Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

9
votes
1answer
567 views

How secure is Windows 8 email authentication?

I boot up Windows 8 and the first thing I notice is that it allows you to login with your email credentials. Let's say if my laptop is stolen then what are the advantages or disadvantages of email ...
9
votes
4answers
443 views

How should I tell an organisation that they are vulnerable when I wasn't given permission to check?

I was recently at a village hall (in the UK), some distance from where I live, for a party. I noticed that they had unsecured wi-fi with an SSID of NETGEAR. I assumed it was free wi-fi for users of ...
9
votes
3answers
1k views

Length of CSRF Token

Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
9
votes
3answers
471 views

Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?

It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
9
votes
1answer
266 views

What shell binary should I use for the root account on a Linux system?

Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
9
votes
1answer
360 views

Optimal variable sizes in the Secure Remote Password protocol

I am implementing the Secure Remote Password protocol: U = <username> --> <-- s = <salt from passwd file> a = random() A = g^a ...
9
votes
1answer
142 views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
9
votes
2answers
3k views

Keeping user session alive - security considerations

We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
9
votes
2answers
513 views

NFC used in place of contact based smart card two-factor authentication

My organization is trying to move away from contact based smartcards (because our hardware vendor is no longer integrating them into their current systems) to some other form of two-factor ...
8
votes
5answers
402 views

Oldest security feature still in active use

Beyond commonsense and physical access controls, is the system password the oldest still in active use security feature? By physical access, I mean for example leaving the system within a secure ...
8
votes
7answers
338 views

Aren't permanantly logged in accounts inherently insecure?

The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these ...
8
votes
3answers
13k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
8
votes
5answers
307 views

How to verify new accounts against a known persons database?

I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
8
votes
3answers
3k views

What common products use Public-key cryptography?

I want know what common use products are there that use public key/private key cryptography?
8
votes
4answers
1k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new ...
8
votes
1answer
1k views

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

The default usage of HttpClient and HttpWebRequest .NET classes is setting Credentials property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization ...
8
votes
3answers
526 views

Why would a website allow answers to security questions to be used interchangeably?

I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are: ...
8
votes
5answers
1k views

Email instead of username

I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
8
votes
4answers
681 views

Is using a flash drive as a base for security a safe thing to do?

I'm developing some software for schools. I've found severe flaws with the current popular school LAN protection that I feel needs fixing so I plan on releasing my own software. One the those ...
8
votes
2answers
577 views

Is a rand from glibc's rand secure for a login key?

Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
8
votes
3answers
330 views

Security of pronounceable passwords

Some random password generators support the generation of pronounceable words of any given length n. Assuming that words are derived using 26 lowercase letters, the number of possible words of length ...
8
votes
2answers
697 views

Should user be allowed to save password in browser?

The auditing company found a bug "The Auto-complete form attribute is set in password field". They suggested to disable autocomplete for this field to prevent disclosure of it "when working on shared ...
8
votes
3answers
678 views

zero knowledge proof and its protocol

In Zero-Knowledge Proof where we take the analogy of Peggy (Prover) and Victor (Verifier): In this story, Peggy has uncovered the secret word used to open a magic door in a cave. The cave is ...
8
votes
3answers
2k views

iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

With such a big deal being made about the iPhone 5S's fingerprint reader (and formerly the Thinkpads' fingerprint readers) I really wonder how secure it is to use fingerprints in lieu of passwords. ...
8
votes
3answers
7k views

Choosing a session ID algorithm for a client-server relationship

I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
8
votes
5answers
1k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
8
votes
4answers
4k views

HTTP Basic auth password storage more secure than Digest auth

If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
8
votes
4answers
3k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
8
votes
6answers
7k views

One Time Passwords. Using OTP at Windows, Ubuntu and internet sites

my question is this: Is there a way (software,hardware/token or web-ware) to use One Time Passwords in the following scenarios: Logon to my pc/laptop (windows or ubuntu) Logon to sites with OTP ...
8
votes
6answers
3k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
8
votes
2answers
426 views

Is there a way to negotiate a secret between 2 parties with no prior knowledge?

Is there a way for 2 parties to negotiate a shared secret (for example, a session key) without having a pre-shared knowledge? SSL does this by using asymmetric encryption. Is there any other way to ...
8
votes
4answers
8k views

Difference between authentication and identification [Crypto and Security perspective]

I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification. ...
8
votes
2answers
309 views

What's wrong with this authentication system?

I'm a software developer with an interest in and basic level of knowledge about security. I've come across an authentication system that "smells bad" to me however I lack the expertise to know what if ...
8
votes
4answers
3k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
8
votes
3answers
561 views

Which authentication at the end of the Secure Remote Password protocol?

For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this: M = H(A | B | K) --> <-- H(A | M | K) ...
8
votes
3answers
8k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
8
votes
2answers
504 views

How is an HTTPS login secure when pages use HTTP?

When someone go to eBay's website, they use an unencrypted connection between their PC and eBay's server. If they sign in, they are redirected to a secure site identified by its certificate and may ...
8
votes
4answers
445 views

Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?

This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
8
votes
3answers
1k views

Verify Login and Encrypt with PBKDF2

I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
8
votes
2answers
296 views

Is the argument really over on SSO?

I got shot down on ServerFault recently for suggesting that SSO can be less secure than having different credentials for each service. What are the arguments against SSO?
8
votes
1answer
790 views

What were the specific security flaws with OAuth 1.0? How are they being addressed in 2.0?

I read an article documenting Twitter abruptly pulling its OAuth support back in April 2009. The article said it wouldn't specify the hole for security reasons, but mentioned "social engineering" is ...
8
votes
4answers
874 views

Are Java applets more secure than regular forms for login?

In Norway we have something called BankID which is a login solution for banks and other stuff. It consists (from a users point of view) of a Java applet where you enter your SSN (person number), a one ...
8
votes
2answers
2k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
8
votes
2answers
2k views

How reliable are device IDs provided by PhoneGap on Android and iOS?

I have a web application that allows users to add mobile devices to their accounts (using mobile app). Each device is uniquely referenced by its UUID. Mobile client is developed using PhoneGap, so ...
8
votes
1answer
498 views

Build a secure channel without SSL/TLS

I'm looking at possible options to build a secure channel between multiple embedded devices with limited cryptography capabilities and an HTTP server (It could be some sort of web service). 1. ...
8
votes
2answers
437 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
8
votes
1answer
392 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
8
votes
5answers
5k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
8
votes
1answer
2k views

Designing single-sign-on with JSONP/CORS?

I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions). I would like to do something ...
7
votes
6answers
2k views

Is denying login after incorrect attempts ineffective?

Generally denying login attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicious login attempts. Yet, surely doing this is ...