Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

3
votes
1answer
49 views

secure user authertication

Here : Help understanding basic user authentication with salts and hashing They explain it pretty well, but i'm still struggling to understand this one part... Now, when a user comes to log in ...
1
vote
0answers
31 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
1
vote
1answer
81 views

NFC - Felica / NXP (Desfire EV1) or ACOS3 which is more secure?

I am new to NFC, and just have been researching on security from different manufacturers, trying to find out which system is more secure with their password protected area. I only know that Desfire ...
5
votes
3answers
162 views

How to prevent a prophecy from becoming self-fulfilling or self-defeating

Let's assume that I have deduced with a high probability what a certain famous person or organization will choose to do at a near-future date. How can I publish any proof of me having deduced this? ...
0
votes
0answers
26 views

Persona combined with stateless token authentication

My REST-Backend is using Mozilla Persona to authenticate users. Normally you would just use cookies to authenticate any further requests but I want to use token based authentication (out of personal ...
1
vote
2answers
60 views

Authentication without registration

Let S be a server and C be a mobile client (iOS/Android App). Assume that the communication between S and C is ciphered with SSL (or any other standard protocol). The system is a voting application, ...
1
vote
1answer
87 views

Pros and cons of security images [duplicate]

Over the past year or so, I've noticed that all of the banking organizations I work with that have or had "security images" as part of their login process have removed or are planning to remove that ...
2
votes
1answer
78 views

What reasons are there to not just send the API key as an HTTP header over HTTPS?

I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
0
votes
2answers
68 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
0
votes
0answers
54 views

Bluetooth LE 4.0 security issues [duplicate]

How does BLE secure communications between devices? BLE 4.0 supports AES128, and the key exchange is done using DH. However, it is often reported that BLE 4.0 has security issues. What specifically ...
2
votes
2answers
131 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
1
vote
1answer
56 views

Encryption strategies for multi users access revisited

This is a follow up to this post: Encryption strategies for multi users access in production systems I don't see how this can work given the second bullet point: Kc is stored on the computer n ...
2
votes
0answers
153 views

NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?

Hi i saw a few threads about NFC NTAG against cloning and NTAG Desfire , i just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
8
votes
3answers
238 views

What advantage does the Bloomberg authentication system have over traditional 2 factor?

Bloomberg clients have an interesting way to authenticate to the server. This seems involve some of the following: Logging into a secure website, that displays a flashing square Swiping your finger ...
4
votes
3answers
361 views

Message Authentication Codes (MACs)

What is the main difference between Message Authentication Codes (MACs) and hash function? Is there any difference regarding their usage domains?
5
votes
1answer
772 views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
1
vote
2answers
115 views

Mobile Phone Client -> Server Authentication based on device

I have a mobile application (Android, iOS) and a server, which handles requests from the application. It is easy to perform standard authentication using SSL, password and random token to ...
1
vote
0answers
69 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
1
vote
2answers
149 views

Questions about user authentication over REST API

I'm now trying to implement user authentication on my android app. I, however, have a few questions. I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
0
votes
1answer
134 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
0
votes
1answer
57 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
2
votes
0answers
69 views

Zero Knowledge Proof Password Systems

I am wondering if there is a practical zero-knowledge proof system that can be used by humans to authenticate themselves to a server. Note that even the computer can not be trusted (at least with the ...
6
votes
1answer
567 views

Message signing disabled (dangerous, but default)

Over the last couple of years, I've developed a fairly keen interest in Penetration Testing & Information Security. Throughout this time, I've acquired (and accumulated) a range of different ...
-1
votes
1answer
60 views

Authenticating users by checking if the key can decrypt a phrase vs by checking a password against a database [duplicate]

I'm kind of curious: Why would we store a password in a database when we can just encrypt a phrase such as "unlock me" using that password and then, at login, seeing if the encrypted phrase can be ...
0
votes
0answers
19 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
2
votes
2answers
86 views

How can Authenticity be achieved in SMS or Text Messaging?

What tools or information is needed to verify the authenticity of a SMS message... or to send one so that such authenticity is intact? This answer describes something as a "message center", but I'm ...
0
votes
1answer
1k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: ...
2
votes
1answer
94 views

Avoiding repeaters in radio-communication

Suppose a sender and a receiver communicate over some radio channel. Is there a way to prevent packets sent and received are not being repeated/forwarded by a MiTM? That is, when the agents are out of ...
3
votes
1answer
74 views

What are the security implications of having login dialog inside of an iframe

I have the page to render some content and I allow it to be embedded at any third party page, so I can't use X-Frame-Options. One of the requirements is to ask user for login/password when content ...
2
votes
0answers
141 views

Astonishing Recent Belkin Router Auth Bypass Vulnerability: CSRF Used to Exploit?

