Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
2answers
94 views

Website doesn’t always log me out – Privacy concern or am I overreacting?

I’ve been applying to for some jobs and use one certain careers page somewhat regularly. I’ve started to notice that I don’t always get logged out even if I do click “log out” and see a message that ...
2
votes
3answers
153 views

Can authentication in social networks through VPN defeat the purpose of the latter?

If a person uses VPN and authenticates herself to some social network through the VPN, doesn't she lose her anonymity for as long as the VPN session is used ? By losing her anonymity, I mean that her ...
2
votes
2answers
77 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
0
votes
2answers
45 views

Email rejected by the server [closed]

Emails from site such as Gmail and Yahoo are rejected from secureserver.net server and treated as a spam. Can you help me?
14
votes
4answers
383 views

Does two-factor authentication reduce the need for a long password?

I've recently enabled 2-factor auth on a number of web apps, mostly using Google Authenticator. Does this mean that the importance of a strong password on each site is reduced? I would prefer to use ...
28
votes
7answers
4k views

Why isn't open WiFi encrypted?

As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
24
votes
3answers
1k views

Is authentication using personal pictures more secure than passwords?

Statement 1 There is a start up called PixelPin. On the web site it reads: The PixelPin solution is simple and quick to use, yet very secure. PixelPin eliminates the traditional alphanumeric ...
2
votes
2answers
227 views

Should login pages be cacheable?

I'm considering the relative benefits/disadvantages of making a login page cacheable. Note that here I'm referring to the page containing the form into which the user enters their username and ...
2
votes
2answers
115 views

Ways to authenticate client with a server

I have an app that sends an encrypted message to the server, with the sender and recipient username attached. The usernames are each linked to a unique device ID that allows messages to be sent to ...
1
vote
1answer
34 views

Is it possible to use AH in transport mode on an IPSec channel with mediation?

I understand that it's not possible to have Autentication Header with a regular NAT, because it messes with the IP header protected by AH. How about proxies? Do they change anything in the packet? ...
0
votes
1answer
93 views

Building an VM with Vagrant and connecting with ssh+2FA to protect a bitcoin wallet?

I would like to try to build a Virtualbox image to use with Vagrant. This is the features: Login with SSH + 2FA (Google Auth) No X No internet connection Copy unsigned transaction, sign it and ...
1
vote
2answers
99 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
4
votes
4answers
391 views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
1
vote
2answers
302 views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
4
votes
2answers
142 views

Is authorisation with token secure?

I have a general security question: Let's say there is a client-server application with authorisation by login and password using a secure connection between server and client (https). User can have ...
0
votes
2answers
401 views

Attack on old OpenSSL/Debian vulnerability doesn't work on a vulnerable box

DISCLAIMER: The vulnerable box that we are testing on belongs to us, and all the actions are under surveilence, hence we are not doing anything illegal here. I'm testing a Ubuntu 8.04 box, it's known ...
2
votes
4answers
187 views

Why is it dangerous to stay logged in as root for an extended period of time?

I found the following general advice from WikiHow in an article on changing password: It is very dangerous to stay logged in as root for an extended period of time. Log out immediately after ...
1
vote
4answers
121 views

search CA for someone's public key

do CAs offer service wherein an application can request someone's public key? i am trying to do this but i am unsure if it is correct (suggestions of better ways to do it will be most appreciated): ...
4
votes
4answers
194 views

Why change password? [duplicate]

Why are there recommendations to change passwords with certain intervals? If I have a good password, e.g. a long wrongspelled odd sentence with a couple of special characters thrown in, why is the ...
0
votes
1answer
63 views

Advantage Mutual authentication over PSK [duplicate]

I have a client - server setup with TLS communication. I want to be sure of mutual authentication. The safety that certificates can offer assumes that the private key that links to the certificate ...
2
votes
1answer
71 views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...
0
votes
2answers
183 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
1
vote
2answers
598 views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
0
votes
3answers
77 views

Can I trust profile data a 3rd party auth provider send to me?

