Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
0answers
104 views

Authentication for an enterprise application via a reverse proxy in the cloud

I am trying to understand conventional deployments for users accessing HTTP enterprise app from the internet detail: Let's say we have a HTTP reverse proxy in the cloud (amazon) and an enterprise ...
1
vote
0answers
57 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
20
votes
5answers
4k views

Password strength and banks 4 pin code?

Why is it that some security advisers recommend using an 8 character password with upper, lower, digits, and symbols while banks only use a 4 digit number pin for debit and 3 digit pin for credit ...
20
votes
5answers
2k views

Are login “certificates” more secure than standard username + password authentication?

I just opened a new bank account which comes with internet banking. Unlike the others I have used so far, this one requires a personal certificate (a .p12 file stored on my computer) + password for ...
0
votes
3answers
59 views

How to secure Password and Salt on a deployed application

I have a question regarding one step of protection more than salt/hash. I work on an application that is distributed to many clients and then deployed on their networks. If I set a password on one ...
1
vote
2answers
342 views

VPN over HTTPs for a web service only

I have a web service (PHP & MySQL on Ubuntu 12.04) running in a corporate intranet. I have also connected it to internet through a firewall letting incoming connections on HTTPs only (port 443). ...
0
votes
1answer
75 views

Mobile authentication

I'm currently working on an Android app in which I want to authenticate someone against an REST API. I want to do this as secure as is (cost-)effective/possible/userfriendly. I've been looking around ...
0
votes
1answer
39 views

How to sync with multiple authentication services?

I have a peculiar case to work on. We are using a proprietary product which supports LDAP integration. However, it can be configured to use only one LDAP service. (most of the products are shipped ...
2
votes
1answer
140 views

Where do browsers store HTTP Authentication details

Where do browsers store HTTP Authentication credentials ? If I gain access to a browser, is there some place I can look where all HTTP Authentication details would be available? In most browsers, even ...
0
votes
1answer
237 views

SSL Mutual authentication Fails

When I try to establish a Mutual authentication between server and client, I am getting the errors below. The timing between the server and client is exactly same and also the certs are proper in ...
3
votes
1answer
104 views

What stops an attacker from tampering with data sent during the SSL/TLS handshake?

On this page, it says the first thing sent is the SSL settings, such as version, and cipher settings. If the attacker, say, wanted to change the encryption method used, what makes this not possible?
1
vote
2answers
85 views

In two step authentication, should I check step 1 before proceeding to step 2 or check both at the end?

I asked this question first on Stack Overflow but it was suggested that Information Security would be a better place for it (pretty obvious in hindsight). ...
-1
votes
1answer
24 views

Symmetric Mutual Authentication Case

I have an interesting question about mutual-authentication with a symmetric key. Is this scheme possible and secure? And is this scheme a mutual-authentication scheme? Alice -------"Im ...
1
vote
3answers
116 views

HTTP authentication: identify the client

We have a web-site, where each user has to log-in to access a private area. Inside the private area, there are some information about the user, a profile, including some sensitive information (home ...
0
votes
4answers
3k views

Wifi deauth attack - Difference between Aireplay and MDK3

I am currently working on some Wifi related security issues, and something appeared to me. I have an Open Wifi network, to which a client connects. I try the Deauth attack from Aireplay ...
2
votes
1answer
489 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
-3
votes
3answers
435 views

Two-factor authentication Without Mobile Phone

Two-factor authentication is based on the notion of “something you know” and “something you have”. Is it absolutely necessary for having your mobile phone involved in two-factor authentication, which ...
1
vote
0answers
53 views

Security for message queue in ActiveMQ

I am using ActiveMQ and WSO2 for my application. I need to protect my queue to restrict posting of messages by anonymous users(I need to protect my queue with some password). I know, there is a ...
20
votes
6answers
2k views

Web authentication - password vs key file

There is a corporate web mail site (PHP + MySQL) for limited numbers of users who are employees of a company working remotely with the corporate web portal. Each user has a login and password. I'm ...
0
votes
2answers
73 views

Best practice for two WebServices that have to authenticate with each other [closed]

I have two WebServices that are hosted by two different applications. Both Applications access each other's webservices: Now both WebServices have to authenticate with each other. Different ...
1
vote
1answer
83 views

Secure way of opening web page from iOS without need of logging in

I am developing an iOS application and web page, both use same Parse backend. Web page contains some functionality that is not available in the iOS application. Therefore I would like to present the ...
1
vote
1answer
227 views

How could the Skype app log me out from my Facebook account on OSX? Isn't this a huge security flaw?

According to this post (and to my personal experience), installing the Skype app on Facebook and the Skype client on OSX Mavericks will result in you being logged out from Facebook every time you ...
3
votes
3answers
118 views

Is login limiting still needed if we employ multi-factor authentication?

