Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
4answers
253 views

Log in with email is more secure than a username?

Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
1
vote
2answers
520 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
0
votes
2answers
164 views

Determining the accuracy of a biometric system

How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?
0
votes
3answers
50 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
1
vote
3answers
68 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
2
votes
2answers
68 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
2answers
126 views

What's the meaning of the term “ad-hoc MAC” (Message Authentication Code)?

In SSL literature, I've noticed the use of the term "ad-hoc MAC". I understand the meaning of MAC (Message Authentication Code) and how it works, but what does the term Ad-hoc MAC mean? Note: With ...
0
votes
1answer
119 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
2
votes
1answer
138 views

SAML and OpenID, centralized and decentralized

I'm learning SAML, which is said to be centralized. To understand the difference with decentralized, I'm reading about OpenID. I find it difficult to understand the difference between the two, ...
7
votes
1answer
300 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
2
votes
5answers
405 views

What is the most credible timestamp I can create for a digital file?

Is it possible to create a timestamp that is so hard to fake, that it could be used as proof or simply strong evidence in a court of law, that something was not created after a certain point in time? ...
2
votes
4answers
311 views

how secure is rsa encryption for a web login without https?

I have a server running rstudio. This is basically a web application, and it is currently only accessible over the local network. The web app takes your Linux username/password in order to log you ...
0
votes
2answers
66 views

Is it safe to use a ECDSA public key as a password seed for GCM/AES?

Two peers already exchanged their ECDSA (curve secp256k1) public keys using a secure channel. They want to establish an authenticated encrypted channel between them. They will use CCM mode and with ...
1
vote
2answers
122 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
8
votes
2answers
570 views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
2
votes
1answer
282 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
1
vote
1answer
107 views

Securing Javascript plugin

My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on ...
0
votes
2answers
71 views

Can session data be manipulated without access to source code

When implementing a web-based application, how secure are any session variables against manual manipulation beyond the scope of my code? i.e. when a user is authenticated, if I were to initialise a ...
0
votes
1answer
111 views

What is a AUTH-KEY in the security of the computers?

I don't know if this is the right section to post my question and if it is not I apologize. I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL ...
1
vote
1answer
124 views

SSL Handshake random number?

I realized all of the phase of the handshake but I do not understand how it does that from the two randomly generated numbers are unable to generate a session key that the client and the server uses ...
1
vote
1answer
90 views

Amazon Turk - How secure is it? Strange behavior

I just had this really strange experience with Amazon Turk, where suddenly I was logged into someone else's account. I was logged into the company's Turk account, left my computer for a while, ...
0
votes
0answers
43 views

Can the device seed be recovered from the iPhone/Android RSA SecurID app?

The Windows RSA SecurID app allows the device seed to be determined and cloned from one machine to another (see this blog post). Do either the iPhone or Android RSA SecurID apps suffer from the same ...
3
votes
2answers
134 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
1
vote
3answers
327 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Several systems rely on using UID of smart card for identification/authorization. For example database stores list of smart card UIDs and corresponding privileges. Given that today there exist cards ...
0
votes
1answer
505 views

Use SSH config file with Putty [closed]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
1
vote
3answers
133 views

How can I add a layer of security to cleartext passwords and SSL?

I'm creating a web API in .Net for a web application. I'm wondering what the industry standard for login authentication is. I know that most people believe that sending cleartext username/passwords ...
3
votes
2answers
150 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
1
vote
2answers
175 views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
1
vote
1answer
97 views

Web Application Authentication Using Computer Properties

Introduction: I am in the process of building a web-based game that requires user authentication. The vast majority of other gaming sites utilize the typical username/password method for ...
0
votes
1answer
44 views

Evaluation of cryptosystem for authentication and keyexchange

I'm a masters student in computer science who works part time with my own company as a consultant. My lastest project is based on my bachelor thesis which handles everything except the security. The ...
1
vote
2answers
162 views

How to make an efficient bruteforce attack on Windows? [closed]

I've been trying to figure out a way to efficiently bruteforce on Windows, but the method I currently have isn't very efficient. I did some profiling and found out that on average it can go through ...
1
vote
0answers
104 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
0
votes
0answers
102 views

Client-server authentication protocol suggestion

I'm designing an authentication methods for my client/server system consisting of: a windows desktop client application (.NET) windows/linux servers (C++) one "security server" which authorizes the ...
-4
votes
3answers
4k views

How do I hack this login page by using SQL injection? [closed]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
1
vote
1answer
135 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
1answer
62 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
16
votes
5answers
2k views

How many Stack Exchange logins should I have?

On Stack Exchange's Add a login page, one can add logins with Google, Facebook, Yahoo, etc. How many logins should I have to provide the least chance of a hacker gaining access to my Stack Exchange ...
2
votes
2answers
127 views

How to build a secure affiliate network

I'm going to build a demo affiliate network, which needs to be secured. Let say I have a web application called Affiliate Network Manager that manages all affiliates associated with my online book ...
6
votes
3answers
1k views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
4
votes
3answers
179 views

Why do some websites need time to log you in securely, while others can do it instantly?

I noted that on a lot of money-related websites (banks, paypal, etc), you are brought to a page that "logs you in securely". This is an example of one: Meanwhile, websites that also store very ...
1
vote
1answer
45 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
1
vote
1answer
60 views

Save application autostart login token on computer

I need to login desktop application while autostart on server (like skype does). What is the best practice to save authentication token (password)? Should I use something like RSA encryption (which ...
1
vote
0answers
46 views

Considerations when implementing a key based SSH-like auth scheme

I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
1
vote
3answers
52 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
1
vote
1answer
87 views

Client authentication flaw in old Netscape SSL protocol

Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
3
votes
1answer
102 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
1
vote
1answer
89 views

Api authorization basic concepts in detail

I am trying to write an application is rails. Which is more like a api application so that when a user gets redirected from his application into mine I would like to authorize him and start a session ...
2
votes
1answer
320 views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
1
vote
0answers
113 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
3
votes
6answers
228 views

Why not ask for a password and 2-factor token at the same time?

I have observed a number of web-based login forms that offer 2-factor authentication do token entry on a second form after validating your username and password. Is there a reason not to ask people ...