This question may be related to this one, but I think we need to be sure. My website implement login via OpenID (or Google, or Facebook, etc.). On my website, authorization is based on user email ...
14
votes
5answers
717 views

Safe way to authenticate (multi-factor authentication?) while being monitored?

(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.) ...
8
votes
6answers
516 views

Is there multi-factor authentication for machines?

Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
14
votes
10answers
2k views

2 factor authentication - cost effective solution for a web startup

My local bank uses a 2 factor authentication where customers key in password AND a One Time PIN delivered via SMS to mobile phone OR from a security token device. I am doing a web startup in the ...
12
votes
6answers
5k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
0
votes
1answer
113 views

Prevention of netcutter use in the College LAN

I am a student,residing in a hostel,accessing internet,using College LAN,which is protected by Cyberoam Corporate Client authentication,and the bandwidth is equally distributed to all students but a ...
5
votes
2answers
590 views

How reliable are device IDs provided by PhoneGap on Android and iOS?

I have a web application that allows users to add mobile devices to their accounts (using mobile app). Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
25
votes
8answers
2k views

Share certain information only after death

After your death, you want to make sure that a special someone gets a vital piece of information (like the password to your bank account), but: You don't want anyone else to be able to get that ...
1
vote
2answers
87 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
1
vote
0answers
40 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
0
votes
1answer
53 views

What info to log/store about a user login?

Currently I am saving LastLoginAt, LastActionAt, LastLogoutAt, and LastLoginFromIPAddress. I am not so sure about the value of logging/saving details of logouts and IP addresses, as I am not sure of ...
3
votes
2answers
208 views

BOTs C&C channels

Can someone please explain the C&C for bots ? im reading a paper about Android bot , and its explaining something called URL flux as method of C&C . however i couldn't really get it , so ...
3
votes
2answers
437 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
8
votes
3answers
482 views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
7
votes
2answers
893 views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
2
votes
2answers
225 views

Disable local/KVM access on a Linux VPS (allow only SSH)

Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you ...
34
votes
6answers
1k views

Is the concept of Authenticated Anonymity possible?

Or is authentication essentially incompatible with anonymity? If we have the idea that authentication is proving that someone is who they say they are and anonymity is essentially having an unknown ...
10
votes
4answers
6k views

Preventing deauthentication attacks

I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network. I captured and analyzed the network traffic on my Wifi work ...
32
votes
2answers
1k views

Why does Google cripple the 2FA Google Authenticator PAM module?

If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226: R6 - The ...
5
votes
3answers
13k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
1
vote
1answer
127 views

Sharing login session from one website to another?

Given two companies managing two separate websites, the client wants the user to be able to log in to one website, and then click a link to navigate to a certain part of the second website. The client ...
3
votes
1answer
106 views

Should an administrator be able to turn off TFA for a user

We use Google Authenticator and SMS for two factor authentication. Should we allow the administrators of the site to turn off TFA for users? Google Auth uses SMS as backup option but SMS does not ...
9
votes
7answers
426 views

Authencity of information displayed on an untrusted device

Suppose I have a (bluetooth/usb) device which needs to displays information on an external pc/phone. Is there a simple and effective method to garantuee that the information displayed hasn't been ...
0
votes
1answer
54 views

Using multiple hash-functions along the line [duplicate]

I was wondering what the effect on strength/security is If I would use an aggregate of multiple hash-functions. For instance, I don't want to sent passwords in plain text (although it's over an ...
2
votes
1answer
123 views

After having confirmed a computer is infected by a Botnet.

And having found a server IP that is controlling it. How can I find out the log-in credentials this client uses to log in to a IRC channel / server webpage / control panel. I have found out a python ...
1
vote
2answers
243 views

How to write a rock solid TOTP implementation?

I am currently writing a TOTP implementation in PHP (but this applies to other languages as well) and of course want it to be as secure as possible, what should be considered? After reading the ...
1
vote
1answer
685 views

Why is a CA certificate required for EAP-TLS clients?

When setting up clients with WPA2 EAP-TLS, most clients (ie: my phone, my computer) require both a client public/private keypair (for obvious reasons) and a certificate authority certificate. It's ...