I was visiting the CERT site main page today for another reason when I glanced at the list of recent vulnerability bulletins and came across some news I had somehow missed before today: a notice that ...
3
votes
2answers
54 views

Can a Meta Tag be Spoofed? (Is a Metatag Sufficient to Declare a Page is Protected?)

Background I am working as a front-end developer, and I have very little security experience. We are working with a very obscure backend setup, using a 4D database and WebClerk on top of it. ...
-1
votes
1answer
141 views

Information Security Thesis idea [closed]

I need advice. Currently I'm doing my Masters in Information Assurance, and I only have my Thesis left to graduate. I chose a topic for my thesis but for some reason I don't feel confident that it's ...
1
vote
1answer
106 views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
8
votes
3answers
972 views

Two factor authentication with my bank

My bank requires a security dongle. Place the debit card in the card reader and enter a pin code. An 11 digit code appears which is entered on the bank's website and access is granted. But if I ...
0
votes
0answers
57 views

Is authentication/authorisation necessary between a web server and an isolated application server?

If I have a system that consists of an application server which responds to requests made only from the web server. a web server that responds to client requests over the internet. Is it necessary ...
2
votes
3answers
455 views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
5
votes
1answer
501 views

How can a system verify an online password using a phone keypad?

I phoned into a financial company's website, and it prompted me to key in my password on the phone keypad, converting the alphabetic characters to the corresponding digit, and special symbols to '*'. ...
1
vote
2answers
139 views

Difference between KMS and PKI

While the PKI System deal with digital certificates life cycle and Key Management System (KMS) deal with keys life cycle. What is the the fundamental difference between them? Is it possible to ...
4
votes
3answers
174 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
0
votes
1answer
331 views

How to avoid storing plaintext during CHAP authentication

When using CHAP authentication, passwords are stored in plaintext, then I used reversible encryption to store password. However, I recently found Citrix states " storing passwords using reversible ...
1
vote
0answers
126 views

SimpleWebRTC Server Side Authentication for Room Access

I am trying to do some sort of server side authentication to allow only specific clients to join a SimpleWebRTC Room. Right now, any client that goes to the SimpleWebRTC "demo" page can join the ...
20
votes
8answers
9k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
1
vote
1answer
78 views

The difference between authentication protocols and authentications rules

ISO 25023 divides the authenticity into authentication protocols and establishment of authentication rules. I understand that the authentication protocols aim to authenticate the user using different ...
0
votes
0answers
41 views

How to secure a service with Mutual SSL Authentication and Intermediary CA?

Given: A working SSL mutual authentication setup (a WCF service hosted in IIS) No Intermediary CA In the current setup any client in the world having a certificate signed be one of the well known ...
4
votes
1answer
104 views

OAuth2 Client Credentials & Native Apps

The OAuth2 spec seems to consider native (Android & iOS) apps as "public clients", ultimately meaning that they can't use the "client credentials" flow. That being said, how does one go about ...
10
votes
5answers
2k views

Are case-insensitive passwords a bad idea?

I recently discovered a service where the password was not case sensitive. I understand basic principles of encryption and hashing so I am a bit worried, is this service storing my password in plain ...
1
vote
1answer
71 views

Google account 2FA only with HW security key?

Is it possible to configure 2FA access to a Google account using only HW security key (e.g. Yubikey) without verification SMS code option ? It seems that SMS confirmation code is still primary 2FA ...
0
votes
6answers
221 views

Authorization before Authentication?

From a conceptual point of view, can authorization occurs without authentication taking place first? I'm thinking about few cases where authorization seems to occur without authentication taking place ...
1
vote
1answer
62 views

How does a public key authenticator work? (as opposed to public key signatures)

In the documentation for djbs library NaCl under the headline Security model you can read that the library provides public key authentication without non-repudiability (http://nacl.cr.yp.to/box.html). ...
2
votes
1answer
115 views

How can storing a userId as client-side-sessions be safe?

The documentation for session handling in ninjaFramework states: [...] Ninja uses so called client-side sessions. The cookie itself stores the information you want to attach to that session. ...