Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
3answers
181 views

Mitigating Login CSRF on 3rd party websites

I'm working on a project that requires to have a signup/login functionality exposed to partners who manage their own website. For some of these websites they reuse our own backend, and just change the ...
26
votes
7answers
4k views

Does username length/complexity/uniqueness positively impact security?

Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security? This is assuming that adversaries aren'...
4
votes
2answers
211 views

Is the following authentication solution safe or am I missing something?

Context: I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their ...
0
votes
0answers
142 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
3
votes
2answers
179 views

Should ability to access login page after authentication be considered a security flaw?

On one of the recent engagements, I bumped into something I have not seen before: after successful authentication attempt the user still can access the login web page and login as another user. It ...
1
vote
1answer
29 views

Network authentication using router firmware scripting [closed]

To connect to internet in our institute, you need to login with your credentials on a page and then approve the IP address for proxy less usage. On a router, if one device authenticates, all the other ...
1
vote
1answer
178 views

Authorization on complex ownership

I have problem with object ownership in my web application. In my web application. There are object types: 1. Faculty 2. Student 3. Student Group 4. Student Lesson The following user roles are ...
1
vote
0answers
170 views

Check if user is logged in on other ADFS authenticated site

I've been looking around for this specific situation, but so far no good.. We have multiple websites that use ADFS WSFederation, and we would like for a user to always pass through one, before being ...
3
votes
1answer
189 views

How to get TOTP password with hmac sha 512 as hashing function?

ive never learned about javascript and network security before, but lately ive taken on some programming challange but i have to send my project link via http post request, and i have to figure the ...
15
votes
6answers
2k views

What's the point of the CA?

So a Certificate Authority certifies that a website corresponds to a given organization. Why is this necessary? When I interact with a business or organization, I do it one of a couple ways: I ...
3
votes
3answers
347 views

Is this authentication and encryption solution secure?

I need to communicate over insecure TCP sockets where SSL/TLS is not available. Does the following solution provide a secure means of authentication and encryption? - Client sends: username Server ...
4
votes
1answer
138 views

Is using OAuth for login less or more secure than maintaining your own passwords?

Pros: The complexity in managing passwords is maintained by a company with stronger security policy. Let's assume they secure passwords properly. The user doesn't have to maintain yet another ...
3
votes
1answer
47 views

Single randomly generated passphrase for both identity and authentication

There are questions about using a password only to identify and authenticate a user, rather than an email address or username plus password: Why do we authenticate by prompting a user to enter both ...
1
vote
1answer
33 views

How can I detect if IETF TokenBinding is in use for bearer tokens?

Token Binding increases the security of traditional bearer tokens (cookies). This Blog describes that ASP.NET can use Token Binding. As a security consultant, I'd like to observe or detect that this ...
1
vote
1answer
52 views

What are the advantages of a ZKP authentication system?

So, I read somewhere that Zero Knowledge Proof based authentication is good because it makes sure that the server does not store your password and neither is your password being transmitted over the '...
1
vote
2answers
95 views

Can You Prove a Chat Happened Online? [closed]

With so much communication happening online nowadays the needs to verify information is obviously an essential. However, let's say something was said in an online chat room/or private chat client, ...
3
votes
1answer
81 views

How can I enforce that an SSH private key has a passphrase?

My company is serious about security and willing to move to SSH key-pairs. Users can generate their SSH key pairs independently and I worry if they set a pass-phrase. Can I enforce this? Does signing ...
-2
votes
1answer
107 views

How does Windows 7 login work? [closed]

Maybe the question can be considered ambiguous, so: how does Windows 7 work for its login authentication? What are the involved processes and what do they do?
1
vote
1answer
50 views

Trying to build an open authentication controled authorization website for multiple domain users

I'm not sure that this is possible but I figure at worst, I'll be told you cannot do that. Our organization has a report server that sits in a DMZ accessible by multiple units that have their own ...
0
votes
0answers
33 views

HAWK authentication vs. API tokens (shared secret)

I regularly find myself designing HTTP-APIs. My goto solution for authentication / network security is forcing HTTPS and using HAWK since it seems to be the only open standard for that. When I look ...
6
votes
2answers
169 views

How does Google store passwords for remote IMAP/POP services?

It is possible to add non-Google accounts to Gmail and retrieve their mail messages via POP or IMAP. As part of the setup process, one has to provide the login username and password for these accounts....
6
votes
1answer
179 views

When I register on a website, is there a way to know whether or not the site admin will be able to see my password? [duplicate]

It seems to me that whenever I register on a website, there is absolutely no guarantee that the administrator will not be able to decrypt and view my password (if they even bother encrypting my ...
1
vote
1answer
42 views

Mutual SSL - Using Public CA for Client Auth CSR signing

I have been reading a lot of articles regarding Mutual SSL, Two-Way Authentication or Client Authentication and I have a general enquiry which may have been answered in content that I've read but if ...
3
votes
1answer
66 views

What are the security implications of having a dummy user account representing unauthenticated users?

In my web application, users are assigned to groups and groups are granted permissions on objects. The application exposes some objects to unauthenticated public users (i.e. people casually visiting ...
1
vote
1answer
92 views

How specifically should I implement CSRF protection?

There are a ton of articles explaining what CSRF is and that I should use a CSRF token to prevent CSRF. A few of them mention details such as using SHA256 over MD5. However, none of them explain how ...
2
votes
1answer
102 views

How does MailChimp authenticate emails?

