Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
0answers
75 views

SSH Keybased authentication using NitroKey

So I'm fairly new to more secure forms of key management, I've been used to storing my keys inside key files on my computer. Recently I wanted to try and see if I could setup SSH authentication to my ...
0
votes
0answers
29 views

security authentication protocol [duplicate]

I'm "creating" a secure authentication protocol for my system and it is this: C-> S C S-> C N(once) C-> S Kc,aut[N] S-> AUT Ks,aut[C,Kc,aut[N]] AUT-> S Ks,aut[N] the line : X ...
1
vote
1answer
66 views

Secure WebApp authentication

I know there are many questions about hashing passwords on the client side out there, but none of them, which I found, address my use case. My app will be end-to-end-encrypted and it is not an option ...
1
vote
1answer
101 views

Is it secure to refesh a JSON Web Token (JWT) auth token using the user credentials?

As I understand the answers to this question JWT: Is refresh an expired token is a good strategy?, one should use a refresh token to refresh an expiring auth token. Since my web app should be ...
0
votes
3answers
84 views

Is it a good idea to let a database do a password check?

Setup A server running a PostgreSQL database and an Apache with several php applications. Access to db is over the loopback interface. The db contains a table with the username and SHA-512-CRYPT ...
1
vote
2answers
105 views

memorable word and answers to security questions when resetting password?

Context We have a situation where we are allowing our users to login using either using Username & password + Memorable word OR Username & Password + answer to Security questions depending on ...
0
votes
1answer
72 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue We have a domain joined tablet that runs a Windows Store Application, we already have user identity and we need to call ...
0
votes
0answers
30 views

PostScript/Jet Direct port TCP 9100 mandatory for printers?

I'm trying to acquire more knowledge on the topic in order to find and fix a few security issues on printer infrastructures to prevent misuse, pranks and secure all data in it. Currently I have a few ...
1
vote
1answer
70 views

Attack Challenge/Response Authentication by requesting challenges

If a client/server application uses a challenge/response pattern for authentication, e.g. SCRAM or alike, it often involves the usage of nonces (client nonce and server nonce) for preventing replay ...
3
votes
0answers
65 views

Secure a server on `localhost` such that only the authorized users can connect

Consider an application (such as an IPython notebook) that runs an HTTP server, and that (by design!) allows arbitrary code execution by authenticated users (this is the entire point of IPython, ...
0
votes
0answers
27 views

Securing device communication with API back-end with no user interaction

We have remote devices programmed in Python that talk to our back-end to update our database with information gathered from sensors connected to our remote devices. The remote devices are not ...
2
votes
1answer
99 views

Can data coming into my UDP server be sniffed?

I have made a small tracking device. I am trying to reduce the data overhead as much as possible to make the device very cheap to run. We are working on the basis that 1MB = £0.01 (the data price at ...
0
votes
0answers
53 views

Benefits/negatives of password-less authentication

I am facing the following dilemma: I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products. Currently, the ...
2
votes
1answer
93 views

Email code authentication

I'd like to replace passwords with a temporary code that's emailed to the user. The login flow would go like this: User enters their email address. "If that email belongs to a user, a code will be ...
3
votes
1answer
94 views

Security requirements for one time access code/token in the url

I have an application that will send an SMS reminder for user containing a URL to log on. I would like to avoid user typing in username/password and log him in directly. For that I plan to use an ...
0
votes
0answers
37 views

What is attribute-based authentication?

I found the following definition here : From a privacy perspective a better solution would be the use of attribute-based authentication (Goyal et al. 2006) which allows access of online ...
1
vote
1answer
61 views

Secure login form from unsecure site

We have two sites, app.company.com and www.company.com. Right now, users are trained only to enter their login credentials on app.company.com. Both sites use SSL. The app.company.com uses CSRF and we ...
1
vote
0answers
38 views

Migration problem between different machines using TrouSerS TPM library

My question coincides with the question posted by Maximiliano Ezequiel. Below is a question. I could make migration process work in one single machine. I can: Export SRK public key. ...
2
votes
3answers
313 views

Does HTTPS allow replay attack on authentication request? [duplicate]

If I sent a username and the password to a website over HTTPS, is it possible that someone on the net would save this request and re-send it later to authenticate on the website?
2
votes
0answers
113 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
2
votes
1answer
107 views

How to verify if a phone number is an online SMS account as opposed to a genuine SIM card

We are using Authy for phone number verification on our website. It is very easy to create a free online SMS account through Twilio or other providers. Is there any way to determine whether the phone ...
1
vote
0answers
73 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels (...
1
vote
0answers
29 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
1
vote
0answers
30 views

Change NTLM hash in memory on the lock screen?

Is there a way to change the ntlm hash in memory to bypass Windows login? For example, I have the NTLM hash of a Windows machine and I have physical access. Is possible to write the NTLM hash in ...
7
votes
2answers
270 views

mobile number authorization strategy using SMS, best pattern and practices

In recent years, mobile number has become an important factor for authentication and hence more and more enterprises employ methods to capture their users' mobile numbers using SMS. In a typical ...
0
votes
0answers
47 views

Integrated Windows Authentication and Java/Unix

I have a specific scenario where we have existing ASP.NET Web applications/services hosted in IIS and accessible via Integrated Windows Authentication. The challenge is to have a new web application ...
3
votes
1answer
86 views

Revoke access from intranet if an employee leaves the organization

A question has been on my mind lately. Say you have a global organization with intranet which does not exist, but it is supposed to be developed. This organization has offices in maybe 50+ countries, ...
1
vote
1answer
136 views

Secure HttpOnly Cookie or Header field for auth token securing an API?

I have an API to secure. There will potentially be two types of consumers of this API - our own Single Page Application, and third party services that will integrate with it. I have read that in ...
1
vote
2answers
114 views

Should users be allowed to reuse/recyle the same login credentials across a network for different systems?

Should users be allowed to reuse/recycle the same login credentials across a network for different systems? Should this be disallowed/discouraged, or are the security implications minimal? If it's ...
1
vote
1answer
29 views

Extract X509 client certificates from TCPdump files

I have the following question: assuming I have a TCPDump file containing a number of HTTPS connections using TLS mutual authentication, is there a way to extract all client certificates sent to the ...
3
votes
0answers
95 views

Thoughts on my JWT implementation

So I've been trying to learn as much as I can about JWT tokenisation, and auth0 seems to be the defacto JWT information hub. However, the more I read about refresh tokens, the more I cringe - the ...
0
votes
0answers
35 views

Does Apple CloudKit prevent 3rd party apps from MITM'ing the API?

One of the issues with SnapChat is that some users were using unauthorized apps to access the backend API, which then allowed for some application level security to be compromised. I am of the ...
2
votes
1answer
135 views

SQL injection vulnerability when using prepared statements in PHP

I've been studying prepared statements and implemented it in my first login. I used a prepared statement for the SQL query and am wondering if this is enough to ward off most SQL injections? Since ...
2
votes
2answers
49 views

IP Restricted OTP like Web Admin Authentication Safe or Not

I created a web admin panel with the following security implementation. It is located on a sub directory of the web, which will trigger a 404 Error when tried to access (just like the link is ...
2
votes
2answers
61 views

Does having multiple 'memorable info' answers reduce secuity?

I use a website that on top of requiring a username and password also requires 'memorable information'. When signing up I provided multiple pieces of memorable info as answers to multiple questions (...
-7
votes
1answer
105 views

Is webkey a reasonably secure authentication system?

I just created Webkey in the last couple days. It's built to do client-certificate auth without using the (in my opinion unusable) client-cert functionality built into browsers. It would allow single-...
5
votes
1answer
116 views

Simple, Secure PHP API Design

I'm trying to design a secure RESTful API web service with as few moving parts as possible. I have some questions, and want to make sure my design is secure. For the data transmission level of ...
0
votes
1answer
35 views

Why is calculating the checksum of an IP Datagram header and then encrypting it not appropriate to provide Data Origin Authentication?

So assuming Alice and Bob have agreed to use a particular symmetric cryptosystem and share an appropriate key, they want to achieve data origin authentication by computing the header checksum of an IP ...
6
votes
2answers
193 views

OAuth2 and Authentication

I see a lot of confusion about OAuth2 and Authentication so I created this question in the hope to clear some of the confusion. So, let's talk about the following points : What is the difference ...
-2
votes
1answer
86 views

Public key encryption for initial challenge-repsonse

I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
0
votes
0answers
23 views

Cyrus-Imap (v2.3.16) local logon attack

CentOS-6.7 Cyrus-IMAP-2.3.16 The host inet07.hamilton.harte-lyne.ca is our IMAP server host. It offers imap and pop3 publicly. I uses local accounts (/etc/passwd) for imap/pop3 authentication only....
1
vote
0answers
37 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
14
votes
3answers
2k views

Are combined sign in / up pages dangerous, and how to improve them?

I'd like to code a combined sign in/up page like the one in the picture below. My colleague said this will allow spammers/hackers to see what email addresses are registered with our system and ...
2
votes
1answer
69 views

How to get around hard coding a PFX password

I've got an application that acts as a SSL server. I've got the pfx file and in code, I've had to hard code the password to use in the following way PKCS12_parse(p12, PFXPassword, &pkey, &...
1
vote
1answer
45 views

What is the drawback of allowing multiple accounts on a single email?

I run a website where users authenticate using email and password. Some users would like to have two or three accounts using the same email address. I see the use case in their situation, and am ...
6
votes
3answers
205 views

Authenticating a user via SMS

I'm involved in a project that's building a chat-bot that users can communicate with via SMS from their mobile phones. We'd like the users to be able to use the bot to do some basic account-management ...
2
votes
1answer
61 views

Is installation id secure enough to authenticate device's user against a Web Service API?

...or interactively asking for password / or having some certificate is inevitable? Context My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my ...
2
votes
1answer
98 views

How to protect my server from continous login attempts (Ubuntu)

This is the log of my server: Mar 25 16:49:51 f4arelay sshd[10831]: input_userauth_request: invalid user git [preauth] Mar 25 16:49:51 f4arelay sshd[10831]: pam_unix(sshd:auth): check pass; user ...
1
vote
3answers
110 views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
3
votes
1answer
63 views

Increased security from separating username and login name?

I seen this question: Does username length/complexity positively impact security? which got me thinking about usernames/passwords from a developer-aspect. If a developer for an application were to ...