Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
0answers
746 views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
-2
votes
1answer
109 views

Whats the most secure way to send user data from client to server? [closed]

I know there are probably many existing answers to this question but so far I couldn't find a simple detailed answer. On the android app there is two buttons, sign in with facebook and sign in with ...
1
vote
1answer
88 views

Is logging a user out with CSRF a security issue? [duplicate]

I found the following behavior on a relatively popular website: They have a GET route for logging out (e.g. /api/user/logout). That allows me to write ![](/api/user/logout) in a comment or anything ...
0
votes
1answer
77 views

Mutual Authentication and Authorisation with Certificates from various CAs

Edit: Having read this question and answer I have a bit more of an understanding. My question now then, is: can I use a certificate that a user has had signed by a registered CA such as VeriSign, ...
6
votes
3answers
238 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
0
votes
1answer
88 views

What does showing a “security picture & phrase” guard against? [duplicate]

A couple financial sites that I use have a "security picture" (some small random photo) and "security phrase" (something I write about it). Two of them go about it differently, however: One asks my ...
0
votes
1answer
117 views

Secure implementation of user login

Well, I created login which works pretty fine, but I'm worried about its security. For checking if user is logged in I use only this $auth = $_COOKIE['authorization']; header ...
1
vote
2answers
70 views

Does information security justifies Iphone 6's “error 53”? [closed]

An update of IPhone 6 software left several IPhones that were previously repaired by an non-certified phone repairer dead. See e.g. this news. Apple claims that this is due to security: A ...
4
votes
1answer
2k views

Website Login Security (Secure enough?)

I'm making a bigger site for the first time so security really matters, unlike for my really-bad boards with maybe 10 users. So I wanted to ask if the way I'm doing it is secure enough for a semi-big ...
5
votes
2answers
348 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
0
votes
3answers
91 views

Alice and Bob authentication and integrity problem

Suppose Alice needs to send a file to Bob, guaranteeing her identity and the file integrity (no confidentiality required); the two parties are sharing a secret w and make use of a hash function H ...
-4
votes
1answer
185 views

Do you need to restrict the possible characters of a username? [closed]

I was looking at Twitter login system and saw this error message when trying to enter a username Your username can only contain letters, numbers and '_'. Twitter offer the possibility to login ...
1
vote
1answer
81 views

Not Asking Email Verification on Account Creation

Could we consider it as a security flaw to not ask an email verification on account creation? Let's say there is a service that ask you to enter an email address as a username and a password in order ...
2
votes
3answers
304 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
0
votes
2answers
78 views

Access to system32 [closed]

Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
0
votes
0answers
35 views

Api key v oAuth for mobile apps

So we already have an oAuth setup for authenticating users. But there are endpoints that are not user specific that are currently open, we would like to restrict access to those open endpoints via API ...
1
vote
0answers
55 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
8
votes
5answers
10k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
30
votes
6answers
4k views

How safe are employee laptops in China against International corporate espionage?

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. This loaner had MS Outlook and was linked to my normal company ...
3
votes
2answers
640 views

Security measures for “Forgot password” link

I noticed that Facebook sends out a "Forgot password" code of six digits, which is very short for a validation code, so I assume they are doing the following: Set a session variable which is linked ...
7
votes
4answers
224 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
16
votes
2answers
558 views

Which factors should I consider for devices that accept handwritten digital signatures?

These days many locations ask you to give your signature on a digital signature pad/device. As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
1
vote
1answer
61 views

Handling session tokens when a users IP changes with extreme frequency

My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token ...
2
votes
2answers
58 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
3
votes
1answer
97 views

Why attack detection based on the same user request from different places (e.g. by IP) is not widely used?

There are many ways how an adversary can pretend that he is a legitimate user (like session cookie stealing, bruteforcing the password and what not), but as far as I can see it should be rather hard ...
8
votes
3answers
6k views

Why is there a minimum username length?

