Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

5
votes
6answers
457 views

How to protect the company VIPs

Environment: small engineering company (<50 employees) and everyone is local administrator on their computer, including everyone in the management group. Setup: Some standard security features are ...
8
votes
0answers
672 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
3answers
181 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
8
votes
5answers
1k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
2
votes
1answer
46 views

PBKDF2 strong salt for client-side hashing

What should I use as a secure/strong salt for PBKDF2 hashing when salt is not available to use before login as it will be client-side javascript to hash user+pass with PBKDF2 ? I'm going to use ...
1
vote
1answer
35 views

PBKDF2 strong salt

I want to use a strong authentication scheme, so I decided to use PBKDF2. I'm using PBKDF2 with SHA256 algorithm, 5000 iterations and I use username (which is full email address of user) as salt. So ...
10
votes
3answers
9k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
6
votes
3answers
214 views

Any way to prove that two devices are in the same physical space, for authentication?

I need to come up with digital proof that two physical devices are in the same (approximate) location whenever that transaction occurs. This could be: A digital ID and the authenticator A consumer ...
2
votes
4answers
840 views

Analyze my custom web authentication scheme, based on a token derived from username and password

To avoid having the user to login every time his session expires, I want to implement a token based authentication system. My scheme works like this: Send the user login (send name + password) ...
6
votes
1answer
3k views

How do NFC tags prevent copying?

Ten years ago, we opened our building's front door with a badge. Five years ago we paid public transports with an RFID card. Today we pay for our bread with the same system and tomorrow we would ...
0
votes
1answer
124 views

Authentication and security of a REST API

Scenario: I design a REST API where authenticated users can hit the API over TLS. I have to use TLS as the data transmitted over the wire is sensitive. I don't need authorization right now, but I ...
2
votes
0answers
53 views

How secure is docker container-to-container traffic?

I'm working on building a web application using the microservice architecture pattern in a set of docker containers and I'm wondering about the importance of securing the communication between the ...
12
votes
7answers
6k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
1
vote
2answers
91 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
1
vote
1answer
67 views

Unusual design aspects of AWS HMAC-based authentication, v4

I am designing a RESTful API in python. I want to use HMAC authentication. I could not find any suitable HMAC libraries, so I am rolling my own. However I want to use a well-known standard such as AWS ...
11
votes
2answers
497 views

“Pulled from public record” security questions

Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
9
votes
3answers
1k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
0
votes
0answers
53 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
0
votes
2answers
107 views

Secure android and server calls

I plan on adding an authentication system on my android app using web services. When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
1
vote
0answers
35 views

How does disabling sign in upon confirmation make devise any more secure?

Referencing reasons given in this question http://stackoverflow.com/questions/18655334/avoid-sign-in-after-confirmation-link-click-using-devise-gem Devise does not allow the immediate sign-in of a ...
3
votes
1answer
93 views

Best approach to confirm email within mobile app?

Would appreciate your opinion on the options explored: a- Launch app and ask for a verification code that was sent to user email? b- Launch app by clicking deep link + verification code in the ...
2
votes
0answers
152 views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
0
votes
2answers
166 views

Is PassFace Authentication System secure?

In the passface authentication system, whether the passfaces are selected by the users or assigned by the system? Is such system secure? How is user's passface stored on the server side?
3
votes
1answer
171 views

Can a Windows or Linux password be brute-forced on a public network?

I am at a hotel that has a public network. I have a Windows machine with a wired connection to it. "Network and Sharing" has network discovery on. No folders are shared except "Users", which is shared ...
5
votes
7answers
3k views

Techniques to make a login page safe without using SSL

I am developing a web page where people can write and comment things (no personal informations required) and I need to put a log in form so users can see all their actions on my web page. My idea is ...
1
vote
1answer
239 views

Authentication between two internal servers

I have two internal servers that are going to communicate with each other; they speak HTTPS. Is there a best practice for authenticating communications between internal servers? Short of a best ...
225
votes
7answers
171k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
0
votes
1answer
73 views

