Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
75 views

Limiting Login Attempts [duplicate]

I have to set up a server that will allow remote logins. Obviously security is an issue. In this first pass we are discussing:- Locking a person for 15 minutes if they fail to login correctly three ...
0
votes
1answer
71 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...
3
votes
1answer
1k views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
1
vote
1answer
92 views

OTP for syncing mobile device

Scenario: a web app with two-factor authentication using username/password and hardware OTP. Once logged into the app, one of the app modules should be used in a tablet or any mobile device without a ...
93
votes
17answers
22k views

Is “password knocking” a good idea?

With port knocking, you have to "knock" on specific ports in defined order to expose a port on which service is running. How about password knocking? For example you have three passwords: A, B and C. ...
69
votes
3answers
23k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
1
vote
1answer
49 views

Using a Cryptovariable with an API Designed for Human-Generated Passwords

I'm working with a vendor who provides an API with a user registration method clearly designed for human-generated passwords. We're calling the API in an offline server-to-server fashion, however, ...
1
vote
1answer
215 views

How to secure my REST API once user authenticates with Google on mobile client?

In my application, I build REST APIs so that user can interact with my application server. Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all ...
1
vote
1answer
60 views

Retrieve anonymous credentials

Background A registration process to acquire an anonymous, verified account goes like this: Registrant provides proof of individuality to a Registrar. Registrar verifies proof, ensures no prior ...
2
votes
0answers
254 views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
1
vote
1answer
357 views

Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used. Some options came to my mind: Store the password ...
42
votes
4answers
5k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
-2
votes
2answers
142 views

A Graphical Two-Step Authentication System [duplicate]

Changes made to system proposed in Two-factor authentication Without Mobile Phone: In previous system, shoulder surfing would reveal the user’s pre-decided image. In the current system, end image ...
2
votes
1answer
66 views

How do Client-specific keys and Certificates work?

I have clients that communicates with my server. Clients sends it unique id (guid) to server with its request over a secure https channel. Also to increase security I use my own private-public key ...
1
vote
1answer
1k views

How can a gmail recipient open email in two different countries, at the same time?

I sent an email to person in Russia, and tracked it with Right Inbox, when the email is opened I get notified. The problem is I get 2 different IP addresses, one in Russia, and one in the US, both ...
3
votes
1answer
1k views

“Extended Protection” primer and implementation guide to prevent MITM

Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks. Does anyone have a primer (or explanation in plain English) what this feature is, ...
2
votes
1answer
72 views

Is TLS enough to prevent eavesdropping? [duplicate]

Is it enough to use only SSL/TLS for client-server application with authentication, registration and data transmission (like chat)? If it is not what I also need to use?
1
vote
2answers
82 views

Circumventing disadvantage of IP-based account lockout

So we're trying to prevent brute-force attacks on our web server login page--currently we just do IP-based locking if x failed attempts from IP address Y occur over z time period. After a security ...
0
votes
0answers
62 views

How to associate an oAuth token with a particular user. Is this possible?

We have HTTP Rest services and SignalR (aka Web sockets, server send events, etc) for cases in which we need to push data from the server to the Web UI . We are currently using the built in tools that ...
4
votes
2answers
71 views

FIDO: what is the benefit of the challenge parameter?

In the enrollment stage an attacker could intercept the message and answer with a signature based on the correct challenge. I know that normally you include a symmetric secret in such a challenge, but ...
1
vote
0answers
36 views

authentication token not stored in DB

I am implementing a webserver and the guideline I am following suggests: - to create token by a Serializer that takes the IdUser, a symmetric key and an expiry date - provide it to the user but not ...
1
vote
0answers
94 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
0
votes
0answers
37 views

Additional security for services hosted on a 2FA or Multi-Factor Authenticated Network

I am aiming to lock down a web service that accesses other services and has a publicly facing UI. I have a hosted service on a network that requires 2-factor authentication to access. This service's ...
0
votes
1answer
138 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
3
votes
1answer
62 views

Is it possible to restrict a client-side certificate (for web auth) valid only for a given site name?

If I have 2 websites, a.example.com and b.example.com. Those sites use TLS and SNI, and require client authentication with certificates created with my own CA. The use case is that some clients have ...
0
votes
3answers
133 views

What is a good way to authenticate a user to websites and applications with a smart phone?

What would be a good way to authenticate a user to authenticate to websites and applications over a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be ...
1
vote
1answer
103 views

How do MACs provide authenticity?

I don't see how they're different then hash functions. Couldn't Alice use Bob's key to produce a MAC and send the message to Jim.
0
votes
1answer
112 views

Can Google's administrators be trusted with Google Authenticator? [duplicate]

Suppose there is an evil Google administrator who has full access to every server or network at Google. Will such a person be able to abuse the Google Authenticator technology to gain access to ...
0
votes
1answer
146 views

Drawbacks of using ADFS for SSO for external users

Is there any drawback for creating a separate AD forest for external users of organization to authenticate them to access some web applications? Is there any performance and synchronization issues ...
0
votes
1answer
59 views

How Google Authenticator in Android mobile identifies this is the right SSH server?

