Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

5
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...
4
votes
2answers
564 views

Safety of using web based proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a PHP webpage controlled by me containing sensitive data over HTTPS. How would I make sure that the proxy ...
4
votes
3answers
566 views

How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?

Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account. A ...
4
votes
3answers
455 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I ...
3
votes
1answer
151 views

Login to one site using other site's credentials

I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook ...
3
votes
2answers
226 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
3
votes
4answers
217 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
3
votes
2answers
357 views

Is there any way to cryptographically hash a human thumbprint?

Is there any way to cryptographically hash a human thumbprint into a form that can be consistently reproduced by thumbprint readers? Assuming that it would be possible to create a database of ...
3
votes
1answer
3k views

Please explain Time-step in Time-Based One-Time Password Algorithm

I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password) I have no issues with HOTP. But according ...
3
votes
4answers
1k views

Can SMS text messages be used to verify a person's unique identity through a short code system?

We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
3
votes
1answer
308 views

How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?

I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
3
votes
2answers
2k views

Is it possible to change the admin user/password remotely on a router without logging in?

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
2
votes
2answers
212 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
2
votes
5answers
276 views

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
1
vote
1answer
598 views

PHP unserialize() object injection

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how this really is exploitable? ...
1
vote
2answers
132 views

Authenticated sessions and Man in the middle

I see a lot of websites (including Stackoverflow) using this authentication mechanism: Client authenticates under HTTPS and gets back a session id. Client drops back to HTTP and accesses secure ...
1
vote
2answers
990 views

mutual authentication between two clients

I understand how mutual authentication works between a client and a server, however I am unsure how I would be able to get mutual authentication between two clients A and B? What would be the best ...
1
vote
2answers
1k views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
1
vote
1answer
473 views

Web application software architecture: basic security

I am a complete beginner in the security topic and I know that I should read this, but I have a small question to which I hope exists a short answer. Let's say I have three components of a ...
0
votes
2answers
411 views

Generating authentication token from PHP sessions

I have a traditional PHP site which uses sessions. I've developed a real-time app in nodejs and wish to authenticate users here based on their PHP session. The procedure would go something like this: ...
0
votes
1answer
105 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
2answers
473 views

Do Google 2 Factor Auth backup codes work for logging into Google or other sites?

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device. Are these used only to log into Google, or can they be used to log into other sites?
0
votes
1answer
588 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states ...
-7
votes
1answer
84 views

How to attack on a web page to gain username and password? [closed]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
14
votes
3answers
729 views

What can I do if my bank thinks my date of birth is “known only to me”?

My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name. ...
11
votes
5answers
797 views

Non-OEM Biometric Software?

Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
10
votes
3answers
311 views

Is there any conceivable reason to prevent a password change in an authentication system?

I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
9
votes
2answers
981 views

How does Google detect new devices for two factor authentication

When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device. How do they ...
9
votes
2answers
4k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
8
votes
3answers
2k views

iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

With such a big deal being made about the iPhone 5S's fingerprint reader (and formerly the Thinkpads' fingerprint readers) I really wonder how secure it is to use fingerprints in lieu of passwords. ...
8
votes
5answers
1k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
8
votes
2answers
640 views

Is a rand from glibc's rand secure for a login key?

Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
7
votes
3answers
1k views

What are the security implications of using TOTP for single factor authentication?

(Note: I am not actually planning to do this. This question is strictly theoretical.) TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
7
votes
2answers
658 views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
6
votes
2answers
668 views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
6
votes
2answers
673 views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: why use ...
6
votes
3answers
1k views

Using Secure Remote Password without sending the username in the clear

To initiate a key exchange using the SRP protocol the client sends the username so the server can look up the salt and password verifier. Is there a simple way to change this so that an evesdropper ...
6
votes
3answers
2k views

Is the OpenPGP private key inherently password-protected?

I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key? Essentially, ...
5
votes
2answers
230 views

How can I enable opportunistic encryption for my web-site?

As per an honourable mention in an answer for « Why self-signed https is less trustworthy than unencrypted http? », it appears that there are already two post-Snowden drafts that have to ...
5
votes
1answer
282 views

Does DPAPI works if a user hasn't a login password?

I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
5
votes
3answers
364 views

Authenticating client without hardcoding key?

A basic question, but I'm not a master and this is puzzling me- How is it possible to authenticate a client from the server's perspective? i.e. imagine you're the server, and you want to give the ...
5
votes
2answers
3k views

How is user authentication sent in a public wifi? Radius/802.1x/EAP etc

I visit the airport, I pull out my laptop and connect to a network (no password needed). I open up my browser and i am presented with a screen saying I need to pay to use the network. If I pay, I ...
5
votes
8answers
661 views

Biometric authentication in the real world

can anyone give a realistic estimation, based on real-world experience, of how much biometric authentication techniques are being used in the IT field?
4
votes
4answers
459 views

Should both user ID and Password be masked for online banking?

Is there a best practice for security purposes requiring masking of both User ID and Password for online banking? Is there any rationale for or against masking both?
4
votes
1answer
512 views

How does the “Service Identity” feature of Azure ACS compare (and contrast) to a real IDP?

It appears that the ACS has IDP-style features within the "Service Identities" section. How does the ACS treat these in comparison to a real IDP? What is missing? Some examples I'm thinking of ...
3
votes
2answers
108 views

Isn't this the same as using a certification authority?

Taken from Wikipedia, here is the pretext to my question: A certificate authority (CA) is an organization that stores public keys and their owners and every party in a communication trusts this ...
3
votes
4answers
378 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude ...
3
votes
3answers
792 views

PCI DSS 2.0 and ssh keys

I know the real answer to the auditor. We are a smaller company under 40 total employees that is also PCI level 1 compliant. We've always used ssh keys on internal servers. You can't ssh in from the ...
3
votes
2answers
265 views

Does providing OAuth for mobile apps pose a security threat?

Let's take a look at the basic OAuth workflow: The basic idea is that the Consumer (App) asks the user to grant him access to the Service Provider. The service protects the user by asking him each ...
3
votes
6answers
1k views

How to “demonstrate” man-in-the-middle attack?

I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project). Over the years a bunch ...