Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
6
votes
2answers
206 views
An adequate message authentication code for REST
My REST service currently uses SCRAM authentication to issue tokens for callers and users.
Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
6
votes
1answer
383 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
6
votes
1answer
779 views
NVidia update service creates local account on system. Does anyone know the users password?
Nvidia update service has created a local user on several of my boxes. Does anyone know its password? I recon it could possible be leveraged as an entry way for an attacker.
Details:
wmic ...
5
votes
4answers
508 views
Password hashes should run md5 thousands of time: really?
I skimmed through How Companies Can Beef Up Password Security and I thought that several assertions were completely wrong, in particular:
Cryptographic hash (like md5) with salt are bad.
It isn't ...
5
votes
6answers
524 views
How do I secure my login page?
The login page is the starting point to any web site and the most important thing to authenticate the user.
When I begin to build any web application, I take a lot of time to think about how to ...
5
votes
6answers
803 views
Prevent denial of service attacks against slow hashing functions?
I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
5
votes
3answers
243 views
How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?
I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.)
I have a 20+ digit password, however there's apparently a new requirement for Microsoft ...
5
votes
3answers
248 views
Mutual authentication for humans
Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...
5
votes
2answers
177 views
How should hospitals handle the use of sharing credentials to access sensitive information, especially in critical situations?
Most organizations today hold individuals accountable for their actions on systems and networks by unique user IDs and passwords. However, imagine working in a hospital environment where access to ...
5
votes
5answers
92 views
How secure is using CRAM-MD5 for email authentication, when not using an SSL connection?
Background: My current server-provider tells me it's no problem to store the passwords in plain-text in the database, saying he has to do so because they use CRAM-MD5 for email authentication. My ...
5
votes
3answers
236 views
Why would a website allow answers to security questions to be used interchangeably?
I needed to reset my password on a website that uses security questions for the purpose, and I noticed something strange. My hypothetical security questions are (not the ones I actually use) are:
...
5
votes
3answers
163 views
Should we be checking password restraints on log in forms?
We have many restraints we put on users when they set up their password. These restraints include password length, characters they can or cannot use, the use of numbers and letters, capitalization ...
5
votes
6answers
1k views
Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?
I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
5
votes
3answers
1k views
Bell-LaPadula imlementation example
I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example.
I understand how the model works, but I have difficulties implementing it in a programming language ...
5
votes
3answers
242 views
DHE exchange and client authentication
If a server has a known public key and a Diffie-Helman exchange is performed and signed by that key, is there any benefit to authenticating the client before establishing a secure channel instead of ...
5
votes
3answers
381 views
Is my session-less authentication system secure?
So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
5
votes
2answers
866 views
Verify SAML Response is from a Trusted Source
I'm in the process of making changes to my site so that we can be a SAML 2.0 Service Provider. We will be doing IdP initiated SAML with Out-of-Band account federation.
My question is this: Given a ...
5
votes
2answers
753 views
How effective is the Mac Open Firmware password protection?
I have used Mac's Open Firmware password protection before and I've always wondered how effective it actually is at protecting my stuff.
[assuming a good password]
Would does the firmware password ...
5
votes
2answers
339 views
Email instead of username
I am wondering about the security implications of using email as the main identifier via which a user logs in (with an associated password, of course). Can I treat it as I would a normal username or ...
5
votes
4answers
298 views
Automating Social Engineering Prevention
Being an advocate for DIO (defensive information operations), I have always been concerned about social engineering and its relation to server security. Giving administrative access to staff members ...
5
votes
3answers
444 views
Is there a reason to protect SIM with PIN?
If phone would be stolen then SIM card will be thrown out by thiefs just after the theft so that they can't be found.
If phone would be losed then it will be harder to find an owner for people that ...
5
votes
2answers
487 views
ssh public/private key pair
I am having problems understanding how ssh really works. I know it uses a public key cryptography to encrypt messages. However, I can ssh to a server without first generating a public/private key pair ...
5
votes
3answers
649 views
Attack vectors for brute-forcing website passwords
When talking about password security, a lot of discussion centers on the risk of a password being guessed in a brute-force attack. For websites where a user has registered an account, what are the ...
5
votes
2answers
188 views
How to login and encrypt data with the same password/key
I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
5
votes
3answers
972 views
HTTP Basic auth password storage more secure than Digest auth
If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
5
votes
2answers
203 views
System for Mutual authenticaion and confidentiality
I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
5
votes
6answers
230 views
Is there multi-factor authentication for machines?
