Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
1
vote
1answer
56 views
How to verify data from localStorage on a server
This is a cross-post from my Programmers.StackExchange post - I think this might be a better forum to ask this question. Admins - please delete either of them as you deem fit.
On my mobile app, I am ...
4
votes
5answers
149 views
When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?
Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
0
votes
1answer
52 views
WLFriends encrypted login risk
I recently had created on WLFriends.org which is presented by Wikileaks, I noticed a big thing there that the process of signing up at WLFriends was very distinct from the other normal sites. There, ...
1
vote
2answers
210 views
Can I use hardware token OTP to stop piracy?
Our firm sells an offline desktop (.exe) software, we are thinking of using OTP (from hardware token like in internet banking) to stop people from copying the software without permission. Basically, ...
0
votes
1answer
149 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
1
vote
0answers
71 views
Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?
Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system?
The scenario is as follows: I am a ...
4
votes
1answer
112 views
How to solve race condition in 2-factor authentication solutions like RSA Security tokens or Google Authenticator?
One of the reasons we opt to use 2-factor authentication is to minimize the impact of keyloggers. The theory is that even if an attacker is able to observe the user type in the token numbers, they ...
4
votes
2answers
175 views
Any real world examples of GPS location data being used with authentication?
Are there any examples of how GPS coordinate (or any location data really) can be used to detect suspicious locations or validate well known locations?
Specifically
Highlighting new or unusual ...
0
votes
3answers
249 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
1
vote
1answer
746 views
Wifi login redirect applications
This may sound a bit naive questions as i am a beginner. But I do my best to put it into words.
You may have experience when sometimes you want to use the internet in a cafe for example (with your ...
4
votes
3answers
236 views
Is SiteKey a valid defense against Phishing?
As described here, some banks use a SiteKey mechanism in an attempt to provide a defense against phishing. The comments and answers indicate some issues with this approach, but that question wasn't ...
26
votes
3answers
666 views
What is this authentication method/approach called?
Background: I want to implement something like this in our websites, and I'm looking for advice and possibly APIs that allow this out of the box rather than re-inventing the wheel, but I can't even ...
0
votes
3answers
101 views
Lowest possible threshold for smartphone app login
I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game.
Testing shows some ...
3
votes
1answer
183 views
Can I re-use another vendor's dual factor token in my own system? (Avoid physical token bloat)
I read the open source multifactor authentication techniques called HOTP RFC 4226 and TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this ...
3
votes
2answers
91 views
Should the serial number of multi factor devices be removed?
I'm trying to understand the relationship between the serial number of a multi factor device and the cryptographic material behind it.
I don't want to blindly assume that the serial number is just ...
0
votes
2answers
199 views
What are RealVNC 5.0 Authentication Protocol Security Limitations?
In the old version of RealVNC, the password length was limited to 8 characters which was easier to be cracked. They have now increased the password length by 255 characters, will this make Realvnc ...
1
vote
1answer
437 views
Is it secure to install RSA SecurID Software Tokens on the same computer that will be used to access the VPN?
My office switched from using the old hardware RSA SecurID key tokens to the RSA SecurID Software Tokens and most users have them installed on the same machines they use to access the VPN.
I asked ...
0
votes
1answer
170 views
How does the YubiKey Validation Server work from an encryption perspective?
Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at ...
4
votes
1answer
282 views
Trying to figure out Gmail login in Wireshark
In my pentesting lab I'm using ettercap for do a mitm to a XP VM.
I go to gmail, accepting the false certification, and here I start to sniff with wireshark. I put some false account like ...
8
votes
1answer
319 views
How secure is Windows 8 email authentication?
I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email ...
3
votes
1answer
391 views
How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
0
votes
2answers
150 views
Security concern to implement a web based remote desktop
I am implementing a web based remote desktop application.Through this application client can connect to the server and can access the server using JSP/Servlet Java robot class.
I can configure the ...
1
vote
4answers
149 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
0
votes
0answers
19 views
Facebook Login security concern with the javascritp JDK [duplicate]
Possible Duplicate:
Isn’t OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?
