Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
60 views

Retrieve anonymous credentials

Background A registration process to acquire an anonymous, verified account goes like this: Registrant provides proof of individuality to a Registrar. Registrar verifies proof, ensures no prior ...
2
votes
0answers
242 views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
1
vote
1answer
354 views

Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used. Some options came to my mind: Store the password ...
42
votes
4answers
5k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
-2
votes
2answers
140 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
2
votes
1answer
63 views

How do Client-specific keys and Certificates work?

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key ...
1
vote
1answer
1k views

How can a gmail recipient open email in two different countries, at the same time?

I sent an email to person in Russia, and tracked it with Right Inbox, when the email is opened I get notified. The problem is I get 2 different IP addresses, one in Russia, and one in the US, both ...
3
votes
1answer
1k views

“Extended Protection” primer and implementation guide to prevent MITM

Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks. Does anyone have a primer (or explanation in plain English) what this feature is, ...
2
votes
1answer
71 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
1
vote
2answers
82 views

Circumventing disadvantage of IP-based account lockout

So we're trying to prevent brute-force attacks on our web server login page--currently we just do IP-based locking if x failed attempts from IP address Y occur over z time period. After a security ...
0
votes
0answers
61 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
4
votes
2answers
70 views

FIDO: what is the benefit of the challenge parameter?

In the enrollment stage an attacker could intercept the message and answer with a signature based on the correct challenge. I know that normally you include a symmetric secret in such a challenge, but ...
1
vote
0answers
35 views

authentication token not stored in DB

I am implementing a webserver and the guideline I am following suggests: - to create token by a Serializer that takes the IdUser, a symmetric key and an expiry date - provide it to the user but not ...
1
vote
0answers
93 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
0
votes
0answers
37 views

Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network

I am aiming to lock down a web service that accesses other services and has a publicly facing UI. I have a hosted service on a network that requires 2-factor authentication to access. This service's ...
0
votes
1answer
137 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
3
votes
1answer
61 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
0
votes
3answers
130 views

What is a good way to authenticate a user to websites and applications with a smart phone?

What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be ...
1
vote
1answer
103 views

How do MACs provide authenticity?

I don't see how they're different then hash functions. Couldn't Alice use Bob's key to produce a MAC and send the message to Jim.
0
votes
1answer
111 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
0
votes
1answer
142 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
0
votes
1answer
59 views

How Google Authenticator in Android mobile identifies this is the right SSH server?

I am new to Google Authenticator mechanism. I gone the basics of mechanism but I couldn't understood what logic behind that to make a connection to the Linux machine. I have a Linux which have no ...
3
votes
1answer
193 views

Best practices for passwords on registration?

I have a website which users register an account. On the registration field, the form fields are: Name Email Confirm email Username But there is no password field. When they hit submit, they are ...
5
votes
2answers
117 views

Four eyes authentication for command execution on Linux. (OS level) [closed]

I reached the end of the internet with no success, so now I turn to you guys. What I'm after is a way to implement four eyes principle on the OS level for certain commands in Linux. Example : The ...
3
votes
1answer
762 views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
34
votes
3answers
71k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
1
vote
0answers
72 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
5
votes
3answers
6k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
19
votes
5answers
3k views

How to uniquely identify users with the same external IP address?

I have created a login module on my website. I was able to deal with simple brute force attacks since I can identify the user based on username/email and throttle their login based on failed login ...
0
votes
0answers
80 views

Brute-forcing a RSA private key password vs. LUKS volume

I need to store various private keys for my clients. Given these options, what would be the least prone to brute force attacks: Encrypt the private keys using a separate RSA key (each user get its ...
0
votes
3answers
101 views

Two factor authentication(Mobile)

Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
0
votes
1answer
100 views

Mechanism used for offline authentication of software

To prevent user from downloading bootleg copies of software , users often have to enter a string of hexadecimal numbers which would be used to authenticate the user. I think the basic idea would be ...
27
votes
7answers
3k views

What is a good way to authenticate a user to a smart phone?