Most of what I have seen on mutiifactor authentication (eg wikipedia or here on se) seems human centric. Ie it is a human interacting with a machine and the factors are associated with authenticating ...
5
votes
2answers
633 views
Could this login form be “hacked” to allow access?
We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell:
$email=$_POST['email'];
...
5
votes
4answers
1k views
HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
5
votes
1answer
129 views
How can a new website create trust with users?
Earlier I asked a question on how to authenticate business identities, now I am wondering on the other side (the user side).
There is also How do I choose whether to trust a particular website?
How ...
5
votes
2answers
689 views
How does openid implement Single sign on?
I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
5
votes
1answer
592 views
TLS at layer 4 BUT 802.1X EAP-TLS at layer 2?
In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine.
Port security 802.1X and EAP is a data link layer 2 ...
5
votes
6answers
284 views
What's the most secure technique for authenticating user in a website?
I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
5
votes
1answer
281 views
OpenPGP Encryption / Decryption Process Using GnuPG
I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
5
votes
1answer
539 views
Ways to sign gpg public key so it is trusted?
I have a service through SSL which gives the user a code for a specific reason. I want to sign the code with the web server's private key (gpg --clearsign) and send the signed code along so that they ...
5
votes
2answers
332 views
How can I authenticate a client connection in a secure way?
Let's say I have a server listening on port 1234. I have some client software that needs to be able to connect to this port. But I want to prevent malicious users from bypassing the client software ...
5
votes
1answer
322 views
False negative in biometrics
In biometric systems preventing false positive is usually far more important than preventing false negatives. In what situations can false negatives be more serious than false positives?
5
votes
1answer
223 views
What is the benefit of the scope in OAuth2?
In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless.
This question refers to ...
5
votes
2answers
156 views
Authenticating client without hardcoding key?
A basic question, but I'm not a master and this is puzzling me-
How is it possible to authenticate a client from the server's perspective?
i.e. imagine you're the server, and you want to give the ...
5
votes
1answer
15k views
How do I clear cached credentials from my Windows Profile?
Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data.
How can I backup and purge this data?
5
votes
3answers
654 views
What are some good ways to verify user identity for password resets?
I'm wondering how others verify the identity of users they're resetting passwords for. We currently try to speak to a manager at work, but it frustrates end users and seems like we don't trust them. ...
5
votes
2answers
325 views
Length of CSRF Token
Is there any standard length of the token which should be used while generating the random tokens? Should we use the same standard which we use for generating Session IDs?
5
votes
2answers
340 views
Cellular phone cloning
It is known that certain methods of authentication are used to tie a particular device to a particular phone number, so that cloning can be prevented.
What are these authentication mechanisms? ...
5
votes
1answer
83 views
Are there risks of using the same OpenID provider for sites with different security levels?
I always use the same OpenID provider (Google, with a strong unique pw and 2-factor auth) in every site that supports it, without thinking twice. It's my understanding that, as long as the provider is ...
5
votes
4answers
688 views
MDK3 warns about WPA2 downgrade - how do I find the key in Wireshark?
While stress testing my router using MDK3, I got the message "REALLY BIG WARNING!!! Seems like a client connected to your target AP leaks PLAINTEXT data while authenticating!!"
I viewed the tool ...
5
votes
2answers
1k views
Dealing with expired or revoked signing certificates with Infopath documents
Suppose I have an Infopath form that is digitally signed today by a valid, and active user.
When that user leaves the company, we disable the account and revoke the certificate. This causes a problem ...
5
votes
1answer
93 views
Security and authentication problem
We have a sample scenario and we would like to receive some feedback and some solutions regarding possible security schemes.
First of all, lets imagine a real world scenario:
Imagine that a user ...
5
votes
3answers
335 views
Verify Login and Encrypt with PBKDF2
I'm writing a desktop application where I'm using PBKDF2 to generate an encryption key to AES-128 encrypt the config file. The config file contains a crypo-random key that's been used to encrypt the ...
5
votes
2answers
126 views
What are the risk tradeoffs of all-in-one “smart” IDs vs. using a separate hardware authenticator?
In many organizations these days, employee IDs are very mutli-functional. They can serve as:
Visual identitiy verification. (Including employee photo, name, ID number, and other details on the ...
5
votes
3answers
595 views
Why banking websites always ask me to authenticate my PC even after I'd chosen to “Remember my Computer”?
Why banking websites always ask me to authenticate my PC even after I'd chosen to Remember my PC? This is the case with all banking websites
