Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
1
vote
3answers
142 views
Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?
Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP.
Should banks offer integration with services like OpenID, WS-Fed, or ...
13
votes
3answers
1k views
Should security question answers be case-sensitive?
Question
In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers?
Scenario
An ...
1
vote
2answers
100 views
Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?
I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
1
vote
2answers
241 views
UNION SQL Injection
I'm trying to demo SQL Injection with a UNION query but I'm not getting results.
This is the C# code and the database is SQL Server 2008 R2:
string cString = "server=.\\sqlexpress; ...
1
vote
3answers
244 views
Using only password to authenticate user (no “username” field)
I am creating a client access system, to allow manage invoices, make payments, access information about their products and information/functionality alike.
Supposedly there are less than 1000 ...
10
votes
4answers
621 views
Security measures against packet sniffing
I work in a environment where packet sniffing can be easily done . I was worried about my confidential data . Please suggest how is it done and precaution which i can take at client level.
-1
votes
1answer
82 views
Does PayPal support a backup code for two-factor auth? [closed]
Google and DropBox have backup codes in case you can't get access to one of the devices you have registered. Does PayPal have a backup code?
4
votes
5answers
145 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
1
vote
1answer
46 views
How to verify data from localStorage on a server
This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit.
On my mobile app, I am ...
4
votes
2answers
167 views
Any real world examples of GPS location data being used with authentication?
Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations?
Specifically
Highlighting new or unusual ...
0
votes
1answer
50 views
WLFriends encrypted login risk
I recently had created on WLFriends.org which is presented by Wikileaks, I noticed a big thing there that the process of signing up at WLFriends was very distinct from the other normal sites. There, ...
1
vote
2answers
106 views
Does Convergence solve the problem of hacked CAs?
My question is about the Firefox AddOn Convergence.
So my question is if it is possible for convergence to observe that a phishing-site which is verified by fake Certificate because a hacker of a CA ...
2
votes
3answers
98 views
Whether certificates can be used for regulating access
I am thinking of a mechanism where I need to authenticate the client and control the access. I am thinking of using SSL for this purpose. I want to know whether using SSL solves my purpose.
My ...
0
votes
1answer
246 views
How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?
This document describes how there are 3 ways to constrain a SmartCard certificate
The Enhanced Key Usage field defines one or more purposes for which
the public key may be used. RFC 5280 states ...
0
votes
1answer
132 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
1
vote
2answers
205 views
Can I use hardware token OTP to stop piracy?
Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
10
votes
4answers
1k views
Are there technical disadvantages in using free ssl certificates?
Note this question is related, except this one is about free SSL certs.
There are providers who are offering totally free entry-level SSL certs (like StartSSL). I was wondering if they are ...
1
vote
0answers
68 views
Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?
Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system?
The scenario is as follows: I am a ...
4
votes
1answer
106 views
How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?
One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
24
votes
5answers
2k views
How to Securely Implement a “Remember Me” Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period ...
0
votes
3answers
100 views
Lowest possible threshold for smartphone app login
I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game.
Testing shows some ...
0
votes
3answers
217 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
1
vote
1answer
600 views
Wifi login redirect applications
This may sound a bit naive questions as i am a beginner. But I do my best to put it into words.
You may have experience when sometimes you want to use the internet in a cafe for example (with your ...
3
votes
1answer
156 views
Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)
I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
0
votes
1answer
153 views
How does the YubiKey Validation Server work from an encryption perspective?
Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
3
votes
2answers
91 views
Should the serial number of multi factor devices be removed?
I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it.
I don't want to blindly assume that the serial number is just ...
1
vote
1answer
346 views
Is it secure to install RSA SecurID Software Tokens on the same computer that will be used to access the VPN?
My office switched from using the old hardware RSA SecurID key tokens to the RSA SecurID Software Tokens and most users have them installed on the same machines they use to access the VPN.
I asked ...
0
votes
3answers
257 views
help understanding client certificate verification
I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
1
vote
4answers
143 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
4
votes
1answer
267 views
Trying to figure out Gmail login in Wireshark
In my pentesting lab I'm using ettercap for do a mitm to a XP VM.
I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
8
votes
1answer
302 views
How secure is Windows 8 email authentication?
I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email ...
2
votes
2answers
302 views
How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
0
votes
2answers
141 views
Security concern to implement a web based remote desktop
I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.
I can configure the ...
7
votes
5answers
369 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
1
vote
1answer
92 views
Reasonable computationally lightweight security?
I've read a bunch about how one should use bcrypt or PBKDF2 as a good middle ground between tunable workload and acceptable time to make brute force and collision attacks unfeasible.
What if the ...
0
votes
0answers
18 views
Facebook Login security concern with the javascritp JDK [duplicate]
Possible Duplicate:
Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I have some real concerns about how to use facebook login for my wabb-app. I have a ...
10
votes
2answers
207 views
“Pulled from public record” security questions
Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
1
vote
2answers
150 views
Authentication without saving password
Are there any security problems with following authentication protocol?
when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = ...
7
votes
4answers
821 views
What are the disadvantages of single sign-on authentication?
We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication.
Advantages
Users ...
6
votes
2answers
397 views
HMAC Based Request Signing - Storing the Salt
I'm working on a (non high security) project that currently isn't live but might go live at some point.
We have a REST API (implemented using Restlet and Neo4j) running on a server and an Android ...
5
votes
4answers
1k views
HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
1
vote
1answer
138 views
Public web server and AD- based Kerberos authentication
I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
4
votes
2answers
297 views
Does having a passphrase and SSH key qualify as two factor authentication for PCI?
I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
6
votes
5answers
232 views
Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
The typical set of multi-factor categories is as follows:
Something you know (e.g. a password)
Something you have (e.g. a hardware token, or key file)
Something you are (e.g. a fingerprint or retina ...
6
votes
6answers
3k views
Securing an API for mobile access
I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
0
votes
1answer
209 views
3 or 4 characters long username from security point of view
I have on my site the ability for the user to choose his/her username that is 4-20 characters long.
But some users could have names like "Amy" "Eva", "Ian" etc.
Should I stick with 4 letters or go ...
0
votes
1answer
93 views
How do I prevent my Rails application from attack? [closed]
My website is being nuked by new signups and new posts some of which don't even have user.id associated with.
How do I solve this? What code should I add to the user#new page and/or post#new page.
...
4
votes
3answers
378 views
Is my session-less authentication system secure?
So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
1
vote
1answer
166 views
RADIUS proxy chains
RADIUS is a widely deployed remote authentication protocol. I'm looking here at its use in wireless roaming. The RADIUS protocol allows for proxies and chains of proxies:
|CLIENT|<->|Access ...
1
vote
2answers
308 views
Two-Factor Authentication: When is it worth it?
I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
