Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
0answers
181 views

Safe communication via rest api between two known servers

i would like to have some advice on the following scenario: I'm using kinvey as backend but because it doesn't provide the ability to run custom code i have set up another server. So basically when x ...
5
votes
2answers
262 views

Can I trust large companies like Google not to store failed password attempts?

Let's say, for example, that I accidentally entered my Microsoft account password instead of my Google account password when logging in to some Google web service. After getting an error message, I ...
1
vote
2answers
241 views

What is it common to only say “username or password is incorrect” in case of login errors? [duplicate]

When logging in to a site with wrong user/password credentials, the displayed error is most generally a generic "username or password is incorrect". Looking into some PHP code that handles such login ...
2
votes
1answer
443 views

Android access tokens and access to all google services

My questions is based on the asnwer on that question: Can the Gmail password be recovered from the Android Gmail app? So, as I understand when we setup google account on Android devices, it stores ...
7
votes
3answers
1k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
1
vote
2answers
300 views

When do you use OpenID vs. OpenID Connect

Can they be used together? ....or are they two separate protocols that may or may not be useful depending on the context? The reason I ask is because I'm trying to implement the following: User ...
1
vote
3answers
161 views

How to figure out who is pummeling my WP install with bogus login attempts

I have a WordPress install which uses the plugin Wordfence. I set Wordfence to block the IP of anyone trying to log in with a non-existent username. For several months now, I have been getting many ...
1
vote
0answers
46 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
3
votes
1answer
2k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
2
votes
3answers
138 views

Message authentication code based on a single AES block

I think I need to use a MAC for ensuring the integrity of a URL that my system will provide to an end user that will use it to download a content from another component of the system, i.e., an URL has ...
1
vote
0answers
113 views

Routing Protocol Encryption

As far as I know 'newer' versions of routing protocols support authentication between routers. What about encryption and integrity checks? Some implementations like this one from Cisco use MD5, which ...
1
vote
1answer
110 views

Is using an old Android phone for 2-factor authentication safe?

I apologize in advance if this is the wrong place to ask this, I didn't know a better place to start. I have a rooted HTC Hero (CDMA) that is no longer receiving service and is just kind of...sitting ...
1
vote
4answers
120 views

Are there any web services which use any other form of authentication, than passwords? [closed]

Out of curiosity and interest I was wondering if anyone had come across any web based services which offer users other forms of authentication, other than the standard password or PIN? Or if ...
4
votes
3answers
949 views

Safe to expose Active Directory via LDAPS externally?

We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs? Addendum 1: Our business case, ...
3
votes
1answer
433 views

What are the risks posed by “pass-through authentication” and how are they mitigated?

Related: Local Admin has Domain Admin rights "Pass-through authentication" on Windows systems allows for the possibility for user accounts with the same name and password to impersonate one ...
1
vote
1answer
191 views

Local Admin has Domain Admin rights

While installing a new XP machine that had not been connected to the domain I was browsing to a UNC path and was not prompted for authentication. I then went to the different mapped drives and found ...
1
vote
3answers
209 views

How safe is it to provide my administrator account password for a 3rd party software: EasyUS Todo Backup?

I've been recently searching for a backup solution for my Windows desktop. That's when I came across this free software called EasyUS Todo Backup. (I know it's a mouthful but English doesn't seem to ...
5
votes
3answers
788 views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
1
vote
1answer
350 views

Additional security for WebRTC/DTLS-SRTP with PGP?

I am having a thought experiment. Can you help me? Two clients who both use PGP. They initiate a WebRTC call using DTLS-SRTP via a 3rd party server. Is there any benefit of encrypting, via their ...
0
votes
2answers
319 views

mutual authentication between two clients

I understand how mutual authentication works between a client and a server, however I am unsure how I would be able to get mutual authentication between two clients A and B? What would be the best ...
1
vote
2answers
135 views

Does this show the need for a two-factor authentication?

I need some help for my understanding while reading through this authentication scheme in WEP. In a WEP authentication scheme, the station first sends a request for authentication. However, this ...
0
votes
1answer
66 views

Payload authentication + HW-SW Binding

I want to authenticate a (2nd stage) bootloader during the boot process using a symmetric key, which is derived from HW properties of the platform the bootloader is running on. Thus, I want to bind ...
7
votes
3answers
2k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
1
vote
1answer
75 views

Certificate Mapping in IIS

When pasting the certificate blob in the configuration editor in IIS 7.5 for one on one authentication, is this the server certificate or the client certificate?
1
vote
3answers
163 views

Are subdomains a cure for phishing?

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
1
vote
1answer
558 views

How can a gmail recipient open email in two different countries, at the same time?

I sent an email to person in Russia, and tracked it with Right Inbox, when the email is opened I get notified. The problem is I get 2 different IP addresses, one in Russia, and one in the US, both ...
4
votes
2answers
328 views

Is HTTP Digest + MD5 still an alternative to consume my own api?

