Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
43 views

does the --nack command do what I think it does in reaver and why won't it work?

I have a problem with reaver. I try the --nack command reaver -i mon0 -b 00:01:02:03:04:05 -vv --nack --mac=00:BA:AD:BE:EF:6 for example. And I assume it will try a different PIN, even if it ...
20
votes
7answers
3k views

Are reCAPTCHA enough to prevent brute-force password guesses?

I was wondering if reCAPTCHA were strong enough to prevent BruteForce from bots or if I needed to add more security, such as sending a unique mail to the user every 5 tries that someone try to log on ...
0
votes
1answer
124 views

Protect software from copy [duplicate]

Imagine I wrote some software on .NET which will run on client machine. Is it possible to detect that someone copied my software to different computer? (Assuming my software can connect to a remote ...
14
votes
6answers
1k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
-3
votes
2answers
73 views

Client certificate vs HMAC

My team is working on web API project for one customer which will call this API. Now we are thinking about authentication. We've stopped on two options HMAC and client certificates HMAC: pros - no ...
7
votes
2answers
311 views

How to secure a modem/ wifi router without login?

A friend of mine has a DSL-modem/wifi-router from his ISP. The configuration page of the modem requires no login and no login can be set. It is said that there also exists a superuser but this is only ...
3
votes
0answers
166 views

Login details security using salt and hash, and a login role in postgresql

I am coding up the security for a website in express.js and postgresql database. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but ...
3
votes
0answers
267 views

Routing Protocol Encryption

As far as I know 'newer' versions of routing protocols support authentication between routers. What about encryption and integrity checks? Some implementations like this one from Cisco use MD5, which ...
4
votes
2answers
133 views

Passwordless website authentication scheme

I have a userbase which really isn't all that inclined to create a secure password for a website. They're also almost entirely on mobile devices, so I would like to try something a little different ...
0
votes
1answer
64 views

Using HTTP Basic Auth on a Personal Website

So I'm making a portfolio site with a blog which is accessed via a different URL slug and I'm wondering if using basic HTTP auth is enough for security on this website as I will be the only person ...
1
vote
3answers
87 views

HTTPS client “pairing”

I've been redirected here from SuperUser, I hope the question is appropriate. I need to restrict usage of a certain site to a limited number of customers. More than that, actually: I would like to ...
0
votes
1answer
159 views

AngularJS - Can a response from an $http.post to PHP be modified?

I have an angularJS $http.post that sends username/password to a PHP file that then queries my database to verify a successful log in. I then return a JSON object back to angularJS in one of the ...
0
votes
2answers
256 views

How to create a secure login system with cookies? [closed]

For my personal education, I am trying to create a secure login system using cookies. I have read a lot of articles and Stack Overflow questions on how to achieve that, but couldn't find anything ...
0
votes
2answers
107 views

How can I make locally stored data unreadable unless connected (logged in) to server?

I have a chat application built in Java. The chat app stores a log of the user Jimmy's chats locally on his machine. I want this chat log to be encrypted so if someone uses the computer (authorized ...
4
votes
1answer
82 views

Issuing and managing large numbers of certificates for client authentication

I am developing an Internet of Things product and plan to use client certificate authentication, issuing each "thing" its own certificate on the production line so that it may authenticate with a ...
2
votes
2answers
72 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
2
votes
1answer
91 views

What is the difference between key mechanism in wep and wpa

I haven't found the resources explaining about exact authentication mechanism about wpa-psk in the internet. finally i found securitytube videos i found one video regarding the wpa-psk concepts.in ...
5
votes
4answers
232 views

Password guessing: Is it more effective to try many passwords against a few accounts or a few (very common) passwords against many accounts?

I was watching a security vid on Irongeek the other day (I immediately lost track of which specific vid, unfortunately) where the creator gave some interesting advice about doing live password ...
0
votes
1answer
35 views

Authenticating on the client with OpenID Connect using Authorization Code flow?

Our company has a series of software suites that we are tying into a single OpenID Connect Resource Server. All but one of our applications can use Authorization Code flow as normal, redirecting ...
0
votes
2answers
70 views

Need to protect passwords (or 1fa) in the context of 2fa

I am trying to get some clarity on this. I am not looking at personal or risk mgmt perspectives. Why do we need to protect passwords (or 1st factor) in the context of 2fa (or multi factor ...
-2
votes
1answer
75 views

Unconditionally Secure Authentication

I'm trying to add the authentication for my One-Time Pad implementation. I know that to provide Unconditionally Secure Authentication I need to use the One-Time MAC authentication. But I don't ...
0
votes
0answers
45 views

Is it possible to do Bluetooth pairing without a shared secret?

I was wondering if it is possible to pair a device if it does not have a shared secret key with the device it wants to connect to? I believe authentication is done using challenge response between ...
8
votes
4answers
1k views

Can I replace username and password with a long random text in URL? [duplicate]

Scenario One customer is facing a problem with his users: they use a (web) service a few times per year and they forget their credentials very often. There is a standard password recovery procedure ...
5
votes
1answer
789 views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
4
votes
2answers
173 views

How long should a session absolute timeout be?

