Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
0answers
40 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
3
votes
3answers
81 views

Central auth service redirecting to subdomain, using digital signature as auth token

I'm working on a "proof of concept" of a central auth service (not CAS). There are holes in my understanding of what I need to do, and I have concerns that the "protocol" is not secure. Why/What ...
2
votes
1answer
90 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
1
vote
0answers
24 views

Authenticating requests across a two tier application architecture

Consider the following architecture: Users log into a website and issue commands to the website. In parallel, separate software processes ("agents") on different computers connect to the website ...
3
votes
1answer
144 views

Would this work to protect a cookie with an OAuth token?

I'm currently trying to set up an OAuth 2.0 authentication scheme to protect some stateless REST webservices. These services deal with sensitive information, and the OAuth support is a requirement. ...
1
vote
1answer
39 views

With a known secret key, can I determine the response for an authentication challenge?

I am trying to find a response for a 64-bit authentication challenge message (e.g. c055258b829d89bc). Each challenge message is unique. If I know the 512-bit secret key that was used to create the ...
2
votes
3answers
282 views

Someone shared their google account with me, am I vulnerable?

Recently a friend gave me the credentials to his Google account (GMail and password), so I could check his email while he was on a trip (with no cell signal). He is a trusted friend and not ...
6
votes
1answer
113 views

Do any systems implement a Duress Code?

We've seen it in the movies. A spy or important government agent uses a pre-determined authentication word to not only prove who they are, but also that they are in danger. I have not seen it ...
5
votes
0answers
50 views

How the AWS signature works in depth

I'm trying to understand how the AWS signature 4 works. I read the docs and I found the Python example where a signature is computed ...
1
vote
1answer
124 views

What are WiFi certificates used for? What are they?

Recently my university updated the certificates for authenticating on their WiFi network. I was hesitant to accept it because I wasn't sure what accepting it entailed or even what it was and what ...
2
votes
2answers
99 views

my bruteforce prevention has major downsides - any ideas?

I'm currently searching for the best way to prevent my software's webportal from bruteforce attacks and came up with the following idea: 3 login attempts without any visual challenge after 3 failed ...
3
votes
1answer
49 views

secure user authertication

Here : Help understanding basic user authentication with salts and hashing They explain it pretty well, but i'm still struggling to understand this one part... Now, when a user comes to log in ...
1
vote
0answers
31 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
1
vote
1answer
88 views

NFC - Felica / NXP (Desfire EV1) or ACOS3 which is more secure?

I am new to NFC, and just have been researching on security from different manufacturers, trying to find out which system is more secure with their password protected area. I only know that Desfire ...
5
votes
3answers
162 views

How to prevent a prophecy from becoming self-fulfilling or self-defeating

Let's assume that I have deduced with a high probability what a certain famous person or organization will choose to do at a near-future date. How can I publish any proof of me having deduced this? ...
0
votes
0answers
26 views

Persona combined with stateless token authentication

My REST-Backend is using Mozilla Persona to authenticate users. Normally you would just use cookies to authenticate any further requests but I want to use token based authentication (out of personal ...
1
vote
2answers
60 views

Authentication without registration

Let S be a server and C be a mobile client (iOS/Android App). Assume that the communication between S and C is ciphered with SSL (or any other standard protocol). The system is a voting application, ...
1
vote
1answer
90 views

Pros and cons of security images [duplicate]

Over the past year or so, I've noticed that all of the banking organizations I work with that have or had "security images" as part of their login process have removed or are planning to remove that ...
2
votes
1answer
79 views

What reasons are there to not just send the API key as an HTTP header over HTTPS?

I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
0
votes
2answers
71 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
0
votes
0answers
54 views

Bluetooth LE 4.0 security issues [duplicate]

How does BLE secure communications between devices? BLE 4.0 supports AES128, and the key exchange is done using DH. However, it is often reported that BLE 4.0 has security issues. What specifically ...
2
votes
2answers
132 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
1
vote
1answer
56 views

Encryption strategies for multi users access revisited

This is a follow up to this post: Encryption strategies for multi users access in production systems I don't see how this can work given the second bullet point: Kc is stored on the computer n ...
2
votes
0answers
154 views

NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?