I have some real concerns about how to use facebook login for my wabb-app. I have a ...
1
vote
1answer
93 views
Reasonable computationally lightweight security?
I've read a bunch about how one should use bcrypt or PBKDF2 as a good middle ground between tunable workload and acceptable time to make brute force and collision attacks unfeasible.
What if the ...
7
votes
5answers
386 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
0
votes
3answers
318 views
help understanding client certificate verification
I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
10
votes
2answers
214 views
“Pulled from public record” security questions
Several times in the past months, I have been asked security questions that are "pulled from public record" to verify my identity, either over the phone or on a website (Chase Bank, Walgreens ...
1
vote
2answers
157 views
Authentication without saving password
Are there any security problems with following authentication protocol?
when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = ...
6
votes
4answers
362 views
Banking application login leaks information
My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows:
User visits the homepage of the bank.
User ...
1
vote
2answers
126 views
Are SIP REGISTER transactions w/ HTTP Digest subject to replay attacks?
It is my understanding that the authentication during a SIP registration is done through some kind of an MD5 hashing algorithm known as HTTP Digest, and doing a tcpdump of the actual traffic I've ...
1
vote
1answer
147 views
Public web server and AD- based Kerberos authentication
I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
6
votes
5answers
248 views
Is behavioural analysis (e.g. keystroke dynamics) a reliable security mechanism for MFA?
The typical set of multi-factor categories is as follows:
Something you know (e.g. a password)
Something you have (e.g. a hardware token, or key file)
Something you are (e.g. a fingerprint or retina ...
5
votes
2answers
345 views
Does having a passphrase and SSH key qualify as two factor authentication for PCI?
I am working on getting our company's servers PCI SAQ-C compliant (credit card data passes through our system but is not stored by our system). We have SSH access to administer the servers and all ...
0
votes
1answer
238 views
3 or 4 characters long username from security point of view
I have on my site the ability for the user to choose his/her username that is 4-20 characters long.
But some users could have names like "Amy" "Eva", "Ian" etc.
Should I stick with 4 letters or go ...
5
votes
3answers
760 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
0
votes
1answer
99 views
How do I prevent my Rails application from attack? [closed]
My website is being nuked by new signups and new posts some of which don't even have user.id associated with.
How do I solve this? What code should I add to the user#new page and/or post#new page.
...
5
votes
3answers
428 views
Is my session-less authentication system secure?
So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
1
vote
1answer
181 views
RADIUS proxy chains
RADIUS is a widely deployed remote authentication protocol. I'm looking here at its use in wireless roaming. The RADIUS protocol allows for proxies and chains of proxies:
|CLIENT|<->|Access ...
2
votes
2answers
329 views
Two-Factor Authentication: When is it worth it?
I was reading this article, and it triggered the question: Why not use two factor authentication? In his case, it both possibilities were enabled anyway, so this looks to me like it's two attack ...
3
votes
1answer
815 views
what is the role of RADiUS server and Active Directory to increase the security in wireless networks?
In the CBT Nuggets Video Training, one slide about Wireless networks :
i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and ...
2
votes
4answers
303 views
Client Certificate in SSL HandShake insecure?
Imagine we have an application which is trying to establish a secure connection to a server by using SSL. Now we want the user to authenticate himself with a client certificate which he stores in an ...
4
votes
1answer
217 views
What is the opaque field in HTTP Digest Access Authentication used for?
Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value ...
1
vote
1answer
168 views
Pre boot authentication for Android phones
is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
2
votes
3answers
251 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
4
votes
4answers
361 views
Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far
Most of what I ...
0
votes
1answer
171 views
Protect database resources from fake data inputs via web forms
Scenario:
I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
2
votes
1answer
86 views
What's the best way to enumerate log/sign in attempts?
For sign in via a website, what is the best way to count the number of attempts that is:
least vulnerable to tampering
reliable
quick
The system would:
use HTTPS throughout the sign on phase (at ...
0
votes
1answer
644 views
How to create trusted chain of certificates if I have the last certificate?
Good day.
During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using)
My server is:
telnet xmpp.odnoklassniki.ru ...
