Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

2
votes
1answer
81 views

Choosing token over session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and sent ...
1
vote
1answer
95 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
1
vote
3answers
74 views

How to verify that a host applied a firewall ruleset as is?

I have a service that sends rulesets to a fleet of hosts. Each host in its turn is expected to apply its ruleset to its firewall (iptables) and then send an acknowledgement back to the service. I ...
0
votes
1answer
59 views

How should I secure my site for logins? [closed]

I am making my very first site, and I need a way, to secure it. Users must be able to post stuff on my site, but I want to prevent throttling my site or using bots to break it. I thought of making ...
0
votes
1answer
29 views

Authentication using a digital signiture

I'm new to the world of digital signatures and encryption and I'm trying to learn more. I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital ...
0
votes
3answers
60 views

Hostname validation for server-side certificate

I have a reverse proxy which connects to an application which presents a certificate used for PKI based validation. I was wondering if I should enforce the condition that the common name (or ...
2
votes
2answers
120 views

I delete cookies file in chrome but i'm still logged in after I restart Chrome

I'm using linux and google chrome as browser. I know that cookeis are stored at /home/my_name/.config/google-chrome/Default/Cookies. I deleted this file but it seems like when I restart Chrome and ...
2
votes
3answers
243 views

Why do I have to use multiple keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
4
votes
2answers
136 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
1
vote
2answers
135 views

Keepass - password paranoia

How do I know that the Keepass app isn't behind the scenes at some point sending my master password over internet to some secret site whose job it is to collect them and use them for evil means?
0
votes
2answers
70 views

Two-factor authentication methods: password + SMS/voice message vs. password + app-generated code?

I am thinking which methods of two-factor authentication are most reliable and secure when using Pebble as an user end who has the capability of seeing his or her SMS messages but not answer phone ...
6
votes
1answer
193 views

Why does OWASP recommend security questions?

I was reading the OWASP Forgot Password Cheat Sheet when I stumbled upon the recommendation to use security questions. There is even a dedicated page about what information to gather. Whenever I ...
2
votes
1answer
48 views

Does TrustManager PKIX (or RFC 3280/X.509) really check client certificate expiration date?

It was noticed that default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check expiration date of client's certificate during ...
5
votes
2answers
90 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
29
votes
7answers
4k views

Silently Limiting Login Attempts

I've seen the following login rate limiting approach used on a web site I worked on, but I can't figure out if it's a good idea: After any failed login attempt, the site locks the user account for a ...
3
votes
3answers
80 views

Central auth service redirecting to subdomain, using digital signature as auth token

I'm working on a "proof of concept" of a central auth service (not CAS). There are holes in my understanding of what I need to do, and I have concerns that the "protocol" is not secure. Why/What ...
0
votes
2answers
57 views

Does X.509 standard claim to check client certificate's expiration date on server side?

Does the X.509 standard claim to check client certificate's expiration date on server side? Consider an expired client certificate in the trust store of web server. If some client tries to ...
3
votes
3answers
73 views

Implement a passcode to authenticate app users [duplicate]

This question is related to this one. We're busy implementing 5 digit passcode authentication for our app (Android, iPhone), but we're running into a complexity. We're unsure how we can safely ...
4
votes
0answers
20 views

How to securely send your user and hashed password to a server? [duplicate]

I'm making a user system for an app I'm developing, and I have a client side (the mobile app itself) and a server side (where the database remains) for it. The app sends get and post petitions to the ...
6
votes
2answers
160 views

Protection of eduroam credentials

Recently my educational institution officially switched over from the their own wireless network to eduroam. If I understand correctly from the FAQ, credential authentication is performed on the ...
1
vote
0answers
52 views

How secure is Asus router latest framework function: “Added protection mechanism for GUI login brute-force attack for login username and password.”?

I have just updated my RT-N12 D1 router to the latest framework, and it has new function - "Added protection mechanism for GUI login brute-force attack for login username and password.". I Googled and ...
2
votes
1answer
89 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
1
vote
1answer
38 views

With a known secret key, can I determine the response for an authentication challenge?

I am trying to find a response for a 64-bit authentication challenge message (e.g. c055258b829d89bc). Each challenge message is unique. If I know the 512-bit secret key that was used to create the ...
9
votes
1answer
379 views

Do readers for the “Mifare DESFire EV1” smartcard really need to know the card's secret key in order to authenticate the card?

I'm trying to understand the security of a contactless smartcard system, used for access control and payment. The card is a Mifare DESFire EV1 implementing ISO 14443 (see the this documentation ...
1
vote
1answer
62 views

Encryption that service provider themselves cannot decrypt?