Hi i saw a few threads about NFC NTAG against cloning and NTAG Desfire , i just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
8
votes
3answers
242 views

What advantage does the Bloomberg authentication system have over traditional 2 factor?

Bloomberg clients have an interesting way to authenticate to the server. This seems involve some of the following: Logging into a secure website, that displays a flashing square Swiping your finger ...
4
votes
3answers
363 views

Message Authentication Codes (MACs)

What is the main difference between Message Authentication Codes (MACs) and hash function? Is there any difference regarding their usage domains?
5
votes
1answer
844 views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
1
vote
2answers
120 views

Mobile Phone Client -> Server Authentication based on device

I have a mobile application (Android, iOS) and a server, which handles requests from the application. It is easy to perform standard authentication using SSL, password and random token to ...
1
vote
0answers
69 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
1
vote
2answers
151 views

Questions about user authentication over REST API

I'm now trying to implement user authentication on my android app. I, however, have a few questions. I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
0
votes
1answer
142 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
0
votes
1answer
58 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
2
votes
0answers
69 views

Zero Knowledge Proof Password Systems

I am wondering if there is a practical zero-knowledge proof system that can be used by humans to authenticate themselves to a server. Note that even the computer can not be trusted (at least with the ...
6
votes
1answer
598 views

Message signing disabled (dangerous, but default)

Over the last couple of years, I've developed a fairly keen interest in Penetration Testing & Information Security. Throughout this time, I've acquired (and accumulated) a range of different ...
-1
votes
1answer
60 views

Authenticating users by checking if the key can decrypt a phrase vs by checking a password against a database [duplicate]

I'm kind of curious: Why would we store a password in a database when we can just encrypt a phrase such as "unlock me" using that password and then, at login, seeing if the encrypted phrase can be ...
0
votes
0answers
19 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
2
votes
2answers
90 views

How can Authenticity be achieved in SMS or Text Messaging?

What tools or information is needed to verify the authenticity of a SMS message... or to send one so that such authenticity is intact? This answer describes something as a "message center", but I'm ...
0
votes
1answer
2k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: ...
2
votes
1answer
94 views

Avoiding repeaters in radio-communication

Suppose a sender and a receiver communicate over some radio channel. Is there a way to prevent packets sent and received are not being repeated/forwarded by a MiTM? That is, when the agents are out of ...
3
votes
1answer
74 views

What are the security implications of having login dialog inside of an iframe

I have the page to render some content and I allow it to be embedded at any third party page, so I can't use X-Frame-Options. One of the requirements is to ask user for login/password when content ...
2
votes
0answers
145 views

Astonishing Recent Belkin Router Auth Bypass Vulnerability: CSRF Used to Exploit?

I was visiting the CERT site main page today for another reason when I glanced at the list of recent vulnerability bulletins and came across some news I had somehow missed before today: a notice that ...
3
votes
2answers
54 views

Can a Meta Tag be Spoofed? (Is a Metatag Sufficient to Declare a Page is Protected?)

Background I am working as a front-end developer, and I have very little security experience. We are working with a very obscure backend setup, using a 4D database and WebClerk on top of it. ...
-1
votes
1answer
144 views

Information Security Thesis idea [closed]

I need advice. Currently I'm doing my Masters in Information Assurance, and I only have my Thesis left to graduate. I chose a topic for my thesis but for some reason I don't feel confident that it's ...
1
vote
1answer
106 views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
8
votes
3answers
972 views

Two factor authentication with my bank

My bank requires a security dongle. Place the debit card in the card reader and enter a pin code. An 11 digit code appears which is entered on the bank's website and access is granted. But if I ...
0
votes
0answers
59 views

Is authentication/authorisation necessary between a web server and an isolated application server?

If I have a system that consists of an application server which responds to requests made only from the web server. a web server that responds to client requests over the internet. Is it necessary ...
2
votes
3answers
470 views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
5
votes
1answer
527 views

How can a system verify an online password using a phone keypad?

I phoned into a financial company's website, and it prompted me to key in my password on the phone keypad, converting the alphabetic characters to the corresponding digit, and special symbols to '*'. ...
1
vote
2answers
144 views

Difference between KMS and PKI

While the PKI System deal with digital certificates life cycle and Key Management System (KMS) deal with keys life cycle. What is the the fundamental difference between them? Is it possible to ...
4
votes
3answers
177 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...