Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
4
votes
2answers
85 views
Logging in a user after password reset via link
Lets say password reset functionality flow is the following:
User submits email address used for his account.
An email is sent to that email address with a link with a password reset hash.
Upon ...
5
votes
1answer
153 views
How does SRP prevent man-in-middle attacks?
SRP is designed to resist both active and passive attacks, how does SRP prevent man-in-middle and packet modification attacks?
3
votes
5answers
245 views
Preventing online voter fraud
As part of a promotional campaign, my company wants to launch a site where users (and potential users) of our product will be required to register and vote for certain choices. Depending on how ...
-1
votes
1answer
73 views
What makes EAP-SRP-256 better than SRP? [closed]
What is the advantage of the EAP-SRP protocol? Is it only used in wireless?
3
votes
3answers
130 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
4
votes
4answers
2k views
How secure is Windows Auto-Logon?
Obviously, if auto-logon is enabled, anyone who can gain physical access to the PC can use the PC. That's not the question.
The question is, when I enable auto-logon for my Windows 7 box, will there ...
1
vote
2answers
214 views
Brute force a GUI login?
I know I have read somewhere that the reason the UAC prompt in Windows 7 was employed is that viruses that would supposedly execute privileged instructions won't be able to "click" the confirm button ...
3
votes
2answers
313 views
SASL Authentication Protocol with No Cleartext passwords
As you know, LDAP supports three authentication mechanisms: anonymous, simple and SASL.
The first one is only suitable for particular cases, and therefore I'm not going to talk about that. The ...
1
vote
2answers
112 views
What security issues are there when reading cookie with .htaccess?
I have a (hobby) web site that runs only on SSL (i.e., site-wide HTTPS). The site does not deal with finances, social security numbers, or anything of that level of importance. However, I'd like to ...
9
votes
4answers
946 views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
1
vote
2answers
61 views
certificate based network authentication
In certificate based network authentication, is the user tied to just the system the certificate has been installed on such that if he tries to authenticate using another system access is denied?
1
vote
3answers
107 views
Requirements for a smartphone anti-theft App
I recently installed Cerberus in my [personal] Android device to get some protection against theft (I'm not really interested in protecting its data, but rather in increasing the odds the device will ...
1
vote
1answer
96 views
Pure SRP authentication without TLS
IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
2
votes
3answers
150 views
Authentication system against the user
I try to search articles on the internet in this category, but no result. In generally we use authentication of the user against the system. So, we want to authenticate the user before he\she use our ...
0
votes
2answers
115 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
1
vote
4answers
302 views
SSH: reusing public keys and known-man-in-the-middle
Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key):
Best Practice: “One per-user ssh key” or ...
2
votes
6answers
202 views
Protecting an admin area from the public
We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site.
Now I'm not very interested at just leaving the admin out in the open ...
1
vote
4answers
219 views
sha512 as no-login-necessary token
My site has a news subscription system. When an item is updated, a notification email goes out to everyone subscribed to that item.
You can un/subscribe via a form on each item's page.
I wanted to ...
14
votes
9answers
1k views
is there a safe way to login to my gmail account from a public pc?
Sometimes i need to use a public pc to access my gmail account, is there a safe way to login and keep my password safe in case there was a keylogger or a trojan on that pc? are there tools that could ...
3
votes
4answers
172 views
Securing opensource web application
I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
6
votes
4answers
930 views
(SoHo) Multi-Factor Authentication for Remote Desktop Gateway
I am looking at implementing some sort of multi-factor authentication for a Remote Desktop Gateway at a small office (less than 20 users).
Where would be a good place to start for a quality, ...
2
votes
3answers
161 views
Using RADIUS for host authentication
Remote Authentication Dial In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) management for computers to connect and use a ...
1
vote
3answers
106 views
Central authentication
I am designing a system composed of several services. Some can be hit only from inside our network and a few can be hit externally. One of these services is a "login" or "authentication" service.
My ...
11
votes
5answers
991 views
How to implement non-password authentication in a web site
In an answer to this question about pw reset, D.W. says:
Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
21
votes
4answers
5k views
How to achieve non-repudiation?