I'm reading a lot about implementing security constraints to a REST API. There are a lot of methods, some better than others for 3party applications or to consume my own API. HTTP Basic + TLS (with ...
3
votes
4answers
245 views

Key-agreement protocol in a REST API

I have a C# REST API which exposes some methods over the HTTP protocol. The API is intended to be used my my Android applocation (Java) which is currently in the makings. Since the app is in an early ...
4
votes
1answer
166 views

Oauth Consumer Secret?

Using OAuth you have a consumer key and consumer secret to identify your application and the user provides an OAuth access token and secret to authenticate your application access to their account, ...
1
vote
1answer
146 views

How to write an authentication module for my website?

This will sound naive for sure, and it is. Being a recent college graduate, I have been wondering on how do average websites implement their authentication modules. I have been using a table storing ...
4
votes
2answers
100 views

Is there a security advantage to requiring a user id instead of just /me in an api request?

Is there a security advantage to requiring a request to conform to /api/1234 instead of /api/me? Both would obviously have access tokens. My guess is that api/1234 is more secure because if someone ...
3
votes
2answers
249 views

Totally secure public key distrubition

Public-key cryptography secures communications provided that you use pre-shared public-keys. The problem is how to share these public-keys while maintaining authenticity? How can we be sure that ...
0
votes
1answer
164 views

Corrupt password being pulled from wireshark data?

Hello everyone, I currently have a pcap file that contains an unencrypted Telnet session, and when I trace the TCP stream the password is in a format like so: pas...ord (please note ...
4
votes
3answers
299 views

Using GET to submit username/password? [duplicate]

From what I understand using GET to submit usernames/passwords is a security issue because the username/password are part of the URL which can show up in browser history. Is this still an issue if ...
0
votes
2answers
123 views

Is it secure if we purchase through a website that is loaded in iframe

I found one of the website is loading all shopping websites in their own domain. Eg . www.domain.com having links like , www.shoppingsite1.com , www.shoppingsite2.com ,www.shoppingsite3.com ...
4
votes
2answers
1k views

Best way to allow sudo access when using ssh keys

Probably a simple question, but I can't seem to find any actual best practices out there. I manage a handful of servers and I am really getting sick of tracking my passwords in pwsafe. I've been ...
14
votes
6answers
6k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This ...
2
votes
1answer
74 views

Authentication of support engineers on client systems

Are there any good methods for authenticating that a user is a maint engineer, or at least trusted enough to use the maint access? The environment is code that is running in client sites, without ...
2
votes
1answer
161 views

Communicate between two sites both with SSL

I now have two websites - site A and B, both with SSL-certificate, and they have exact same users. So when a user log into site A and click the link to site B, I want to make him auto log in to site ...
1
vote
1answer
552 views

Which products are affected by NSA's ability to crack pseudo-random-number generator Dual_EC_DRBG? [closed]

After reading this article about RSA advising its customers not to use the default random-number generator in its encryption products - amid fears spooks can easily crack data secured by the ...
0
votes
2answers
539 views

Google Authenticator - Counter Based [duplicate]

I'm trying to understand How google authenticator - counter based work. I have tried googling around finding a demo or at least how this work. I understand its a one time password but not like TOTP. I ...
3
votes
2answers
95 views

System for securely authenticating content acquisition

I'm having trouble designing a system for authenticated content from my site distributed by other people. I'm working in Ruby on Rails, but I don't think that at a theoretical level my question isn't ...
0
votes
2answers
276 views

Algorithm to generate NTLMv2 Hash in PHP

I am trying to develop a PHP function to calculate NTLMv2 hash by providing server & client challenge, domain, account and password. The resulting hash appears to be not correct. Can someone ...
5
votes
4answers
483 views

Secure authentication: partial client-side key stretching… please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
1
vote
3answers
338 views

Can Paypal be used to verify a user's identity?

As I use my Paypal account for various online services, I noticed that vendors integrate differently with Paypal for on-demand payment, and scheduled payments. I also noticed that Paypal offers a ...
1
vote
1answer
108 views

What is the purpose of Rb in the 3rd step of the 3-pass mutual authentication in ISO/IES 9798-2?

Recently I am studying ISO 9798-2 Three-pass mutual authentication. There are 3 steps, as following: B -> A: NB // B sends to A a "nonce" value NB A -> B: {NB||NA}K // A's identity is proven ...
4
votes
1answer
528 views

Hotspot with same SSID, how does authorization work?

My university has a wireless network I log into with my username and password. It's using PEAP. My phone and laptop automatically connect to this SSID when they detect the network. If someone sets up ...
0
votes
1answer
118 views

Storing Seed for TOTP

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
0
votes
1answer
184 views

Challenge, Authentication and session key

I programmed an application on Linux using C, I added an authentication and cryptography layer that's going like this : 1 -client sends connection request. -server send a random challenge to client. ...
1
vote
1answer
343 views

What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp ...