Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
127 views

multi tenancy and microservices API authentication/authorization

I'm seeking advice on how we may be able to implement authentication and authorization for multitenancy with slightly different number of scenarios. We are building a set of API's which of some are ...
1
vote
1answer
62 views

Encryption that service provider themselves cannot decrypt?

I recently saw the following message verbatim on an online application I use. The login is simply a login/password combination. There is no oauth, no two factor authentication, etc... This sounds ...
1
vote
1answer
144 views

Client authentication successful when using a pfx with Java, fails using OpenSSL. Why?

I've been trying to troubleshoot issues with client authentication and am seeing different behaviour when connecting from a Java application vs OpenSSL. A third party has provided me with a pfx, I've ...
1
vote
1answer
65 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
9
votes
3answers
645 views

Do client certificates need to be trusted by the client?

I'm looking for some clarification around the trust requirements (if any) of client certificates. I'm working with a third party to access their services via Mutual TLS. I generate a CSR, send it ...
2
votes
1answer
63 views

SSH Server Authentication

I know this question was asked several times in several ways, for example: Can an SSH server fingerprint be spoofed? What stops an SSH server from MITMing logins? However, none provided the ...
2
votes
1answer
87 views

How to achieve authentication using symmetric cryptography

Here, message authentication is defined as A MAC authenticates a message. If Alice sees a message and a MAC and knows the associated secret key, she can verify that the MAC was produced by a ...
1
vote
3answers
338 views

Prevent or detect key copy

This question can be classified as somewhat two interrelated questions - or two goals. Main aim is basically to authenticate client to server, but remain secure even if someone steals the key from ...
1
vote
0answers
26 views

fakeauthentication is working when my belkin belkin router f7d2301 mac-address filtering enabled

Actually i have enabled mac-filtering in my belkin router and the security policy is none and the authentication is open authentication. Iam(attacker) using kali linux. when i done a fakeauth attack ...
2
votes
1answer
87 views

Handling Authentication without a unique username or password

Working on a project and I have to authenticate a user that does not have a username ( '' ) or a password ( '' ). There are users and guest_users, but a guest_user won't have to explicitly log-in, ...
0
votes
0answers
36 views

Is it appropriate to request a bounty for finding exploit on major site? [duplicate]

Long story short, I found an easily reproducible, very easy, and honestly embarrassing exploit on a major (yes, major) financial institution's online banking site today. It's not directly tied to ...
2
votes
2answers
73 views

EMV as authentication technology and not a data security technology

I'm trying to wrap my head around what I view as EMV chip card security loopholes. Here's what I'm told about EMV. If a transaction is being recorded maliciously by a third party, they will get your ...
2
votes
2answers
83 views

Log User In Automatically After Clicking Account Activation Email

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
9
votes
1answer
384 views

Do readers for the “Mifare DESFire EV1” smartcard really need to know the card's secret key in order to authenticate the card?

I'm trying to understand the security of a contactless smartcard system, used for access control and payment. The card is a Mifare DESFire EV1 implementing ISO 14443 (see the this documentation ...
3
votes
1answer
72 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
1
vote
1answer
38 views

Authentication system for a web service

I am building a web service which i will be launching in near future. Service is more or less like online classifieds. Now, i need to build a mechanism to collect user's information, enough to trace ...
52
votes
6answers
6k views

Has a benefit been demonstrated for credit card machines asking for ZIP code?

In the U.S., many credit card machines at places like gas stations have started asking for your ZIP (postal) code to use a credit card ostensibly to help verify that you really are the cardholder, ...
1
vote
0answers
33 views

Is our internal SSO design secure? [duplicate]

We use one primary web app that was built internally and 3 other web apps that we did not build but that we do host. I want users to only have to sign into the primary web app, which uses Google auth. ...
-1
votes
1answer
53 views

When I visit a site using HTTPS is it exposed to sniffers? [duplicate]

Say for example I visit https://foo.com. Could someone that is sniffing the network determine that I am going there? At what level does the https encrypt the request? I know that data is secured ...
2
votes
0answers
33 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...
3
votes
1answer
535 views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
2
votes
0answers
86 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
7
votes
3answers
1k views

Do we still need to encrypt/decrypt data in Application Layer, despite using TLS/SSL?

Actually I got some projects from my ex-colleagues. These are App-Server TCP socket based applications. I noticed that some of auth/login interactions are using RSA/AES encrypt/decrypt as I know, if ...
2
votes
1answer
45 views

SSL Client Authentication Failure

I have a setup where the client wants to make https call to the server. The client has a certificate installed on the machine The trust chain of the cert: Root CA      ...
5
votes
2answers
90 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
4
votes
1answer
88 views

Public Key Certificate Pinning and MITM attack

So I was looking at an example of how to implement public key pinning for when your app connects to your web service and you want to have your app ensure it's really talking to your server. ...
5
votes
1answer
92 views

If I obtained a username and the salted password pairs from a server, can I login?

