference of between them ...
0
votes
1answer
132 views

Protect software from copy [duplicate]

Imagine I wrote some software on .NET which will run on client machine. Is it possible to detect that someone copied my software to different computer? (Assuming my software can connect to a remote ...
0
votes
1answer
189 views

Is the following PayPal Vulnerability a design/implementation flaw?

I am trying to understand the logic behind following vulnerability, I believe this a design flaw not only an implementation. To me the problem with the two-factor authentication service at PayPal is ...
0
votes
2answers
170 views

Is a Windows AD credential combined with AD group membership 2 factor authentication?

We have a requirement for 2-factor authentication for our internal WiFi SSID's. Currently we use PEAP w/ MS-CHAPv2 to pass windows creds through the AP to a RADIUS server (A Domain Controller running ...
0
votes
1answer
45 views

Create mod page for an anonymous website

I developed a website. There is no login section in the website. I didn't want to force people to sign up. Now I have a problem. There are a few .php pages that only I should access. How can I do ...
0
votes
2answers
215 views

Are the Microsoft Windows images found on the internet safe?

Microsoft has stopped offering the Windows images for download. It is now only possible to get the image if one has a key of a retail version of the corresponding OS. The question is now, whether the ...
0
votes
2answers
98 views

Remote administration methods

There is a requirement for users to remotely access one of my corporate servers from internet. Policy wise, i would want them to at least use 2FA for communication,eg VPN Tokens, password+SMS etc. ...
0
votes
1answer
107 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
0
votes
2answers
124 views

Effective Free and Anonymous Web Form Encryption

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates ...
0
votes
3answers
259 views

“Remember me” cookies - did I implement them securely?

I am currently working on a pet project website and I want to implement the "remember me" feature for logins and wanted to know if my procedure is secure. The authentication process basically goes ...
0
votes
1answer
631 views

Challenge, Authentication and session key

I programmed an application on Linux using C, I added an authentication and cryptography layer that's going like this : 1 -client sends connection request. -server send a random challenge to client. ...
0
votes
2answers
562 views

Pre boot authentication for Android phones [closed]

is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
0
votes
3answers
103 views

Access Key In URL - Securing The Unsecured!

I'm having some difficulties doing this the right way (as much as it can go). Some time ago, I've asked a question here, asking for help on how to implement sending an access link through email. ...
0
votes
2answers
166 views

Default user names to avoid

Following this answer on a question about fake users, is there a general list of users which would be deemed to be a common username? The part of the linked answer I'm referring to is Don't use a ...
0
votes
2answers
125 views

How can I make locally stored data unreadable unless connected (logged in) to server?

I have a chat application built in Java. The chat app stores a log of the user Jimmy's chats locally on his machine. I want this chat log to be encrypted so if someone uses the computer (authorized ...
0
votes
3answers
278 views

What is a good way to authenticate a user to websites and applications with a smart phone?

What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be ...
0
votes
1answer
93 views

Does encrypting the message protect it against length extension attacks

Assuming the following HMAC is used : HMACK(M) = Hash(K||M) = H which is "secret-prefix" hashed function. M is the plaintext message , K is the secret key used The ciphertext is generated as follow : ...
0
votes
2answers
576 views

Stateless session cookie and logout

I have implemented stateless session cookie, something along the lines of this article: Demystifying Web Authentication (Stateless Session Cookies) The cookie contain an expiry time within the ...
0
votes
1answer
797 views

HTTP status code for successful login [closed]

I have a web application for testing. It has a login page. For unsuccessful login attempts, the developers have made a custom error page so that the response from the web application shows 200 OK, ...
0
votes
2answers
3k views

Can a mobile number ring if the person has not inserted their simcard into their phone? [closed]

I dialled a cell phone number and it rang but with no reply. I asked the person later why they did not answer and they said the Sim card was not in the phone. In fact, it was in a purse.... Is this ...
0
votes
4answers
319 views

Why must every OTP be unique

All OTP systems that I have observed, send a new OTP every time a user requests for an OTP. (for example whatsapp) Only the latest OTP is valid and an OTP can only be used for X hours. I am wondering ...
0
votes
2answers
3k views