If I have a message that I need to send to another person, how do I achieve non repudiation ?
Is digitally signing the message sufficient ?
4
votes
1answer
310 views
How to set up OpenSSH to use x509 PKI for authentication?
I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
1
vote
1answer
88 views
Are there any solutions available which conform to AAA protocol?
According to Wikipedia (http://en.wikipedia.org/wiki/AAA_protocol)
In computer security, AAA commonly stands for authentication, authorization and accounting. It refers to a security architecture ...
0
votes
5answers
111 views
Good ways to prevent spammers from registering [duplicate]
Possible Duplicate:
Is there a true alternative to using CAPTCHA images?
Since everyone hates captchas what are good alternatives? I'm looking to prevent the automated creation of accounts ...
1
vote
1answer
172 views
Picking an encryption algorithm for auth tokens passed via AJAX
I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens.
As an example:
The user will login in to the website (via OAuth, whether by the site as ...
0
votes
2answers
172 views
What are RealVNC 5.0 Authentication Protocol Security Limitations?
In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
2
votes
1answer
163 views
Loki How to crack the password hash OSPF?
I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF.
Now,by Loki penetration testing, I found that routers are the feature authentication.
Using wireshark, I ...
7
votes
3answers
155 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
2
votes
3answers
193 views
Identify client based on computed hash
I'm currently developing a web application which will serve data to iPhone clients.
In order to be the owner of the data, I don't want other clients to be able to get it.
I thought I could use a ...
1
vote
1answer
85 views
What are my options for securely printing an OTP Scratchcard?
I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets)
To me ...
2
votes
1answer
40 views
Kerberos for sending secrets
I understand that Kerberos is used as an authentication protocol. However, would it be possible to achieve a similar effect as Diffie-Hellman with Kerberos i.e. establish a session key which can be ...
2
votes
2answers
115 views
Easy protocol for email authentication
I'm cooking up a very simple system to send commands to a remote server via email. Everytime an email is sent to do_something@mydomain.net, the server runs a python script that does something ...
0
votes
1answer
40 views
Relative costs involved in making changes to the current organisational security
I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures".
Am I to compare the cost ...
1
vote
1answer
200 views
Asymmetric crypto to store credentials in HTML LocalStorage
We are developing a Mobile web app where the users want (and it is a non relaxable requirement) to be logged for a very long time.
The solution we are developing has a web-client part in HTML+JS and ...
7
votes
2answers
801 views
Why does HTTP Basic authentication encode the username and password with base64?
RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64.
To receive authorization, the client sends the userid and password,
separated by a ...
5
votes
3answers
248 views
Mutual authentication for humans
Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...
0
votes
2answers
128 views
Verifying users location & authenticity
I am builduing a business to business website, and users are able to sign up with a personal profile and create a business (like linkedin).
I need to verify the following:
Business Name
...
1
vote
2answers
115 views
is RDP7.0 authentication process secure enough?
Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is ...
3
votes
1answer
201 views
Is this acceptable login security?
I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2.
I discovered that I could input my password, followed by garbage, and it would be accepted.
How is this considered ...
2
votes
4answers
192 views
Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
First, I have a private delegate set up on my web site for OpenID and pointed my SE account at the URL on my web site; SE has no knowledge of the actual OpenID provider endpoint until my delegate ...
28
votes
4answers
14k views
What is the difference between an x.509 “client certificate” and a normal SSL certificate?
I am setting up a web service through which my company will talk to a number of business customers' services. We will be exchanging information using SOAP. I would like to handle authentication with ...
3
votes
3answers
154 views
Should email verification links be 'time limited' after user registration?
Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
3
votes
2answers
408 views
Disabling authentication via DSA keys in OpenSSH?
How can I disable DSA and ECDSA authentication on my server with OpenSSH 5.9? Sifting through the documentation material and doing a web search didn't yield any results - only an old bug report for ...
12
votes
5answers
554 views
Is there a digital “safety deposit box” equivalent?
Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy?
There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
1
vote
3answers
132 views
Is there a law against one email containing both a login and a password?
I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing ...
2
votes
3answers
228 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