In some (web) applications there is a minimum length for usernames, usually there is a restriction for a minimum of 6 characteres length. For example, free gmail accounts and miiverse (Nintendo ...
2
votes
3answers
98 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server ...
3
votes
4answers
300 views

Can the identity of a person in Nigeria be confirmed? [closed]

I need to find out if a person is who they say they are. Can that be confirmed?
1
vote
3answers
147 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
2
votes
2answers
117 views

Is encrypted cookie without authentication secure enough?

I have some sensitive data in the cookie, e.g. it contains the user id that is later on used to execute the query and we trust the cookie because it is encrypted. All communication happens only on ...
109
votes
19answers
27k views

How should I securely type a password in front of a lot of people?

I am a manager in an office where the company does not provide a company email, so I use my personal email. Often, I will receive jobs lists by email from my general manager. How should I log in to ...
2
votes
2answers
83 views

Should it be possible in a good software, using a “Change Password” link for a single user, to try to guess passwords for every user of a Application?

I am having a fight with the "Security Expert" of my team about this very basic question and I need help in getting a good valid argument(s). The pretext is as follows: Should it be possible/valid to ...
0
votes
2answers
153 views

Computer Security vs Privacy

Probably this is a redundent post but in fact I have been searching online about a precise clear distinction between computer security and privacy. I'd like to know the difference of between them ...
4
votes
6answers
316 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
0
votes
0answers
97 views

Account Signup/Login: Code-via-SMS + email verification

In an effort to make the sign-up / login to a mobile app more streamlined, I am considering alternatives to the username/password signup/login. In this case (as is with most mobile apps) login event ...
0
votes
0answers
29 views

TPM based authentication without a trusted third party

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed. In general, what are the TPM operations that ...
-1
votes
1answer
89 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
4
votes
1answer
207 views

Why are JWT's secure?

I want to make sure that my use of JWT's in authentication is correct. There are a couple of issues that I don't understand. This is my current understanding: When a user logs in, the server will ...
3
votes
4answers
120 views

How secure can you be on an untrusted machine?

I feel like most of what is written about web security assumes you are using a trusted / secure PC. I'd like to consider the opposite: you are using a PC (say, at an internet cafe) which is known to ...
7
votes
2answers
121 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
3
votes
1answer
24 views

Automatic client executable updating

Scenario I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an ...
-1
votes
2answers
129 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
0
votes
1answer
136 views

Tie key to computer

I have client server application. Is it possible to tie an encryption key to some computer (say my client) such that is key is stolen attacker won't be able to use that key from another computer? ...
-1
votes
2answers
76 views

what is the different between X.509 certificate and 2-way SSL? or both are same? [duplicate]

Can anyone clarify what is the difference between an X509 certificate and two-way SSL? or both are same?
2
votes
2answers
119 views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
13
votes
6answers
3k views

Is it a security issue to allow nearly identical email addresses when registering?

Say you have a website where it is possible to create accounts for all of the following email addresses: 'test@test.com' 'test@test.com ' 'test@test.com;' 'test@test.com;test2@test.com' Should this ...
25
votes
10answers
7k views

Two passwords for one account

Would it be a good idea if you had one account which would require two different passwords ? For example your login details were: email: example@gmail.com password 1: P4$$w0rd1 password 2: ...
1
vote
5answers
115 views

Best Security Method for SSH Access

I have been starting to think about security in a bit more depth recently and have hit a few questions which I would really value opinions on. For years I have had the same SSH Keypair to get to my ...
19
votes
7answers
11k views

Forgotten password or reset link, which is more secure to email?

I originally posted this as a reply here in this thread but didn't get much feedback on it, and now I'm curious as to what others think is the best approach, or if there is any difference between the ...
6
votes
3answers
278 views

Is there any point in using two step authentication if you have strong passwords?

If you are in the habit of using strong passwords (randomly generated by password manager) is there any point in using two step authentication? Assuming that 99% of the time that when you enter a ...