I am studying Salted Challenge Response Authentication Mechanism (SCRAM). According to the description at https://tools.ietf.org/html/rfc5802#page-8 it seems that the Client does not have to know ...
3
votes
4answers
70 views

How to Protect Webservice on Private Network?

We are building a webservice that will only be queried by other servers on our private network. I was suggesting that we put that webservice over https and use either client ssl authentication or a ...
1
vote
1answer
21 views

Auto log-out sequence based on inactivity on desktop devices

Applications that monitor user activity may log out of the app if there is no user activity in the app for more than kLogoutInterval period. This value could be 1 or 5 or 10 15 minutes based on the ...
1
vote
2answers
111 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...
5
votes
3answers
145 views

Does a Smartphone contain all the essential properties of a Smartcard? If not, what is missing?

Can a smartphone, alone, be a valid substitute for a Smartcard? If not, what is missing technically speaking? Does the TPM chipset (which I assume is in the phone) provide enough security to "act ...
2
votes
1answer
74 views

OTP on the same device being used to login

I've seen mobile apps use two factor authentication by sending an SMS to the mobile phone. However, if I've stolen someone's phone, where is the security advantage? I can understand it if it's used in ...
1
vote
0answers
46 views

How are FIDO and NSA (Natural Security Alliance) different in biometric security? [closed]

Fido Alliance and Natural Security Alliance both work on certifications of biometric authentication. How are those different / complementary? What are their targets for making business for themselves? ...
3
votes
4answers
168 views

Is it good practice to mandate input action on the password field in a webapp?

I am of the school of thought that says you should never have the browser "remember your password" because if you use it often enough, you will be able to retain that piece of information. I now want ...
3
votes
1answer
61 views

Does providing non existant users with fake salts prevent user enumeration?

Background I'm currently setting up a basic username & hash based login process for a web application. The process consist of the following steps: User submits their username. Server responds ...
5
votes
1answer
80 views

Connecting via SPNEGO/Kerberos out from domain

Is it possible to authenticate to SPNEGO/Kerberos server in domain A with an account from the same domain (obviously) when the client is connecting from computer in one of the following (quite ...
1
vote
0answers
73 views

Peer Entity Authentication and Data Origin Authentication services in OSI layers

What kind of Peer Entity Authentication and Data Origin Authentication services are provided in network layer(L3), Transport layer(L4) and application layer(L7) ?
3
votes
4answers
116 views

What is the risk of different responses when a login username matches or not?

I am responsible for a website that allows a user to reset the password, as usual. However, the response of the website is different whether the entered username matches or not. This would allow an ...
4
votes
2answers
119 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
1
vote
0answers
387 views

cgi-bin/webproc : Is my wifi router hacked [closed]

When I try to access the yahoo.com I am asked user name and password then I am routed to yahoo.com/cgi-bin/webproc Not only yahoo likewise for so many sites I am getting the same problem. ...
5
votes
1answer
153 views

Why are JWT's secure?

I want to make sure that my use of JWT's in authentication is correct. There are a couple of issues that I don't understand. This is my current understanding: When a user logs in, the server will ...
2
votes
1answer
93 views

Why is the 2nd step in two-step authentication not a single click? [closed]

The case I'm using Google 2-Step Verification. The question Why does Google use a code as second step? Why not just an android app where you can click "It's me"?
3
votes
2answers
120 views

How to 'pair' a client/server application securely?

Please forgive me if my question is a rephrasing of a common problem, but I am not sure what to search for! My use-case is a client-server program. The server runs on a user's PC and the client runs ...
7
votes
1answer
190 views

“Fix” man in the middle

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good ...
3
votes
1answer
125 views

Use salt as identifier for crypted session id in database based authentication system for webapp

I have written a database-based authentication framework for webapps I am planning to program in the future. The framework is implemented by using the plpgsql-language of a PostgreSQL-Database and ...
2
votes
0answers
34 views

What are the most common ways to Architect the verification process of the access tokens between resource and authentication server using OAUTH 2.0?

What are the most common ways to Architect the verification process of the access tokens between resource server and authentication server using OAUTH 2.0? I am trying to build a web application ...
5
votes
1answer
82 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
1
vote
1answer
57 views

TLS 1.2 mutual authentication certificate based standard

I'm running an analysis on a TLS1.2 mutual authentication certificate-based client-server implementation and I'm wondering if there's a RFC or a reference document covering the handshake process when ...
1
vote
0answers
40 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
3
votes
3answers
81 views

Central auth service redirecting to subdomain, using digital signature as auth token

I'm working on a "proof of concept" of a central auth service (not CAS). There are holes in my understanding of what I need to do, and I have concerns that the "protocol" is not secure. Why/What ...