Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

4
votes
3answers
7k views

Do you need to encrypt session data?

I came across a session management class in PHP which encrypts session data in the session storage folder (i.e., /tmp) and can be decrypted later in your script using a key. I was wondering if it's ...
4
votes
2answers
570 views

intrusion detection on own hotspot?

Is it possible to detect failed logins on the hotspots you create with your windows/linux laptops? So you can detect some dumb brute force/guessing attempts? For example, a log like this: TIME DATA - ...
2
votes
1answer
682 views

Is it possible to Spoof a TeamViewer ID?

I am using 2 forms of remote access to my Windows Server 2008 machine, both go to the Admin account since we only use it to host a Minecraft (MC) Server. Remote Desktop, that goes over a custom port ...
23
votes
2answers
3k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
11
votes
1answer
574 views

Fell for phishing scam. Is my gmail account with 2-step verification vulnerable?

I can't believe it happened to me but I entered Gmail account's user-name and password into a website as part of a phishing scam. I use Gmail's 2-step verification and have changed my password. Is ...
9
votes
3answers
470 views

Security of pronounceable passwords

Some random password generators support the generation of pronounceable words of any given length n. Assuming that words are derived using 26 lowercase letters, the number of possible words of length ...
9
votes
1answer
68k views

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific ...
9
votes
2answers
894 views

My bank makes me enter my password using the mouse. What's up with that?

Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
8
votes
6answers
2k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
8
votes
4answers
5k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
8
votes
3answers
727 views

Which authentication at the end of the Secure Remote Password protocol?

For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this: M = H(A | B | K) --> <-- H(A | M | K) ...
8
votes
2answers
522 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
6
votes
1answer
759 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
6
votes
3answers
925 views

Attack vectors for brute-forcing website passwords

When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
6
votes
3answers
1k views

What authentication system (OpenID, Facebook, etc) permits Javascript-free and/or Cookie-Free operation?

I'm looking for an authentication system that relies on 3rd parties (ADFS, OpenID, SAML) but doesn't rely on cookies or Javascript... or at least can make them optional. My intent is to gracefully ...
5
votes
2answers
483 views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at http://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
5
votes
1answer
2k views

Hotspot with same SSID, how does authorization work?

My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network. If someone sets up ...
5
votes
1answer
3k views

WCF - Is this a good security Architecture?

I am building an information recording system (WCF based) for a business that is accessible by staff over the internet. This software will not be distributed and there will only be a handful of users ...
5
votes
2answers
1k views

How to login and encrypt data with the same password/key

I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
5
votes
2answers
198 views

What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?

In many organizations these days, employee IDs are very mutli-functional. They can serve as: Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
4
votes
2answers
643 views

Safety of using web based proxy?

Lets say for example I have to use a public online proxy like https://www.zend2.com to load a PHP webpage controlled by me containing sensitive data over HTTPS. How would I make sure that the proxy ...
4
votes
3answers
626 views

How can I verify the identity of a US | UK -based person and prevent *fake identities* from being accepted?

Given that it's possible to fake ID cards and fake social security numbers are created, I need to ensure that all users of my site are US or UK based citizens, and don't have more than one account. A ...
4
votes
3answers
472 views

Is this admin area secure enough?

EDIT: Please view the revised question instead The admin area has special access to the database (modifying orders, etc). To help explain, I drew a diagram, so here is my process: Notes: I ...
3
votes
1answer
294 views

Login to one site using other site's credentials

I am frequently seeing websites that allows a user to log-in to their site using other websites log-on credentials. If there is a page that allows me to log-in using my google account or facebook ...
3
votes
2answers
267 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
3
votes
2answers
605 views

How to use TPM to perform platform authentication?

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the ...
3
votes
4answers
255 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
3
votes
2answers
369 views

Is there any way to cryptographically hash a human thumbprint?

