Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
2
votes
2answers
113 views
Easy protocol for email authentication
I'm cooking up a very simple system to send commands to a remote server via email. Everytime an email is sent to do_something@mydomain.net, the server runs a python script that does something ...
0
votes
1answer
39 views
Relative costs involved in making changes to the current organisational security
I need help understanding what is required by the phrase "a comparison of the relative costs involved in making changes to the current organizational security procedures".
Am I to compare the cost ...
1
vote
1answer
198 views
Asymmetric crypto to store credentials in HTML LocalStorage
We are developing a Mobile web app where the users want (and it is a non relaxable requirement) to be logged for a very long time.
The solution we are developing has a web-client part in HTML+JS and ...
7
votes
2answers
747 views
Why does HTTP Basic authentication encode the username and password with base64?
RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64.
To receive authorization, the client sends the userid and password,
separated by a ...
5
votes
3answers
248 views
Mutual authentication for humans
Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...
3
votes
3answers
96 views
jasypt message integrity
I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are
use a high level library.
don't use ECB
use a HMAC to ...
1
vote
2answers
112 views
is RDP7.0 authentication process secure enough?
Latest version RDP used NLA, CredSSP and TLS to secure the authentication process. It sound like secure but in reality does it really secure enough. I knew that the previous version RDP is ...
1
vote
4answers
301 views
SSH: reusing public keys and known-man-in-the-middle
Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key):
Best Practice: “One per-user ssh key” or ...
3
votes
1answer
201 views
Is this acceptable login security?
I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2.
I discovered that I could input my password, followed by garbage, and it would be accepted.
How is this considered ...
2
votes
3answers
147 views
Should email verification links be 'time limited' after user registration?
Regarding web application user management, I understand that password reset links are effectively "password equivalents", and therefore it makes sense to limit them to one use only and also make them ...
1
vote
3answers
132 views
Is there a law against one email containing both a login and a password?
I see most companies either supply a login or a password in an email, but never both in one email. Is this a "best practice" or is there an actual law that prevents legitimate companies from providing ...
3
votes
2answers
148 views
Is Yahoo SignIn Seal effective at phishing prevention? [duplicate]
Possible Duplicate:
Effectiveness of Security Images
Information about the efficacy of Yahoo's SignIn Seal is scarce, the best I could find was this section on Wikipedia's entry on ...
1
vote
3answers
142 views
Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?
Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP.
Should banks offer integration with services like OpenID, WS-Fed, or ...
1
vote
2answers
101 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
2answers
241 views
UNION SQL Injection
I'm trying to demo SQL Injection with a UNION query but I'm not getting results.
This is the C# code and the database is SQL Server 2008 R2:
string cString = "server=.\\sqlexpress; ...
3
votes
2answers
387 views
Disabling authentication via DSA keys in OpenSSH?
How can I disable DSA and ECDSA authentication on my server with OpenSSH 5.9? Sifting through the documentation material and doing a web search didn't yield any results - only an old bug report for ...
-1
votes
1answer
83 views
Does PayPal support a backup code for two-factor auth? [closed]
Google and DropBox have backup codes in case you can't get access to one of the devices you have registered. Does PayPal have a backup code?
10
votes
4answers
626 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
1
vote
1answer
48 views
How to verify data from localStorage on a server
This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit.
On my mobile app, I am ...
4
votes
5answers
146 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
0
votes
1answer
50 views
WLFriends encrypted login risk
I recently had created on WLFriends.org which is presented by Wikileaks, I noticed a big thing there that the process of signing up at WLFriends was very distinct from the other normal sites. There, ...
1
vote
2answers
205 views
Can I use hardware token OTP to stop piracy?
Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
0
votes
1answer
133 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
1
vote
0answers
68 views
Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?
Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system?
The scenario is as follows: I am a ...
4
votes
1answer
106 views
How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?
One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
4
votes
2answers
168 views
Any real world examples of GPS location data being used with authentication?
Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations?
Specifically
Highlighting new or unusual ...
0
votes
3answers
223 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
1
vote
1answer
609 views
Wifi login redirect applications
This may sound a bit naive questions as i am a beginner. But I do my best to put it into words.
You may have experience when sometimes you want to use the internet in a cafe for example (with your ...
4
votes
3answers
216 views
Is SiteKey a valid defense against Phishing?
As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. The comments and answers indicate some issues with this approach, but that question wasn't ...
26
votes
3answers
659 views
What is this authentication method/approach called?
Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
0
votes
3answers
101 views
Lowest possible threshold for smartphone app login
I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game.
Testing shows some ...
3
votes
1answer
159 views
Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)
I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
3
votes
2answers
91 views
Should the serial number of multi factor devices be removed?
I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it.
I don't want to blindly assume that the serial number is just ...
0
votes
2answers
166 views
What are RealVNC 5.0 Authentication Protocol Security Limitations?
In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
1
vote
1answer
352 views
Is it secure to install RSA SecurID Software Tokens on the same computer that will be used to access the VPN?
My office switched from using the old hardware RSA SecurID key tokens to the RSA SecurID Software Tokens and most users have them installed on the same machines they use to access the VPN.
I asked ...
0
votes
1answer
153 views
How does the YubiKey Validation Server work from an encryption perspective?
Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
4
votes
1answer
270 views
Trying to figure out Gmail login in Wireshark
In my pentesting lab I'm using ettercap for do a mitm to a XP VM.
I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
8
votes
1answer
304 views
How secure is Windows 8 email authentication?
I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email ...
2
votes
2answers
307 views
How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
0
votes
2answers
141 views
Security concern to implement a web based remote desktop
I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.
I can configure the ...
1
vote
4answers
143 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
0
votes
0answers
18 views
Facebook Login security concern with the javascritp JDK [duplicate]
Possible Duplicate:
Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I have some real concerns about how to use facebook login for my wabb-app. I have a ...
1
vote
1answer
92 views
Reasonable computationally lightweight security?
I've read a bunch about how one should use bcrypt or PBKDF2 as a good middle ground between tunable workload and acceptable time to make brute force and collision attacks unfeasible.
What if the ...
7
votes
5answers
371 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
0
votes
3answers
258 views
help understanding client certificate verification
I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
10
votes
2answers
207 views
“Pulled from public record” security questions
Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
1
vote
2answers
150 views
Authentication without saving password
Are there any security problems with following authentication protocol?
when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = ...
6
votes
4answers
355 views
Banking application login leaks information
My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows:
User visits the homepage of the bank.
User ...
1
vote
2answers
120 views
Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?
It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
1
vote
1answer
139 views
Public web server and AD- based Kerberos authentication
I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
