Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
0answers
43 views

Some very (very) strange issues in wpa handshake [closed]

I have a router (actually it is an android phone as an access point) with wpa2 AES encription, and I'm trying to crack the password with a very small word list. Strangest thing is, when I use ...
2
votes
2answers
89 views

Why do popular two factor authenticators use shared keys

Please correct me if I'm wrong anywhere, but from what I understand , popular mobile phone based two factor authenticators like Google Authenticator implements TOTP which uses a shared secret key that ...
0
votes
0answers
35 views

how can I authenticate a process from kernel side?

I would like to authenticate and integrity check a single process before its execution. That authentication and integrity checks should be on kernel side for obvious reasons. I was thinking to add ...
3
votes
2answers
244 views

Preventing Illegal Access to Webservice

Let me start off by saying that I read other StackExchange questions related to this and they weren't really able to answer my question. I have a feeling this may be an unsolvable problem, but I'm ...
2
votes
1answer
86 views

Protecting a statistics endpoint

When we download an application - it asks us whether it's ok to submit statistics, error reports to the vendor. Since this data is sent from the application to server endpoint - I am wondering how ...
14
votes
5answers
2k views

What is the difference between login throttling and temporary account lockout? [closed]

I am currently working on the redesign of a login page. I have initially suggested that login be throttled whereby pauses (incremental - in number of seconds) are introduced between each failed login ...
1
vote
1answer
497 views

PHP unserialize() object injection

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how this really is exploitable? ...
3
votes
1answer
418 views

How does the Fake Authentication Attack from aircrack-ng work?

I'm making a school project about the AP attacks and I'd like to know how does the Fake Authentication Attack from aircrack-ng actually work and how to prevent it? I read a lot of articles but ...
1
vote
3answers
128 views

Validating Credentials - Logic in Application vs Database

I am studying Web Application Security, A Beginner's Guide Paperback – November 3, 2011 by Bryan Sullivan (Author), Vincent Liu (Author) On pp 69, "Validating Credentials", they say you can ...
-3
votes
1answer
82 views

Authentication protocol based on hash function [closed]

Is it possible that Alice can authenticate Bob without using any secret information except her password, i.e they don't share any thing else. If so, how can I authenticate Alice and ensure the ...
0
votes
0answers
61 views

Detection of pass the hash

I have researched about PTH Attacks but yet found any solid way detecting it in a network.is there a way to detect a pass the hash ? analysing the windows message from the dcs or something ?
0
votes
1answer
184 views

What are the pros and cons of enabling 2 factor authentication on internal user workstations of an organization?

An organization has all the regular controls you can think of for network and systems protection from the 10 security domains. External login access to the organization's services is protected with 2 ...
5
votes
7answers
3k views

Techniques to make a login page safe without using SSL

I am developing a web page where people can write and comment things (no personal informations required) and I need to put a log in form so users can see all their actions on my web page. My idea is ...
0
votes
1answer
65 views

How much security would I lose if I enabled “easy enter” pins on an android device?

There is an option on android devices to unlock when the correct pin/password is entered, but without the user explicitly pressing the "done" or "enter" button. How much security does this remove from ...
0
votes
1answer
52 views

Is there a way to securely lockdown a website to an Iphone?

So with a typical website, perhaps the fastest and most effective (arguably) way to secure the site is to add a simple .htaccess and restrict by ip addresses: .htaccess DENY from ALL ALLOW from ...
2
votes
4answers
255 views

How is security of server's RSA private key is ensured?

We repeatedly hear news of hacking of passwords from PW database (server side) but nothing about hacking of server's RSA private key (not asking regarding finding p and q for a given public modulus ...
0
votes
0answers
48 views

Federation Service to Azure with users from trusted domain.

I want to set up a website on Azure according to the following requirements and are wondering if it is even possible? As a internal team member, I must be able to login to the site with Windows ...
0
votes
1answer
91 views

SSH and shared secrets

There was a question on a quiz I took, about different authentication methods that SSH uses. The answers were combintions of the following four: username/password public key authentication shared ...
0
votes
2answers
82 views

Access token vs. UserID + access token

My goal is to associate (authenticate) hardware devices to users in the database. The access token is generated via webinterface. It is then entered into the hardware device by the user, and the ...
0
votes
2answers
94 views

Effective Free and Anonymous Web Form Encryption

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates ...
2
votes
1answer
83 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
0
votes
0answers
23 views

How does WebID fit in the SAML picture?

How does WebID fit in the SAML picture? Are they related or completely unrelated? Can they work together? If yes, what are the benefits?
0
votes
2answers
76 views

Legality of cookie(set by other sites) tracking

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to ...
0
votes
2answers
100 views

Open email accounts on public computers

When I use a public computer at a certain location, logging into the workstation and going to a site like gmail.com (to check my email) I find that another user is already logged in. Same happens for ...
4
votes
1answer
125 views

How is a Tor hidden service authenticated based only on trusting the address?

