Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

10
votes
5answers
2k views

How can I securely authenticate the client application sending me data?

We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
10
votes
4answers
735 views

What is the key when facial recognition is used as a password?

I get the basics of what face recognition is and the fact that it is used to protect PC's and as a login replacement. However, if it was to be used for encryption, where the role of the key is played ...
10
votes
4answers
988 views

Can .htaccess and .htpasswd really protect me?

I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
10
votes
2answers
11k views

How does ssh public key authentication work?

My basic understanding is this: The (connected to) server's sshd uses the public key to encrypt some message The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
10
votes
3answers
321 views

If multi factor authentication is enabled, how should that affect self-service password reset?

Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required) ...
10
votes
6answers
9k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
10
votes
2answers
239 views

Preventing Voter Fraud on a Social Media Contest

I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
10
votes
3answers
947 views

What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?

I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
10
votes
3answers
991 views

Multiple CAs signing a single Cert/CSR?

Just saw this suggested on Slashdot So I've seen quite a few people wanting a switch to self-signed certs (who IMO mostly don't understand what making that secure actually involves), and an idea ...
10
votes
4answers
4k views

What are the disadvantages of single sign-on authentication?

We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication. Advantages Users ...
10
votes
2answers
4k views

How does deauthing work in aireplay-ng?

I have a question of how aireplay-ng works when it deauths. I mean, it is really easy to disconnect another client from an AP: you just need to run the deauth command (in aireplay-ng) once, specifying ...
10
votes
2answers
580 views

Security of unencrypted wireless networks with authentication page

Some wireless networks, such as those offered by hotels and hotspots, are not encrypted (they don't require a pass phrase to connect) but have an authentication web page. For example, you connect to ...
10
votes
2answers
366 views

“Pulled from public record” security questions

Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
9
votes
3answers
5k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
9
votes
4answers
2k views

Is Facebook Connect or Twitter OAuth PCI Compliant?

We have a system that stores credit cards securely on file. We'd love to allow users to sign up using Facebook Connect or Twitter. Obviously this wouldn't be secure if we were trusting just any old ...
9
votes
7answers
460 views

Authencity of information displayed on an untrusted device

Suppose I have a (bluetooth/usb) device which needs to displays information on an external pc/phone. Is there a simple and effective method to garantuee that the information displayed hasn't been ...
9
votes
6answers
1k views

What methods can be used to prevent mistyped usernames?

I wanted to log on to my account on my bank's website. The account is protected by a number of security checks. The first one is what really amounts to a username, a confidential one. It's an 8-digit ...
9
votes
3answers
12k views

What is single sign on versus federated login?

What is the difference between Federated Login and Single Sign On authentication methods?
9
votes
4answers
10k views

What is the difference between authenticity and non-repudiation

I'm new to infosec and doing some reading. Not surprisingly one starting point was wikipedia. In this article, authenticity and non-repudiation are listed as 2 separate 'Basic concepts'. My ...
9
votes
3answers
964 views

Is SiteKey a valid defense against Phishing?

As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. (This is a scheme where the user is shown a personalized image (each user has their own ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
9
votes
1answer
34k views

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific ...
9
votes
2answers
791 views

BCrypt's 72-character limit and using it as a general digest algorithm

Goal: have token/cookie-based authentication that doesn't require keeping sessions on the server TL;DR: What, if any, is the accepted mechanism to work around the 72-character limitation of BCrypt? ...
9
votes
3answers
246 views

Is there any conceivable reason to prevent a password change in an authentication system?

I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
9
votes
1answer
544 views

How secure is Windows 8 email authentication?

I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email ...
9
votes
4answers
433 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
9
votes
3answers
930 views

HMAC Based Request Signing - Storing the Salt

I'm working on a (non high security) project that currently isn't live but might go live at some point. We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
9
votes
3answers
887 views

Length of CSRF Token

Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
9
votes
1answer
4k views

How to set up OpenSSH to use x509 PKI for authentication?

I do not mean simply putting the public RSA key of a x.509 certificate into ~/.ssh/authorized_keys - I'm looking for a way to set up a ssh such that x.509 certificates signed by a pre-defined CA will ...
9
votes
3answers
458 views

Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?

It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
9
votes
1answer
263 views

What shell binary should I use for the root account on a Linux system?

Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
9
votes
3answers
730 views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
9
votes
1answer
329 views

Optimal variable sizes in the Secure Remote Password protocol

I am implementing the Secure Remote Password protocol: U = <username> --> <-- s = <salt from passwd file> a = random() A = g^a ...
9
votes
3answers
851 views

API message verification without storing private key?

I'm in the process of implementing a public API for my web service. Security is a key concern as money is involved. It seems the current common practice for "authenticating" users in API requests is ...
9
votes
2answers
2k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
9
votes
2answers
404 views

NFC used in place of contact based smart card two-factor authentication

My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
8
votes
5answers
390 views

Oldest security feature still in active use

Beyond commonsense and physical access controls, is the system password the oldest still in active use security feature? By physical access, I mean for example leaving the system within a secure ...
8
votes
7answers
330 views

Aren't permanantly logged in accounts inherently insecure?

The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
8
votes
3answers
11k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
8
votes
5answers
305 views

How to verify new accounts against a known persons database?

I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
8
votes
3answers
2k views

What common products use Public-key cryptography?

I want know what common use products are there that use public key/private key cryptography?
8
votes
4answers
1k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new ...
8
votes
3answers
489 views

Why would a website allow answers to security questions to be used interchangeably?

I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are: ...
8
votes
5answers
769 views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
8
votes
4answers
639 views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
8
votes
6answers
644 views

Is there multi-factor authentication for machines?

Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
8
votes
2answers
714 views

My bank makes me enter my password using the mouse. What's up with that?

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
8
votes
2answers
534 views

Is a rand from glibc's rand secure for a login key?

Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
8
votes
2answers
611 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
8
votes
3answers
584 views

zero knowledge proof and its protocol

In Zero-Knowledge Proof where we take the analogy of Peggy (Prover) and Victor (Verifier): In this story, Peggy has uncovered the secret word used to open a magic door in a cave. The cave is ...