OWASP Session Management Cheat Sheet (https://www.owasp.org/index.php/Session_Management_Cheat_Sheet) recommends to implement an absolute session timeout (in addition to idle session timeout). It ...
5
votes
3answers
144 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
3
votes
1answer
394 views

Token based approach to authentication over SSL Rest API - refresh tokens

I'm quite a newbie at security. I'm developing an android app with a token based approach to authentication. I'm not using Oauth as the OAuth 2.0 is not an authentication protocol but rather used to ...
0
votes
0answers
29 views

Smartcard authentification: encrypt/decrypt or ECDSA?

I'm implementing a simple door access control with smart keyfobs. At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key. ...
5
votes
3answers
248 views

How do Pentesters approach attacking 2FA (two factor authentication)?

I'm looking for practical ways to attack 2FA. What do you need to consider and how would you go about testing the effectiveness of 2FA? My only thoughts are that you would attack the implementation ...
1
vote
0answers
76 views

Securely storing users PIN on Android with fingerprint authentication

I am have an Android app where the user can enter a pin specific to a particular phone to save them entering the full password. I'm now looking at the new fingerprint reader API on Android M where I ...
3
votes
4answers
168 views

Is it good practice to mandate input action on the password field in a webapp?

I am of the school of thought that says you should never have the browser "remember your password" because if you use it often enough, you will be able to retain that piece of information. I now want ...
-2
votes
1answer
116 views

Can someone bruteforce my OSX? (Macbook)

Is it possible for someone to bruteforce or perform a dictionary attack on a Macbook? It's very easy to bypass security of a Windows box (Password Protection) , what is the difficulty level of ...
11
votes
5answers
7k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
61
votes
10answers
22k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
25
votes
10answers
5k views

Can IP address be a component of 2-factor authentication?

I have a bunch of Linux machines that I wish to administer over the Internet. I currently use SSH keys, but have been advised to use 2-factor authentication. SSH Keys are something you know. Is an IP ...
1
vote
1answer
30 views

SSL/TLS certificates that only certain users can use to talk to my server

are there something like SSL/TLS certificates or other equivalents which could allow only certain trusted users (from the internet) who have my server credentials in their browser to access my web ...
-2
votes
2answers
47 views

Metasploitable: vnc_login - doesn't work with msfadmin:msfadmin

I am quite new to Metasploit and pen testing in general, so apologies for any seemingly noobish references below. I am using auxiliary/scanner/vnc/vnc_login, after seeing that the 5900 port is open ...
0
votes
1answer
46 views

Collect XML files from web server with secure authentication

I need to collect XML files from a 3rd party's web server. These XML files are generated by said 3rd party on a daily basis (e.g. data_2015-11-26.xml) and should therefore be fetched at least daily ...
2
votes
2answers
1k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
0
votes
3answers
38 views

enforce some peers to use IPsec and allow others to bypass it when reaching the same server

Lets assume I have a server that owns UDP socket. And then, for some clients, this server would expect to receive this UDP traffic encapsulated over IPsec. While for some others clients (the default), ...
2
votes
1answer
94 views

Avoiding repeaters in radio-communication

Suppose a sender and a receiver communicate over some radio channel. Is there a way to prevent packets sent and received are not being repeated/forwarded by a MiTM? That is, when the agents are out of ...
1
vote
3answers
389 views

Adequate prevention of distributed brute force attacks?

What are good ways to prevent distributed brute force attacks on my website? I think (not sure. if someone can assure me, thanks!) my site is secure against normal brute force attacks as I am using ...
4
votes
3answers
134 views

Is there a way to prove some content came from a specific website?

I guess we can all agree that a screenshot of a website proves nothing; one can edit the HTML as much as one likes, take a screenshot and show a website displaying false information. As far as I ...
1
vote
0answers
33 views

Guide on how to create certificates and setup an EAP-TLS on debian [closed]

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAp-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some ...
2
votes
1answer
81 views

Choosing token over session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and sent ...
1
vote
1answer
95 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
1
vote
3answers
74 views

How to verify that a host applied a firewall ruleset as is?

I have a service that sends rulesets to a fleet of hosts. Each host in its turn is expected to apply its ruleset to its firewall (iptables) and then send an acknowledgement back to the service. I ...
0
votes
1answer
59 views

How should I secure my site for logins? [closed]

I am making my very first site, and I need a way, to secure it. Users must be able to post stuff on my site, but I want to prevent throttling my site or using bots to break it. I thought of making ...
0
votes
1answer
29 views

Authentication using a digital signiture

I'm new to the world of digital signatures and encryption and I'm trying to learn more. I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital ...
0
votes
3answers
60 views

Hostname validation for server-side certificate

I have a reverse proxy which connects to an application which presents a certificate used for PKI based validation. I was wondering if I should enforce the condition that the common name (or ...