I recently saw the following message verbatim on an online application I use. The login is simply a login/password combination. There is no oauth, no two factor authentication, etc... This sounds ...
4
votes
2answers
84 views

Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys)

I often ssh into servers for work and play using dynamic dns with ssh keys that are password protected. Twice now (shame on me!) I have mistyped the dyndns.org part of the address and been greeted ...
22
votes
13answers
4k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
1
vote
3answers
335 views

Prevent or detect key copy

This question can be classified as somewhat two interrelated questions - or two goals. Main aim is basically to authenticate client to server, but remain secure even if someone steals the key from ...
1
vote
1answer
64 views

What type of authentication should I use, basic or digest? [duplicate]

I know that it is strongly recommended to use both basic and digest authentification with https. Many say that if you use SSL, there are no advandages in using digest auth, and basic auth is safe ...
1
vote
1answer
140 views

Client authentication successful when using a pfx with Java, fails using OpenSSL. Why?

I've been trying to troubleshoot issues with client authentication and am seeing different behaviour when connecting from a Java application vs OpenSSL. A third party has provided me with a pfx, I've ...
5
votes
1answer
79 views

Connecting via SPNEGO/Kerberos out from domain

Is it possible to authenticate to SPNEGO/Kerberos server in domain A with an account from the same domain (obviously) when the client is connecting from computer in one of the following (quite ...
9
votes
3answers
643 views

Do client certificates need to be trusted by the client?

I'm looking for some clarification around the trust requirements (if any) of client certificates. I'm working with a third party to access their services via Mutual TLS. I generate a CSR, send it ...
2
votes
1answer
63 views

SSH Server Authentication

I know this question was asked several times in several ways, for example: Can an SSH server fingerprint be spoofed? What stops an SSH server from MITMing logins? However, none provided the ...
1
vote
2answers
1k views

Improving stateless REST API authentication token - or ditch it for database persistence?

I'm looking to implement stateless REST authentication into an API. I've been reading up on articles here, and have implemented an idea that works, but I was hoping to get some feedback on its ...
2
votes
1answer
87 views

How to achieve authentication using symmetric cryptography

Here, message authentication is defined as A MAC authenticates a message. If Alice sees a message and a MAC and knows the associated secret key, she can verify that the MAC was produced by a ...
2
votes
1answer
87 views

Handling Authentication without a unique username or password

Working on a project and I have to authenticate a user that does not have a username ( '' ) or a password ( '' ). There are users and guest_users, but a guest_user won't have to explicitly log-in, ...
1
vote
0answers
26 views

fakeauthentication is working when my belkin belkin router f7d2301 mac-address filtering enabled

Actually i have enabled mac-filtering in my belkin router and the security policy is none and the authentication is open authentication. Iam(attacker) using kali linux. when i done a fakeauth attack ...
3
votes
1answer
125 views

Use salt as identifier for crypted session id in database based authentication system for webapp

I have written a database-based authentication framework for webapps I am planning to program in the future. The framework is implemented by using the plpgsql-language of a PostgreSQL-Database and ...
50
votes
4answers
50k views

How do I secure my REST API?

In Detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
0
votes
0answers
36 views

Is it appropriate to request a bounty for finding exploit on major site? [duplicate]

Long story short, I found an easily reproducible, very easy, and honestly embarrassing exploit on a major (yes, major) financial institution's online banking site today. It's not directly tied to ...
2
votes
2answers
81 views

Log User In Automatically After Clicking Account Activation Email

Scenario: Forum account registrations, user must click an activation email after they sign up e.g. they create an account with username, email, password, and an email is sent to the email they select. ...
3
votes
1answer
72 views

Using the password, among other values, as key data in two-factor authentication

I'm writing an implementation and a thesis about two-factor authentication, and am currently doing some research. I'm currently looking at an implementation for deterministically generating a ...
52
votes
6answers
6k views

Has a benefit been demonstrated for credit card machines asking for ZIP code?

In the U.S., many credit card machines at places like gas stations have started asking for your ZIP (postal) code to use a credit card ostensibly to help verify that you really are the cardholder, ...
1
vote
1answer
38 views

Authentication system for a web service

I am building a web service which i will be launching in near future. Service is more or less like online classifieds. Now, i need to build a mechanism to collect user's information, enough to trace ...
3
votes
1answer
517 views

How to supply HTTP Basic Authentication details in OWASP ZAP proxy?

I am using Basic HTTP Authentication to log into my Web Application. The credentials are Base64 encoded and sent to the Server. OWASP ZAP Proxy is intercepting the request and I can see the ...
1
vote
0answers
33 views

Is our internal SSO design secure? [duplicate]

We use one primary web app that was built internally and 3 other web apps that we did not build but that we do host. I want users to only have to sign into the primary web app, which uses Google auth. ...
-1
votes
1answer
53 views

When I visit a site using HTTPS is it exposed to sniffers? [duplicate]

Say for example I visit https://foo.com. Could someone that is sniffing the network determine that I am going there? At what level does the https encrypt the request? I know that data is secured ...
2
votes
0answers
32 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...
2
votes
0answers
84 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
7
votes
3answers
1k views

Do we still need to encrypt/decrypt data in Application Layer, despite using TLS/SSL?

Actually I got some projects from my ex-colleagues. These are App-Server TCP socket based applications. I noticed that some of auth/login interactions are using RSA/AES encrypt/decrypt as I know, if ...