Attack on old OpenSSL/Debian vulnerability doesn't work on a vulnerable box

DISCLAIMER: The vulnerable box that we are testing on belongs to us, and all the actions are under surveilence, hence we are not doing anything illegal here. I'm testing a Ubuntu 8.04 box, it's known ...
0
votes
1answer
403 views

Does PayPal support a backup code for two-factor auth? [closed]

Google and DropBox have backup codes in case you can't get access to one of the devices you have registered. Does PayPal have a backup code?
0
votes
1answer
31 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
0
votes
1answer
63 views

How should I secure my site for logins? [closed]

I am making my very first site, and I need a way, to secure it. Users must be able to post stuff on my site, but I want to prevent throttling my site or using bots to break it. I thought of making ...
0
votes
3answers
87 views

Hostname validation for server-side certificate

I have a reverse proxy which connects to an application which presents a certificate used for PKI based validation. I was wondering if I should enforce the condition that the common name (or ...
0
votes
2answers
71 views

Does X.509 standard claim to check client certificate's expiration date on server side?

Does the X.509 standard claim to check client certificate's expiration date on server side? Consider an expired client certificate in the trust store of web server. If some client tries to ...
0
votes
2answers
96 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
0
votes
2answers
380 views

Diffie-Hellman and MIM attack, and server identity

Diffie-Hellman and MIM attack: When variants of Diffie-Hellman algorithms like DHE, ECDHE etc. are used in SSL handshake for key exchange then can it become prone to man in middle (MIM) attack. ...
0
votes
1answer
81 views

How to authenticate users?

I'm in the scenario that I'm planning a detailed description on "how to securely encrypt files" without putting too much in one Q/A. So, in a file-encryption scenario, what are the possible ways to ...
0
votes
2answers
133 views

Would my protocol be safe?

Suppose I have a protocol like the one below between users A and B; -A sends random nonce G1 to B -B sends back hash_k(G1) and random none G2 -A verifies hash_k(G1), then sends back hash_k(G1 | ...
0
votes
1answer
615 views

PGP Key publishing on MIT PGP Public Key Server [duplicate]

I have a public pgp key, so that users can send me an encrypted message. Ofcourse, any user that wants to send me a message, wants to verify that the public key (s)he has, really belongs to me. From ...
0
votes
1answer
298 views

Is (WEP) shared key authentication secure?

I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds ...
0
votes
3answers
90 views

How SplashData knows about Worst Passwords used by users annually

It is known that every reputable website stores their user passwords into their database after implementing some hashing algorithm on it, and even they don't know what the actual password of the user ...
0
votes
2answers
165 views

Detect Different Machine using Browser [closed]

Some web apps like Facebook and Gmail detect the first time we try to login from a device. Assuming that a browser can't read machine name, and MAC ADDRESS. What kind of variables are they collecting ...
0
votes
1answer
237 views

Techniques for bypassing zero length check in javascript?

I am working on a node.js application that allows users to sign up for accounts using social media. When they do this an entry is created in our database with their email address, and a blank ...
0
votes
2answers
959 views

https login iframe 2014

Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages? Is this not a dupe? It is, but I want current trends because ...
0
votes
2answers
1k views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
0
votes
3answers
119 views

Would this authentication method prevent MiTMs getting the password?

Assuming SSL/TLS cannot be used in this context, is this method secure enough to authenticate someone without someone listening to be able to retrieve the password from the information transmitted. ...
0
votes
1answer
79 views

What is the point of hosting database externally?

Following the breach of avast:forum.avast.com they decided to host the database externally@id.avast.com. My question is, what is the point of hosting the database externally since when you get remote ...
0
votes
1answer
293 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
0
votes
2answers
175 views

RSA for authentication?

Is it possible to use RSA public and private keys to authenticate two computers (or to make sure they're both the right computers)? If so, how? Thanks!
0
votes
1answer
5k views

Use SSH config file with Putty [closed]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
0
votes
1answer
189 views

is there any 100% secure way for form authentication and sending information from client side to server side over internet pages? [closed]

i think for acquiring 100 % secure data transfer between forms on client side and c# code on server side ? my tools : i use IIS as my server and i wonder how can i reach for latest security that ...