The status quo is that most online websites limit login attempts per IP address, or even per account since some attackers possess huge amounts of IP addresses. OWASP declares: When multi-factor ...
0
votes
1answer
90 views

ChangeCipherSpec Authentication

According to RFC 5246, 7.1. Change Cipher Spec Protocol: The ChangeCipherSpec message is sent during the handshake after the security parameters have been agreed upon, but before the verifying ...
-1
votes
1answer
42 views

What are relation between security services? [closed]

message confidentiality message integrity message authentication non-repudiation The 4 services are related in the sense that one services often implies/provides another. Indicate for each service ...
1
vote
0answers
95 views

CAS protection against CSRF attacks

A website based on Apache Struts uses central authentication service (cas) for login. I'd like to know if additional csrf protection needs to be provided with Struts in case cas doesn't provide that. ...
3
votes
3answers
106 views

Is an emailed PIN for 2FA worthwhile?

To log in to our web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password login, which ...
0
votes
1answer
48 views

Does a username/password + emailed PIN count as strong 2FA?

To log in to a enterprise web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password ...
1
vote
1answer
116 views

Implementing password-reset in a web application by authtoken over email

I think I have a basic understanding of security concerns, but I feel like if I don't know everything, I'm going to implement lousy solutions. Below is my current strategy; Have I overlooked obvious ...
11
votes
4answers
711 views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
2
votes
2answers
150 views

Is this token based web service secure?

Note: Original question asked at http://stackoverflow.com/questions/24012390/is-this-token-based-web-service-secure but here seems to be the right place for it. The company that I current work for ...
2
votes
1answer
82 views

Using OAuth as Security For E-Commerce Sites

I need some help in understanding the security risks if I want to use OAuth 2.0 (Facebook, Twitter and G+) as standard login provider for an E-Commerce site. Keeping in mind that I will not be saving ...
1
vote
1answer
608 views

Bypassing CVE-2010-4478 (J-PAKE parameter validation) in OpenSSH 5.1

Did anyone successfully exploit CVE-2010-4478 in the past? This is insufficient validation of the J-PAKE public key parameters in OpenSSH up to 5.6. I'm dealing with a vulnerable machine running ...
5
votes
0answers
96 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...
0
votes
2answers
153 views

When I reset my password for my Microsoft account, how do they know what password I've used before?

Assumption used: all password that I've used have been salted with some random elements before hashed and stored somewhere in their database. If my previous password exists only as salted-hashes in ...
6
votes
1answer
644 views

What's keeping a malicious man in the middle server from forging a valid certificate

According to process of authenticating a server certificate: What's keeping a malicious server to fill up a valid server certificate since it knows all the things: Forged Server public key (man ...
2
votes
1answer
314 views

HMAC secret key client storage

I've read numerous articles about using HMAC and the secret key for client authentication in a RESTful client (Javascript) application today. Still, I don't find a single source that is able to ...
0
votes
0answers
43 views

Algorithm to Transaction Data Signing

Transaction Data Signing I need an idea to develop a very secure algorithm to authenticate online operations using PHP in the server and an Android app in the user's device. What is the idea? The ...
0
votes
2answers
128 views

Is it safe to rely on text messages as a means on authentication?

Many websites, including banks, use text messages as their primary or secondary means of authentication. In theory, it sounds like a perfect method unless the user loses their phone or has it infected ...
5
votes
4answers
283 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
1
vote
1answer
65 views

Are there other ways for a CA to have their certificates included in a browser?

From what I understand, the certificate authorities (CAs) have to get their root certificate included in the browser. What if the root certificate of a particular CA is not included in the web ...
0
votes
1answer
70 views

Secure end-to-end when part of conversation must be over HTTP

We have a situation where a user's identity can be verified as follows: the network provider knows the identity of the user and injects secure headers into the HTTP request, which our servers can use ...
-1
votes
1answer
82 views

Prevent someone to login to my website from teamviewer

I have my own suspicions that there are blocked users of my website that use Teamviewer to login to my site from their friends' pc. Is there any way to identify if the one who visit a website is using ...
0
votes
0answers
34 views

Best practices concerning pushing user registrations

Imagine an organization which possesses a lot of personal customer data in their internal databases. This organization creates a web application, and wishes to be able to send a registration link to ...
3
votes
4answers
274 views

Ethical brute force demo on a web login when knowing the password complexity requirements

We are currently having accounts compromised at a substantially high rate. Some in the organization believe that our password complexity requirements is enough to thwart brute force attacks. I wanted ...
38
votes
2answers
5k views

Is it good practice to ban an IP address if too many login attempts are made from it?

Since an IP address does not necessarily represent a specific device, but probably a whole network/company/etc. does it at all make sense to block an IP address if there is a significant amount of ...
0
votes
2answers
87 views

RSA for authentication?

Is it possible to use RSA public and private keys to authenticate two computers (or to make sure they're both the right computers)? If so, how? Thanks!
2
votes
1answer
115 views

Does using token-based auth make CSRF checks on login unnecessary?

Based on my understanding, avoiding the use of cookies as an authentication mechanism prevents CSRF vulnerabilities entirely (namely token based authentication in an SPA), when authenticated. Does ...
1
vote
1answer
78 views

How do I migrate users with shared email addresses to an email-based forgotten password process?

I'm migrating users from custom application-level authentication security (built into the app, using username as the unique identifier) to security as a service (using ThinkTecture's Identity Server ...
1
vote
2answers
91 views

Authenticated sessions and Man in the middle

I see a lot of websites (including Stackoverflow) using this authentication mechanism: Client authenticates under HTTPS and gets back a session id. Client drops back to HTTP and accesses secure ...