Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
2answers
120 views

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
0
votes
2answers
100 views

How secure is the hashing/salting/stretching process as described in this diagram?

Question I was just brainstorming about the hashing, stretching, salting part of the user password in the authentication process and I want it to be as secure as possible (no matter how paranoid that ...
1
vote
1answer
24 views

does openssh support authentication using public key fingerprints?

Cisco have two ways of enabling public key authentication: using the public key and using the public key hash. ip ssh pubkey-chain username <user> key-string <public key> OR ...
4
votes
2answers
76 views

Is CHAP authentication still secure?

Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure? I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in ...
9
votes
3answers
13k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
1
vote
1answer
79 views

How exactly are physically unclonable functions used in authenticaton if they are unclonable?

There is ongoing and quite promising research with prototypes presented about using physically unclonable functions (PUFs) in authentication. If they are practically unclonable, how is a PUF-based ...
0
votes
0answers
18 views

Application specific password tools/papers?

We have our users/groups managed by an LDAP system. We would like to move away from logins to all internal systems using the main LDAP password but still want to centrally manage user accounts. We ...
3
votes
3answers
103 views

What security does the new option for two factor authentication that Google offers enforce?

Google has announced a new option for two factor authentication - a popup message. How does this improve security?
4
votes
1answer
67 views

Any scenario for using both, OpenID Connect and OAuth 2.0?

Since OpenID Connect builds on OAuth 2.0, I am assuming that everything that is possible with OAuth 2.0 is also possible with OpenID Connect. In particular, say that my website stores some ...
4
votes
2answers
2k views

“Extended Protection” primer and implementation guide to prevent MITM

Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks. Does anyone have a primer (or explanation in plain English) what this feature is, ...
22
votes
4answers
9k views

Google Account: implications of using application-specific passwords

In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
0
votes
0answers
18 views

Mifare cards authentication

I have few questions about Mifare authentication: 1) Can you confirm me that the authentication between the reader and the tag is as follow: the reader send the correct key to the tag for the sector ...
3
votes
1answer
56 views

PIN Entry via HTML rendered Keypad

I have a web application that replaces a non-web predecessor. A low level set of users accessed basic functionality with touch panels in the non-web previous version of the product with the touch ...
4
votes
2answers
666 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
1
vote
0answers
17 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
2
votes
2answers
72 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
4
votes
2answers
131 views

Time Based Authentication Verification Token

I'm building a long-lived session system which requires that users verify their authentication before performing "dangerous" operations, such as changing critical settings, deleting their account, etc....
-1
votes
1answer
242 views

Secure login procedure

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the ...
0
votes
1answer
46 views

How to configure SSH public key per user?

I have an OpenSSH server running and different users can log into it with different privileges. I know you can enable public key authentication and place all the allowed public keys in the ...
2
votes
1answer
34 views

Understanding the security of a federated public key scheme using WebCrypto

I am proposing this scheme for federated authentication and WebCrypto. I am not sure if something like this (or better) exists, please do send me related material. Entities Alice's Browser, BROWSER ...
-1
votes
5answers
185 views

Is it possible to bypass two step authentication process?

Is it possible for a hacker to bypass two step authentication process if the hacker has no physical access to my phone?
2
votes
2answers
98 views

For 2FA, is one method better (more secure) than another?

There are a variety of options available for 2FA - LastPass, for example, offers all of the following options: LastPass Authenticator Duo Security Authentication Google Authenticator Yubikey ...
2
votes
3answers
3k views

AD User vs SQL User for SQL Server Authentication

My company has multiple web applications that we deploy to customer sites. Often the customer has the final say in deployment options in which often it shocks me. Many of these customers are ...
4
votes
1answer
68 views

How can I be sure if a webview in a desktop app shows the real web page?

When installing Postman (on Mac), you can log on using your Google account. For this, the logon view from Google is shown in a window (A kind of Webview I assume). How can I be sure this is the real ...
2
votes
1answer
167 views

Authenticating a ciphertext

What can be considered as a downside of authenticating a ciphertext? For example, can we say a drawback of authenticating a ciphertext is that we lose repudiation, for example, we can't prove to the ...
1
vote
1answer
103 views

TLSv1: Reason for client not sending client certificate

Our BizTalk installation consists of two load balanced nodes B1 (10.137.10.1) and B2 (10.137.10.2) which process and route incoming SOAP messages. The processing is nothing more than: sending the ...
16
votes
3answers
603 views

What email addresses are treated as trusted?

Windows Live recently suffered a security incident because they didn't realize that email addresses like administrator@live.fi are considered "trusted": some certificate authorities will consider ...
0
votes
0answers
34 views

Best practice regarding secure administration on lots of embedded Linux devices [duplicate]

Lets say I've a lot of embedded Linux devices, like 100. How do I access and administer these devices securely? Is it best practice create a key pair and put the put the public key on all the devices?...
3
votes
3answers
105 views

How does Single Sign On limit phishing risk

I was reading this article about SSO benefits and this sentence intrigues me : Can reduce phishing – Phishing, a fraudulent process where victims are tricked into giving away sensitive user ...
3
votes
2answers
85 views

Useless 2FA in case of inside attacker

Suppose a server-side signing scenario, where user keys are generated in a HSM and exported to a database, encrypted with a symmetric key derived from a user password and HSM's master key. To sign, ...
3
votes
2answers
131 views

Is it secure: unsecured Wi-Fi + social network authentication to access the web?

Recently I visited my dental office and noticed a Wi-Fi configuration I haven't seen before. First, there is unsecured (no password) Wi-Fi, but I cannot surf the web yet. I am redirected to a webpage ...
2
votes
0answers
18 views

Secure userserver authentication with authserver

So, lets say we have Bob, Alice and Peter. Peter is trusted by Bob and Peter has an authserver. Bob hosts a userserver and Alice wants to connect to Bob over an insecure channel. But Bob needs to know ...
1
vote
1answer
41 views

Secure multiserver authentication

I was reading answers in How to split login and game logic when writing servers?. Read that first. Now, I want to know whenever this method will work and how can it be broken. I think there might be ...
5
votes
2answers
1k views

Why is whatsapp using 6 digit codes for verification?

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters. Are there any reasons they chose exactly 6?
3
votes
1answer
58 views

Smartcard authentication SSH remote client

I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation: My desktop computer with smartcard has a ssh session to ...
-2
votes
3answers
73 views

What safeguards are taken when a login system only requires a PIN and no username? [closed]

The gym I go to gives its customers access to the building by giving them a 6 digit PIN code which they must type in on a keypad when they want to enter/exit the gym. Does the person who was added ...
1
vote
1answer
59 views

Why mobile phone app sessoins are never timed out?

This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login. These mobile apps call web ...
-1
votes
1answer
36 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
7
votes
2answers
140 views

Why not make the second factor the only factor? [duplicate]

Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the ...
6
votes
1answer
213 views

If I misuse OAuth 2.0 to do authentication, am I at risk?

I understand that OAuth is not an authentication protocol, not authorization one (even if the first paragraph on Google's OAuth 2.0 page disagrees), as well as that: [...] authorization can be ...
0
votes
1answer
61 views

How to connect to Windows RDP and delegate authentication to a (reverse) proxy?

Looking for the following setup: Client connects to Windows RDP server through proxy server. The client is in public network hence can't send username/password for logon. The proxy server in between ...
30
votes
4answers
209k views

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?
0
votes
0answers
26 views

bundling session information in a binary

We are in the process of developing a desktop app. When a user is logged into the website we create a dynamic binary(.exe) and add session information to that binary which is valid for one time login. ...
1
vote
1answer
19 views

What should I watch out for when using pam_ssh_agent_auth?

I got tired remembering passphrases for my SSH logins and heard about pam_ssh_agent_auth. Unfortunately I hadn't found any security audit of it and I don't know enough low-level details about SSH to ...
0
votes
0answers
11 views

Does PKCS 1.5 padding make it possible for an attacker to extract the private key or not? Is PKCS 1.5 safe to use in authentication context?

Im currently writing a authentication app based on RSA, for Android that should be impossible to copy, even if you have physical access to a phone without lockscreen/PIN. However, the HSM inside the ...
0
votes
0answers
31 views

Is any encyption used for EAP-TLS certificate exchange?

I was reading about the EAP-TLS and mutual client - server authentication using digital certificates. In the authentication process explained in RFC 5216, both server and client exchange ...
0
votes
1answer
58 views

How can I test my SSO connection without having access to the Identity Provider?

I'm trying to set up an SSO connection using Auth0. My app is set up as the Service Provider (SP), and it needs to work with PingFederate as the Identity Provider (IdP). I don't have access to an ...
1
vote
1answer
76 views

Is using dynamic obfuscation and peppers for password hashing a good idea?

I've read now the whole day about password hashing and secure authentication and though I read very often that mostly every own algorithm makes the proven hashing methods just less secure, I just got ...
-8
votes
1answer
181 views

Sign In vs Log In [closed]

Using Web apps, I started to believe that these are synonyms. But, suddenly, at the bottom, developing a web app, I received the following response from a Google server: {"google_logged_in":false,"...
6
votes
2answers
172 views

How does Google store passwords for remote IMAP/POP services?

It is possible to add non-Google accounts to Gmail and retrieve their mail messages via POP or IMAP. As part of the setup process, one has to provide the login username and password for these accounts....