Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
6answers
4k views

Is this authentication scheme secure?

I want to authenticate a client of a webpage and make sure it is a particular user. Let say that we already agreed on a particular hash (SHA256, actually, which I think is secure enough for this) and ...
0
votes
1answer
42 views

I can't connect to OSSIM server [closed]

I installed OSSIM in VMware workstation.The installation was successful.But when I entered the login and the password I have this message " incorrect login" I know that la login must be "root". ...
7
votes
3answers
5k views

Are fingerprint scanners easy to bypass?

Thinking about adding a fingerprint based authentication layer, but then I recalled the MythBusters beat fingerprint security system episode -- is this a common issue, and if not, how do you tell if a ...
3
votes
1answer
71 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
5
votes
2answers
273 views

Website login using database credentials

Is it secure to login to a website by using database usernames, for each user? Is it a bad practice? What can be the issues? The idea is to create the users and permissions at database level. EDIT: ...
4
votes
2answers
172 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
1
vote
1answer
42 views

Privilege seperation when using the same login credentials?

While thinking about preventing ransomware attacks on my machine I stumbled across the following question: Assume I'm on a Windows (10) PC. Assume further that I have two (local) accounts, one with ...
0
votes
2answers
29 views

Bookmark UUID Link

I noticed the following site: nightchamber.com A user account is automatically generated on first visit and keyed against a uuid, the id is then stuffed into the session and used to make a link the ...
5
votes
1answer
64 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own ...
1
vote
2answers
36 views

Client verification with PKCS#7

When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there ...
3
votes
1answer
48 views

Distribution of Application API Token

I wrote a simple twitter client for command-line use. For such application, twitter requires two types of tokens, namely application identification, user OAuth Token. The second one is to allow ...
0
votes
1answer
123 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
19
votes
3answers
2k views

Rate limit login attempts: count by IP or username

I need to limit login attempts. One option is to count attempts by IP address and then block the IP. The disadvantage is that different users may have the same IP address. Another option is to limit ...
3
votes
1answer
54 views

2 Step login: Memorable word reset via Email OR Security Questions?

Background We have a system in place which requires employees to login using a 2 step verification process ( password & Username) + (a defined number of characters from a chosen Memorable word). ...
1
vote
4answers
183 views

How to know if accessing to a VPN service is safe and won't steal my data

I want to know if a VPN service is safe or not. If the VPN server itself can catch or sneak peek my data? Or as long as it is a VPN service, then the security is protected by the algorithm itself? ...
3
votes
1answer
807 views

Is TextKey SMS 2 factor authentication secure against cell phone cloning?

I came across this website today that implements SMS based authentication that works "opposite" most SMS authentication methods. In typical SMS authentication, the provider sends you an access code ...
8
votes
3answers
38k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
6
votes
1answer
309 views

How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?

One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
2
votes
1answer
108 views

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site. Here is the user flow: User visits the site for the first ...
16
votes
5answers
1k views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
3
votes
3answers
622 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
4
votes
1answer
698 views

(ctrl + alt + del) on Windows 8/8.1/10

After seeing this answer I wondered, how is this done in newer versions of windows, where [ctrl + alt + del] is no longer required for login? Was this feature just removed, or is it somehow ...
19
votes
4answers
26k views

What is the difference between authenticity and non-repudiation?

I'm new to infosec and doing some reading. Not surprisingly one starting point was wikipedia. In this article, authenticity and non-repudiation are listed as 2 separate 'Basic concepts'. My ...
2
votes
1answer
114 views

What to do for my Web API authentication scheme

I've been reading a lot lately about WEB API authentication mechanisms and I'm a little bit confused regarding how to implement my Web API authentication mechanism, I'm thinking on using Token based ...
0
votes
1answer
42 views

How should I construct a secure redirect_uri?

I have read a number of questions on the underlying necessity of a redirect_uri. I don't want to screw this up! Can anyone give an example of how a secure redirect_uri could be constructed? For ...
1
vote
0answers
39 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
6
votes
1answer
3k views

What is the opaque field in HTTP Digest Access Authentication used for?

Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value ...
0
votes
1answer
40 views

Why a physical signature is even listing any security at all? [duplicate]

I'm from germany where I have to "access" my money mostly by using a pin. (except for a credit card where I just had to put in the card at all (no signature was requested nor a PIN) But this post: ...
1
vote
0answers
34 views

How Do I Create a Production Client Authentication Certificate for Azure Key Vault?

I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here. The samples do a great job of explaining how to make a ...
2
votes
2answers
50 views

What auth info is locally revealed with eduroam WPA-Enterprise 802.1X?

If you authenticated with your eduroam credentials at a participating institution, your home institution is the one doing the authentication of the credentials, and the host institution is only ...
6
votes
1answer
151 views

Samba printer usernames and passwords , security problem

Password leaks , printing from Linux client to windows based print server When authenticating Linux users for using a windows share printer on their machine, the windows domain user-name and password ...
5
votes
3answers
1k views

Man in the middle attacks for Out of band Authentication

I was researching on methods to avoid man in the middle attacks. I thought of using out of band authentication but i read the wikipedia article on the same topic which goes as follows: "In ...
3
votes
1answer
153 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
1
vote
2answers
141 views

Password may not be similiar to last 5 passwords [duplicate]

SAP NetWeaver has a password policy to prevent your new password beeing similiar to the last 5 passwords. Are the passwords stored in plaintext to verify this? Or is something like a soundex value ...
11
votes
3answers
1k views

Why is my phone connection secure without a password when WiFi is not even with a password?

When I talk on the phone or send text messages, I never need to type a userid and password. But when I use WiFi I need to use a password. How is the phone connection secured without a password, and ...
2
votes
1answer
57 views

Remembering email in login form

After logging out Google remembers recently used email addresses in the login form so the user only needs to enter the password. See accounts.google.com. How secure is it? What factors should I ...
1
vote
1answer
63 views

Distinct error messages for wrong email / password

I want to continue discussion started in this question "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong? but ...
39
votes
12answers
7k views

Sending passwords to someone remotely

As someone who usually works with people in other countries it has always been a problem to send login information to each-other. For development login details like debug databases etc sure I can ...
0
votes
0answers
68 views

Token based authentication: Why invalidate the token after each request?

I use the gem devise_token_auth while developing an API for a mobile app. Authors claim that: Tokens should be invalidated after each request to the API. This behavior is enabled by default. ...
2
votes
4answers
124 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
0
votes
2answers
246 views

multi tenancy and microservices API authentication/authorization

I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
2
votes
0answers
746 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
-2
votes
1answer
109 views

Whats the most secure way to send user data from client to server? [closed]

I know there are probably many existing answers to this question but so far I couldn't find a simple detailed answer. On the android app there is two buttons, sign in with facebook and sign in with ...
1
vote
1answer
88 views

Is logging a user out with CSRF a security issue? [duplicate]

I found the following behavior on a relatively popular website: They have a GET route for logging out (e.g. /api/user/logout). That allows me to write ![](/api/user/logout) in a comment or anything ...
0
votes
1answer
76 views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...
6
votes
3answers
234 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
0
votes
1answer
88 views

What does showing a “security picture & phrase” guard against? [duplicate]

A couple financial sites that I use have a "security picture" (some small random photo) and "security phrase" (something I write about it). Two of them go about it differently, however: One asks my ...
0
votes
1answer
114 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ...
1
vote
2answers
70 views

Does information security justifies Iphone 6's “error 53”? [closed]

An update of IPhone 6 software left several IPhones that were previously repaired by an non-certified phone repairer dead. See e.g. this news. Apple claims that this is due to security: A ...
4
votes
1answer
2k views

Website Login Security (Secure enough?)

I'm making a bigger site for the first time so security really matters, unlike for my really-bad boards with maybe 10 users. So I wanted to ask if the way I'm doing it is secure enough for a semi-big ...