Is there any way to cryptographically hash a human thumbprint into a form that can be consistently reproduced by thumbprint readers? Assuming that it would be possible to create a database of ...
3
votes
1answer
3k views

Please explain Time-step in Time-Based One-Time Password Algorithm

I am studying about OTPs (One Time Passwords). I have gone through all the methods: HOTP (HMAC-based One Time Password), TOTP (Time-based One Time Password) I have no issues with HOTP. But according ...
3
votes
4answers
1k views

Can SMS text messages be used to verify a person's unique identity through a short code system?

We run online contests and want to eradicate cheating (yeah right), or at least mitigate it. I've asked the question regarding user experience here: ...
3
votes
1answer
316 views

How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?

I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
3
votes
2answers
3k views

Is it possible to change the admin user/password remotely on a router without logging in?

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
2
votes
2answers
325 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
2
votes
5answers
284 views

Can extra loading times on login attempts be a security threat?

I have a web application built with PHP with a login page where the visitor is supposed to enter his / her account's email address and matching password. Since I'm using the PHP native (slow) hashing ...
2
votes
5answers
1k views

Is asymmetric encryption vulnerable to man-in-the-middle attacks?

I'm looking for ways to send private messages over a public channel, and in doing this I stumbled in asymmetric encryption, which is just perfect for what I was looking for at first - A and B ...
1
vote
2answers
76 views

Is it Safe to Send an Invalid Password Back to the Client?

It is common for websites to remember the username input value after an invalid login attempt but not the password input value. Take SE for instance. When I attempt to login with an invalid password: ...
1
vote
1answer
893 views

PHP unserialize() object injection

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how this really is exploitable? ...
1
vote
2answers
158 views

Authenticated sessions and Man in the middle

I see a lot of websites (including Stackoverflow) using this authentication mechanism: Client authenticates under HTTPS and gets back a session id. Client drops back to HTTP and accesses secure ...
1
vote
1answer
371 views

How does the MITM (Man in the middle) attack happen with respect to SQRL

I recently looked into SQRL and was intrigued by its simplicity. At first glance it seemed reliable and its author claimed it was inherently fail-proof against phishing and MITM attacks. But upon ...
1
vote
2answers
1k views

mutual authentication between two clients

I understand how mutual authentication works between a client and a server, however I am unsure how I would be able to get mutual authentication between two clients A and B? What would be the best ...
1
vote
2answers
1k views

Signed request vs HTTP digest auth for API authentication?

By signed request I mean something like this (simplified example): Client creates a sig in his request: $sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
1
vote
1answer
544 views

Web application software architecture: basic security

I am a complete beginner in the security topic and I know that I should read this, but I have a small question to which I hope exists a short answer. Let's say I have three components of a ...
0
votes
1answer
131 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
2answers
564 views

Do Google 2 Factor Auth backup codes work for logging into Google or other sites?

I set up Google 2 Factor Auth to log into other sites. I see there are backup codes if you lose your device. Are these used only to log into Google, or can they be used to log into other sites?
0
votes
1answer
627 views

How do I constrain Windows Smartcards for AD Authentication so that “anyExtendedKeyUsage” is not implied?

This document describes how there are 3 ways to constrain a SmartCard certificate The Enhanced Key Usage field defines one or more purposes for which the public key may be used. RFC 5280 states ...
-7
votes
1answer
138 views

How to attack on a web page to gain username and password? [closed]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
14
votes
3answers
809 views

What can I do if my bank thinks my date of birth is “known only to me”?

My bank has recently replaced passwords with occasionally asking me information that is "known only to me". Such information includes my date of birth, postcode, and my mother’s maiden name. ...
11
votes
5answers
931 views

Non-OEM Biometric Software?

Most of us with fingerprint readers and such devices probably use the software provided by the vendor, to enable biometric OS login or single sign-on functionality. However, I've recently wondered if ...
10
votes
3answers
323 views

Is there any conceivable reason to prevent a password change in an authentication system?

I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
9
votes
2answers
1k views

How does Google detect new devices for two factor authentication

When you enable two step verification for google accounts, you get sent a code by SMS to enter in addition to your username and password the first time you log in with a new device. How do they ...