While being fascinated by how it is possible to create hidden services with Tor, there's a few details around the address collision issue I can't seem to wrap my head around. Quote from Hidden ...
1
vote
1answer
231 views

Authenticated Diffie Hellman Key Exchange

It appears that the textbook version of Diffie-Hellman is susceptible to man in the middle attack and the use of digital signatures could prevent this attack from occurring. Digital signatures could ...
0
votes
1answer
101 views

What's the typical approach to caching invalid authentication attempts?

Clients (actually software pieces developed by some random dudes all over the Internet) are authenticating on a web server using "basic" authentication scheme and to do so they are passing the ...
2
votes
1answer
59 views

BTLE pairing: Where does the code come from?

When trying to pair 2 bluetooth LE devices (e.g. 2 iPhones), a popup shows up that requires to input a code displayed on the other device. I am aware of the concept of out-of-band authentication, and ...
7
votes
4answers
1k views

How to prove Bob has received Alice message

I have read up on Digital signature and it is stated that it provides non-repudation. Assuming Alice signs the message using her private key and sends it to Bob, Bob can use Alice's public key to ...
0
votes
1answer
70 views

Does encrypting the message protect it against length extension attacks

Assuming the following HMAC is used : HMACK(M) = Hash(K||M) = H which is "secret-prefix" hashed function. M is the plaintext message , K is the secret key used The ciphertext is generated as follow : ...
1
vote
0answers
45 views

Best way to authenticate for Funding balance with API call [closed]

I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API. What would be a good ...
1
vote
2answers
132 views

Is it possible to restrict email accounts within one computer?

can emails(e.g gmail)can be configured to open-up only in my laptop ,my operating system is windows 8 and is it possible to restrict my gmail account to be opened up only in my computer?Usually we ...
9
votes
3answers
395 views

Security of pronounceable passwords

Some random password generators support the generation of pronounceable words of any given length n. Assuming that words are derived using 26 lowercase letters, the number of possible words of length ...
5
votes
2answers
284 views

Using Client-side certificates for Authentication

Why aren't client-side certificates used for Authentication? Then user has to remember only 1 password to unlock his windows account which stores the certificates. I understand that if user access ...
6
votes
3answers
1k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
13
votes
3answers
3k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
1
vote
1answer
232 views

Using cookies for cross domain authentication

I have an web app 1 which would do the authentication of the user. After that I want to forward the request to another web app 2. Now web app 1 will generate some hashcode which I can authenticate in ...
5
votes
2answers
201 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
56
votes
13answers
8k views

Do we really need a long and complicated password for websites?

Most of websites that handle important information (Gmail, for instance) have some kind of brute force protection. Sometimes if you try more than X times it will lock the account or at least give you ...
2
votes
1answer
96 views

Why are PGP signatures not more widely used as an authentication method?

Example: Bob generates a key pair for this example. Bob registers at example dot com where he provides his public key. When Bob will try to log in, example dot com will ask him to sign a random ...
1
vote
1answer
97 views

Domain socket authentication as in MySQL and PostgreSQL secure?

Are authentication mechanisms based on UNIX domain sockets (Linux) secure? And more specifically, are the respective MySQL and PostgreSQL implementations on Linux secure? The background for my ...
2
votes
1answer
114 views

L2TP/IPSec: Mutual authentication BEFORE user can access VPN

I came across a question You are the network administrator for your company. You have deployed Windows Server 2008 on all server computers in your company. You have deployed the Network ...
1
vote
1answer
443 views

Forcing eap-TLS 1.2 authentication with FreeRadius and OpenSSL

Been working with TLS DHECE Certificate Based Handshake with a FreeRADIUS Server and wpa_supplicant- both running OpenSSL 1.0.1j FIPS. Afer watching the Wireshark traffic, I notice that the client ...
19
votes
4answers
2k views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
2
votes
2answers
113 views

Code Signing Confusion

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
0
votes
1answer
127 views

Is a Cloud-Connected Door Lock More Secure Than a Traditional Lock and Key?

Now that app based door lock replacements are getting more popular in the market, I'm wondering what the security risks are and why or why not this is more secure than an old fashioned lock with a ...
6
votes
1answer
470 views

Why should I persist OAuth 2 access tokens along with refresh token

That's something I've came across in a couple articles about OAuth 2: when it comes to persisting refresh tokens to database some authors prefer to store access token as well, or at least mention it ...
1
vote
1answer
64 views

Is selecting trusted computer in 2-step verification less secure?

In using 2-step verification, does selecting 'Trusted Computer' a less secure options? https://support.google.com/accounts/answer/2544838?hl=en If so, is it still a reasonably secure option?
0
votes
2answers
156 views

Stateless session cookie and logout

I have implemented stateless session cookie, something along the lines of this article: Demystifying Web Authentication (Stateless Session Cookies) The cookie contain an expiry time within the ...
3
votes
1answer
150 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...