Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
1answer
272 views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
0
votes
1answer
38 views

User-friendly public/private manual authentication protocol

I have a remote service which allows users to SSH login to the machine and they're automatically sent to the (command line) application (without access to a bash prompt, for instance). In the course ...
0
votes
1answer
126 views

Sharing RSA Public Key for decrypting JWT amongst Load Balanced servers

I'm trying to implement a cookie-less authentication mechanism for a web API that is stateless on the server (does not store session tokens) and can be load balanced across several servers. I have ...
0
votes
1answer
64 views

single sign on across two servers

I have been wondering how and what kind of tools are needed to do single sign on in the following scenario: 1) Alice is logged in to site X hosted by server W 2) Alice navigates site Y hosted by ...
3
votes
2answers
2k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
5
votes
2answers
634 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
-2
votes
1answer
96 views

What is “Pass the hash” attack?

The article on Wikipedia doesn't explain how the attacker can authenticate to the remote server using the hash instead of the original password. According to the following article the attack is still ...
0
votes
1answer
109 views

Is the following PayPal Vulnerability a design/implementation flaw?

I am trying to understand the logic behind following vulnerability, I believe this a design flaw not only an implementation. To me the problem with the two-factor authentication service at PayPal is ...
0
votes
2answers
61 views

Detect Different Machine using Browser [closed]

Some web apps like Facebook and Gmail detect the first time we try to login from a device. Assuming that a browser can't read machine name, and MAC ADDRESS. What kind of variables are they collecting ...
19
votes
5answers
5k views

Why is “something you know” the weakest factor of authentication?

Quoting from CompTIA Security+ guide The first factor of authentication (something you know, such as password or PIN) is the weakest factor. Why? it makes sense when we say that humans/users ...
0
votes
2answers
81 views

OTP vs. Keyfile

I have been wondering what are the benefits and cons of using an OTP (one time password) versus a keyfile to, for example, decrypt a keepass database, connect to a server via SSH, or other uses. ...
0
votes
2answers
163 views

future of graphical password authentication [closed]

I'm a student currently pursuing my Engineering in Computers. I'm planning to put all my knowledge in and try to actually implement something related to security. To be more specific I'm more ...
298
votes
20answers
50k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
1
vote
4answers
439 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
0
votes
3answers
65 views

How is chase mobile deposit verified? [duplicate]

I read this but it didn't ask the question I want answered. How is Chase Mobile Deposit Secure? What I want to know is how do they avoid accepting a Photoshopped check? When someone gives me a ...
7
votes
4answers
645 views

What are factors in evaluating the fitness of a security questions?

Attempting to understand the key factors in evaluating the fitness of security questions. By security questions, I mean for example: What was the name of your first pet? In what city was [insert ...
0
votes
1answer
121 views

Api authorization basic concepts in detail

I am trying to write an application is rails. Which is more like a api application so that when a user gets redirected from his application into mine I would like to authorize him and start a session ...
1
vote
1answer
66 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
9
votes
2answers
5k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
21
votes
6answers
1k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
2
votes
1answer
70 views

How can I compute the value of the ASP.NET forms authentication cookie?

How can I compute the value of the ASP.NET forms authentication cookie?
15
votes
5answers
12k views

Preventing deauthentication attacks

I am helpless against some kiddy with backtrack who repeatedly uses aireplay-ng to deauthenticate legitimate users on my Wifi work network. I captured and analyzed the network traffic on my Wifi work ...
11
votes
4answers
1k views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
4
votes
2answers
94 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
0
votes
1answer
136 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
2
votes
1answer
117 views

How to autenticate properly in Java

I have to write some login module for Java EE application. Previously i was using JBoss security - provided login and password, called HttpServletRequest with login method and JBoss security did the ...
4
votes
1answer
2k views

Isn't MongoDB actually storing plaintext passwords?

According to the documentation at http://docs.mongodb.org/meta-driver/latest/legacy/implement-authentication-in-driver/: The driver then runs the authenticate command for the database on which to ...
2
votes
1answer
537 views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
23
votes
2answers
3k views

Passwords in plaintext?

I'm doing some research on the App of my telephone operator. I started Burp Suite on my Mac in proxy mode, I opened up the App on my iPhone and started to sniff some traffic. I pressed the "login" ...
3
votes
3answers
162 views

Where are the user credentials stored when remember password is selected?

Provided a user has chosen the remember me option while logged in last time into a web application,how does the web application server identifies the user next time when he logs in? The credentials ...
2
votes
1answer
352 views

Is it possible to Spoof a TeamViewer ID?

I am using 2 forms of remote access to my Windows Server 2008 machine, both go to the Admin account since we only use it to host a Minecraft (MC) Server. Remote Desktop, that goes over a custom port ...
0
votes
1answer
72 views

Techniques for bypassing zero length check in javascript?

I am working on a node.js application that allows users to sign up for accounts using social media. When they do this an entry is created in our database with their email address, and a blank ...
2
votes
1answer
217 views

MySQL Authentication Hash Cracking

I'm currently conducting research regarding MySQL server remote authentication. I've captured unencrypted, uncompressed authentication packets between the client and the server where the username is ...
1
vote
1answer
80 views

Could Mental Cryptography(?) be useful to ordinary users?

I recently read about 'Mental cryptography' or 'Metal hash' process from this post: Mental cryptography and good passwords (via this message board ...
5
votes
2answers
277 views

Does a random set of secondary passwords add any security?

My bank uses this rather uncommon policy of authentication. They of course have a password, which has quite strong password patterns like "use alphanumeric characters and symbols, 8+ characters" are ...
0
votes
2answers
46 views

Application Authentication [duplicate]

We are developing an Android/iOS app. This app tracks the user's GPS coordinates and send them to the server along with other data. The integrity of the sent data is too critical for our service. We ...
-4
votes
5answers
170 views

What is the difference between session fixation and session recreation?

I have read that both of them are conventionally the same. But there must be a few differences which differentiates the two terms. Anyone please explain.
1
vote
2answers
99 views

Should I validate authentication form inputs?

I've got a login page with a form where they can input their account's email address and password. I'm doing the following things before even attempting to authenticate a user: Validating the email ...
2
votes
2answers
120 views

Password verification scheme (used in eg. MS Office) - more secure than just a hash?

Usual password verification schemes stores a salted password hash and the salt. If the hash is good and computational costly, it is considered secure. However an alternate version (used in Microsoft ...
16
votes
9answers
3k views

is there a safe way to login to my gmail account from a public pc?

Sometimes i need to use a public pc to access my gmail account, is there a safe way to login and keep my password safe in case there was a keylogger or a trojan on that pc? are there tools that could ...
7
votes
4answers
339 views

How to suspend a user from my website and prevent them from creating a second account?

I am an outsourcing person, not a programmer. My website is a shopping website (think eBay). My website will need a user suspension feature, in case a user violates the terms and conditions. The ...
10
votes
4answers
2k views

Location to store an encryption key

I'm building a secure system which stores messages on a server in a Postgresql database. The messages are stored encrypted with PHP's openssl_encrypt() function with the AES-256-CBC method. At the ...
3
votes
3answers
2k views

is it possible to create a login “key” out of a USB drive?

I was recently thinking about keeping my computer secure from physical access, and i decided that the safest way to keep my data under lock and key, was to do just that: Create a lock and key out of a ...
1
vote
0answers
37 views

Is the session key system that I use for authenticating users of my Google Cloud Messaging application secure?

The system works as follows: The user registers a username with the server over HTTPS, which generates a random 256 bit number, converts it to base 64, stores it on the server database alongside the ...
7
votes
3answers
6k views

Why is Chrome asking for the application-specific password and my account's password every time? [closed]

I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
-2
votes
1answer
55 views

Escape from <script> to cause a XSS (XSS when reflection is already under <script>) [duplicate]

I am trying my level best to solve this issue i am totally not able to create a XSS i still thinks it to be a vulnerability and i think it is exploitable. I am frustrated around it for 8 days . Please ...
0
votes
2answers
138 views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
1
vote
0answers
87 views

NFS IP spoofing

I am using VirtualBox: where the guest is an Arch ISO and the host Windows/Cygwin or a generic Linux. For sharing host folders, VB native shared folders is not an option (since the setup requires ...
1
vote
1answer
121 views

Is my authentication persistence system design secure?

This system is for a personal file upload and sharing web application made with PHP. When a user logs into the application, it has the option to "stay logged in" after closing and reopening their ...
-2
votes
2answers
820 views

How to completely password protect login into Ubuntu 12.10?

I am running Ubuntu 12.10 on my laptop and I would like to make a set up such that without a login password, no one would be able to login into my system. Currently it seems that one can, quite ...