I am new to Google Authenticator mechanism. I gone the basics of mechanism but I couldn't understood what logic behind that to make a connection to the Linux machine. I have a Linux which have no ...
3
votes
1answer
199 views

Best practices for passwords on registration?

I have a website which users register an account. On the registration field, the form fields are: Name Email Confirm email Username But there is no password field. When they hit submit, they are ...
5
votes
2answers
122 views

Four eyes authentication for command execution on Linux. (OS level) [closed]

I reached the end of the internet with no success, so now I turn to you guys. What I'm after is a way to implement four eyes principle on the OS level for certain commands in Linux. Example : The ...
3
votes
1answer
818 views

Session Authentication vs Token Authentication

I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the ...
34
votes
3answers
71k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
1
vote
0answers
73 views

Questions about SRP algorithm

I trying to use SRP algorithm but I have some questions: Is that a good choice to use for registration and authorization SRP algorithm with SSL/TLS? And for all other transmission using just ...
5
votes
3answers
6k views

How are “security levels” of identities in TeamSpeak 3 implemented?

TeamSpeak 3 VoIP communication system uses a concept of so called identities to identify the client to the server. These identities are basically public/private key pairs. In order to prevent people ...
19
votes
5answers
3k views

How to uniquely identify users with the same external IP address?

I have created a login module on my website. I was able to deal with simple brute force attacks since I can identify the user based on username/email and throttle their login based on failed login ...
0
votes
0answers
81 views

Brute-forcing a RSA private key password vs. LUKS volume

I need to store various private keys for my clients. Given these options, what would be the least prone to brute force attacks: Encrypt the private keys using a separate RSA key (each user get its ...
0
votes
3answers
104 views

Two factor authentication(Mobile)

Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
0
votes
1answer
100 views

Mechanism used for offline authentication of software

To prevent user from downloading bootleg copies of software , users often have to enter a string of hexadecimal numbers which would be used to authenticate the user. I think the basic idea would be ...
27
votes
7answers
3k views

What is a good way to authenticate a user to a smart phone?

What would be a good way to authenticate a user to a smart phone? By good, I mean that it is both secure, and user-friendly. Passwords don't seem to be the best fit because a password needs to be ...
1
vote
1answer
52 views

What is the term for requiring a user to go through an additional activation/verification process on new devices only?

When I log onto my bank's website on a new device (be it a new phone or a web browser I haven't used before) it prompts me to send an activation code to my phone or email. I have to enter in this ...
1
vote
2answers
125 views

Breaking mysql username and password form [closed]

I have two versions of a website. The first one has no security precautions against sql injections. So if I try something like: Username: hello_world Password: ' or ' 1=1 I'll be signed in as the ...
6
votes
1answer
186 views

Can/do botnets brute force “high value” users of services like Gmail?

On an intranet a login is generally disabled after a very small number of failed logins. But a public email service like Gmail can't do the same, otherwise pranksters would just be continuously ...
0
votes
1answer
71 views

Client authentication [closed]

Assume a server which offers some information which must not be exposed publicly. A client of this which may be e.g. a windows service (or at least something executing headless) needs to access the ...
3
votes
1answer
119 views

Can sms-only authentication be safe?

many Android mobile applications (e.g., Whatsapp, Telegram), when used for the first time on a device, "authenticate" users by sending them a secret code in a SMS message. The same mechanism is used ...
2
votes
1answer
77 views

What is the best way to be sure of user's identity?

Not sure this is the right stack to ask this in, it's kind of an abstract question. Say you have a website where it is very important that the personal information provided by the users is authentic. ...
1
vote
1answer
78 views

Why is a cookie's life extended after half the time has passed on a sliding expiration algorithm?

I'm coding my sliding expiration algorithm for Bearer tokens to mimic what's done by Microsoft on their FormsAuthentication logic, and reading their documentation they say (emphasis added) When ...
0
votes
0answers
41 views

Implementation of AEAD_AES_256_GCM and AEAD_AES_128_GCM ciphers in secure RTP

I am in the process of implementing AEAD_AES_256_GCM and AEAD_AES_128_GCM ciphers in secure RTP. There is a mechanism in RFC 5116 to implement the algorithm, but I am not able to find any sample code ...
1
vote
1answer
100 views

Encrypted access tokens - expiration date

My idea is to use encrypted tokens - where upon authentication (with username and password), backend would encrypt user_id, timestamp and an SHA-256 over those, base 64 encode it and return to the ...