Two factor authentication using CVV and 3D secure code

While making online by Debit/Credit card, instead of using OTP (received on mobile), one can use a 3D secure code (verified by visa or mastercard) which is know to user. Should this qualify for two ...
0
votes
1answer
45 views

Mobile Game Auth Token Stolen [closed]

Basically someone sniffed my packets and stole my auth token/cookie for a mobile game I have played on for a year and spent thousands on (crazy I know) and now they are controlling my account through ...
1
vote
1answer
66 views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
14
votes
5answers
1k views

What is the difference between login throttling and temporary account lockout? [closed]

I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login ...
2
votes
1answer
38 views

Kerberos Authorization host/service by host/service basis

I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts? I am currently using LDAP for ...
1
vote
0answers
542 views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
11
votes
1answer
187 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
2
votes
1answer
50 views

electronic voting system

Was looking at cryptocurrency and how, as a non techy, to get involved when I began thinking about the security of it being developed to undermine the stranglehold bankers have on economy and the ...
2
votes
0answers
42 views

HMAC-SHA256 Transaction signing [closed]

Can rfc6238 be used for transaction signing by concatenating the random seed string with transaction details (such as amount and target account number) ? Could a transaction authorization 8-cipher OTP ...
0
votes
2answers
232 views

How to call webservice securely in Android

Hello I am working on an Android application in which I'm required to execute a few https web service calls. All my web-service URLs and Web API KEYs are in the code plus the IP address of the server. ...
1
vote
2answers
118 views

Should the whole web *really* be encrypted? Isn't plaintext sometimes faster/better? [duplicate]

It seems to be commonly accepted nowadays that all internet communication should be encrypted. (For example, this is evident in how the HTTP 2.0 standard outright requires HTTPS.) However, I have a ...
1
vote
3answers
153 views

CAPTCHAs: How does simple math in cleartext prove you're human?

I'm intrigued that many sites use seemingly random numbers with a random operator as a security check to validate that you're not a bot. Forgive my ignorance in captcha technology, but what is ...
3
votes
1answer
727 views

what is a valid challenge for 2 factor authentication?

When designing password reset process: 1- Is a an email address or an assigned username a valid piece of information ( identifier) to ask for in two factor authentication? 2- How does two factor ...
0
votes
2answers
52 views

Ubuntu backup to only specific devices

I am looking into setting up a secure Ubuntu server with daily backups to two different external hard drives that will be swapped with the external hard drive that is stored in a safe deposit box. ...
-1
votes
1answer
77 views

TLS/SSL and password transmission

I am still getting confused with security topics. At the moment the advantages and disadvantages of some of authentication methods are still not very clear. According to OWASP Authentication Cheat ...
2
votes
3answers
194 views

Could embedding website links in an email lead to more hack attempts?

My organization currently sends out emails directing our customers to login and view information on a customer portal site we have developed. The content of these emails is usually pretty generic ...
0
votes
2answers
70 views

WinForm Application Security

I wanted to create a winform application that have a centralized security database. This application is portable, can be save to any PC and simply run the .exe to use, hence there will be many copies ...
2
votes
1answer
288 views

How does the Fake Authentication Attack from aircrack-ng work?

I'm making a school project about the AP attacks and I'd like to know how does the Fake Authentication Attack from aircrack-ng actually work and how to prevent it? I read a lot of articles but ...
0
votes
1answer
37 views

Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript?

Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication? Is there any ...
2
votes
1answer
141 views

certificate authentication between apps

I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I ...
0
votes
1answer
56 views

Application-Server connection security

I have this school project of mine that involves an app and a website that use the same database. The app serves as an administration tool for the website. Since it's made in C# and it's not as ...
0
votes
0answers
25 views

Help with SAML 1.1 token request and response

I need to communicate with a service with SAML 1.1 based security and have a number of very basic questions. First I'm supposed to send a token request to the STS with a "Assertion token" in base 64 ...
0
votes
2answers
217 views

Steps to create user authentication system between mobile and server

First time doing a secure login from a mobile app to a server (built in java). I want to understand if I got this right. Login in for the first time: 1. On the mobile device hardcode a security ...