What would be a good way to authenticate a user to a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be ...
1
vote
1answer
52 views

What is the term for requiring a user to go through an additional activation/verification process on new devices only?

When I log onto my bank's website on a new device (be it a new phone or a web browser I haven't used before) it prompts me to send an activation code to my phone or email. I have to enter in this ...
1
vote
2answers
123 views

Breaking mysql username and password form [closed]

I have two versions of a website. The first one has no security precautions against sql injections. So if I try something like: Username: hello_world Password: ' or ' 1=1 I'll be signed in as the ...
6
votes
1answer
183 views

Can/do botnets brute force “high value” users of services like Gmail?

On an intranet a login is generally disabled after a very small number of failed logins. But a public email service like Gmail can't do the same, otherwise pranksters would just be continuously ...
0
votes
1answer
71 views

Client authentication [closed]

Assume a server which offers some information which must not be exposed publicly. A client of this which may be e.g. a windows service (or at least something executing headless) needs to access the ...
3
votes
1answer
118 views

Can sms-only authentication be safe?

many Android mobile applications (e.g., Whatsapp, Telegram), when used for the first time on a device, "authenticate" users by sending them a secret code in a SMS message. The same mechanism is used ...
2
votes
1answer
77 views

What is the best way to be sure of user's identity?

Not sure this is the right stack to ask this in, it's kind of an abstract question. Say you have a website where it is very important that the personal information provided by the users is authentic. ...
1
vote
1answer
74 views

Why is a cookie's life extended after half the time has passed on a sliding expiration algorithm?

I'm coding my sliding expiration algorithm for Bearer tokens to mimic what's done by Microsoft on their FormsAuthentication logic, and reading their documentation they say (emphasis added) When ...
0
votes
0answers
41 views

Implementation of AEAD_AES_256_GCM and AEAD_AES_128_GCM ciphers in secure RTP

I am in the process of implementing AEAD_AES_256_GCM and AEAD_AES_128_GCM ciphers in secure RTP. There is a mechanism in RFC 5116 to implement the algorithm, but I am not able to find any sample code ...
1
vote
1answer
98 views

Encrypted access tokens - expiration date

My idea is to use encrypted tokens - where upon authentication (with username and password), backend would encrypt user_id, timestamp and an SHA-256 over those, base 64 encode it and return to the ...
21
votes
12answers
3k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
5
votes
4answers
230 views

Should we be checking password restraints on log in forms?

We have many restraints we put on users when they set up their password. These restraints include password length, characters they can or cannot use, the use of numbers and letters, capitalization ...
8
votes
3answers
1k views

What are the security implications of using TOTP for single factor authentication?

(Note: I am not actually planning to do this. This question is strictly theoretical.) TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
0
votes
0answers
55 views

What to use to encode JSON Web Token?

I'm using JWT to create access tokens for a Sinatra API. My question is, what should I use to sign the token? Right now I'm trying to use the user's password hash, but bcrypt-ruby changes the ...
0
votes
1answer
54 views

How secure is internal data on the internet with IP authentication?

I am a app developer and working with another software group at my MEGACOMPANY. Said group wants to put confidential information on the internet and they are very happy with their authentication ...
2
votes
1answer
68 views

HMACs that have the same key and message

im using HMACSHA256 to generate the hash of password and store it. the objective here is to just authenticate users, i.e - save their hashed passwords, and validate users whenever needed using the ...
2
votes
1answer
48 views

Is e-mail authentication using a hashed ( address + string ) insecure?

I want to give a newsletter subscriber the possibility to change his information. Since we're using an external company for sending our newsletter I can't put a key right into the newsletter (or not ...
0
votes
2answers
76 views

Remote administration methods

There is a requirement for users to remotely access one of my corporate servers from internet. Policy wise, i would want them to at least use 2FA for communication,eg VPN Tokens, password+SMS etc. ...