Keeping it short, MailChimp states that: Authentication Should Be Simple Email authentication is useless if it's too hard to implement. Many email service providers require server setup in ...
2
votes
1answer
141 views

Why refresh tokens are used

Reading about JWT I see it is common practice to include a refresh token along with the short lived token. So commonly it seems you have a short lived token which lasts for a short time such as 15 ...
32
votes
7answers
5k views

How to prevent username and password matches when changing a username?

Let's say that I have a system where one of the security requirements is preventing users from choosing a password that matches their username. Usernames are not case sensitive but the passwords are. ...
3
votes
1answer
109 views

How to force browser to ask user to resubmit certificate after a logout

We have a website which supports form based authentication (i.e. username and password based) and certificate authentication where a user submits his or her certificate, the username is extracted from ...
5
votes
2answers
180 views

Best practices for automatic login URL's?

An automatic login URL is a mechanism whereby an existing but logged out user of your website or application can click a link with a random token and be automatically recognized and logged-in to your ...
5
votes
1answer
61 views

Use OpenId Connect for authentication only

OpenId Connect adds authentication to the OAuth2 protocol. OAuth2 is a protocol used for authorization. But what if I'm only interested in authenticating a user? After reading up on OpenId Connect, it ...
0
votes
1answer
60 views

I can't connect to OSSIM server [closed]

I installed OSSIM in VMware workstation.The installation was successful.But when I entered the login and the password I have this message " incorrect login" I know that la login must be "root". ...
3
votes
1answer
99 views

User authentication with smart cards or RFID on Mac (OS X) for accessing an encrypted database

I am developing a software that handles privacy sensitive data in a local network environment, using Mac computers, to which only a select group of people may have access. I need to understand how I ...
0
votes
2answers
34 views

Bookmark UUID Link

I noticed the following site: nightchamber.com A user account is automatically generated on first visit and keyed against a uuid, the id is then stuffed into the session and used to make a link the ...
5
votes
2answers
305 views

Website login using database credentials

Is it secure to login to a website by using database usernames, for each user? Is it a bad practice? What can be the issues? The idea is to create the users and permissions at database level. EDIT: ...
1
vote
2answers
51 views

Client verification with PKCS#7

When a client sends you a pkcs#7 file to communicate with you, Is this because the file has their public key(certificate) and their chain and to avoid the confusion on your side what needs to be there ...
3
votes
1answer
63 views

2 Step login: Memorable word reset via Email OR Security Questions?

Background We have a system in place which requires employees to login using a 2 step verification process ( password & Username) + (a defined number of characters from a chosen Memorable word). ...
0
votes
1answer
171 views

Does it Matter That Universal Windows Platform (UWP) is Open to Phishing Attacks?

A few years ago (a little over three now to be exact), I brought up what I consider to be a rather obvious (and serious) security issue with the Universal Windows Platform (UWP): The ability to use ...
3
votes
1answer
63 views

Distribution of Application API Token

I wrote a simple twitter client for command-line use. For such application, twitter requires two types of tokens, namely application identification, user OAuth Token. The second one is to allow ...
1
vote
6answers
4k views

Is this authentication scheme secure?

I want to authenticate a client of a webpage and make sure it is a particular user. Let say that we already agreed on a particular hash (SHA256, actually, which I think is secure enough for this) and ...
1
vote
4answers
213 views

How to know if accessing to a VPN service is safe and won't steal my data

I want to know if a VPN service is safe or not. If the VPN server itself can catch or sneak peek my data? Or as long as it is a VPN service, then the security is protected by the algorithm itself? ...
19
votes
3answers
2k views

Rate limit login attempts: count by IP or username

I need to limit login attempts. One option is to count attempts by IP address and then block the IP. The disadvantage is that different users may have the same IP address. Another option is to limit ...
1
vote
2answers
164 views

Pin delivery: SMS, mail, or pin mailer?

Imagine a scenario where a 4-digit pincode needs to be delivered securely to an end-user. Several possibilities exists: Pin mailer (this seems to be standard according to ISO 9564-1) SMS Email Email ...
2
votes
1answer
131 views

How might a PIN based Web authentication scheme work?

I'm interested in implementing PIN based authentication for a web application, similar to what Facebook provides in their mobile web site. Here is the user flow: User visits the site for the first ...
4
votes
1answer
701 views

(ctrl + alt + del) on Windows 8/8.1/10

After seeing this answer I wondered, how is this done in newer versions of windows, where [ctrl + alt + del] is no longer required for login? Was this feature just removed, or is it somehow ...
3
votes
1answer
87 views

VPN Authentication and Network Administrators

Is it possible for a network admin (or attacker) to monitor traffic sent to a VPN server during authentication and end up being able to decrypt the data as if they were the legitimate user? I don't ...
1
vote
1answer
43 views

Privilege seperation when using the same login credentials?

While thinking about preventing ransomware attacks on my machine I stumbled across the following question: Assume I'm on a Windows (10) PC. Assume further that I have two (local) accounts, one with ...
0
votes
1answer
44 views

How should I construct a secure redirect_uri?

I have read a number of questions on the underlying necessity of a redirect_uri. I don't want to screw this up! Can anyone give an example of how a secure redirect_uri could be constructed? For ...
1
vote
0answers
49 views

Recommended End-User Authentication for OpenID Connect / OAuth 2 [closed]

I am learning about OAuth 2 and OpenID Connect. Reading the documentations I feel that the specification of OpenID Connect leaves some blank space regarding the End-User Authentication. The spec ...
3
votes
2answers
666 views

Getting reliable checksums

Update: A version of transmission that contains malware has been distributed very recently. Quoting this ars technica article: It appears that somehow the Transmission website may have been ...