Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

19
votes
4answers
2k views

Why use a Smartcard for (Two Factor) Auth instead of another medium?

I recently installed Bitlocker on my Windows 8.1 machine, using only a password. I was thinking of getting something other than just a password for my storage drive, something physical, like a USB, SD ...
6
votes
2answers
8k views

Creating user specific authentication methods in SSH

I have configured sshd on an Ubuntu server to use key authentication and it is working fine. I had to disable password authentication for key authentication to work. Server is always accessed via ...
6
votes
1answer
153 views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
29
votes
2answers
19k views

JSON Web Tokens (JWT) as user identification and authentication tokens

I'm implementing a REST service that requires authentication. I cannot store any per-user state (such as a randomly-generated token) because my service does not have direct access to a database, only ...
2
votes
2answers
348 views

Is it safe to use virtual mobile numbers for verification

Is it safe to use virtual mobile numbers for account verification & authentication for services such as PayPal, Twitter, Gmail, Linkekdin, etc.? And what is the security drawback for this?
3
votes
1answer
193 views

Securing server to server http communication

We are trying to come up with a scheme to secure http communication between our internal servers. Are there any good established schemes out there? The requirements we have are: The clients and ...
2
votes
2answers
105 views

Code Signing Confusion

I usually make free windows applications, now I want to digitally sign them. So users can be sure that its from me. But instead of buying the code signing certificate, I thought I may create my own. ...
4
votes
3answers
468 views

Security for home server, wiki

I recently set up my own home server, running Ubuntu linux. The intent I'm having for this is to have a private wiki for my family, so we can have a place to collect information like phone numbers, ...
0
votes
1answer
116 views

Is a Cloud-Connected Door Lock More Secure Than a Traditional Lock and Key?

Now that app based door lock replacements are getting more popular in the market, I'm wondering what the security risks are and why or why not this is more secure than an old fashioned lock with a ...
2
votes
2answers
194 views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at http://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
1
vote
1answer
63 views

Is selecting trusted computer in 2-step verification less secure?

In using 2-step verification, does selecting 'Trusted Computer' a less secure options? https://support.google.com/accounts/answer/2544838?hl=en If so, is it still a reasonably secure option?
1
vote
1answer
159 views

Chat encryption system avoiding protocol sniffing and then key+decryption replay?

I'm working on a chat system and I want to add it some kind of security (not just HTTPS with SSL since I've read it can be sniffed and decrypted with a few tools). Now, my knowledge in cryptography is ...
5
votes
5answers
3k views

Is there a reason to protect SIM with PIN?

If phone would be stolen then SIM card will be thrown out by thiefs just after the theft so that they can't be found. If phone would be losed then it will be harder to find an owner for people that ...
0
votes
2answers
119 views

Stateless session cookie and logout

I have implemented stateless session cookie, something along the lines of this article: Demystifying Web Authentication (Stateless Session Cookies) The cookie contain an expiry time within the ...
0
votes
1answer
122 views

Is (WEP) shared key authentication secure?

I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds ...
0
votes
2answers
89 views

Should I use HMAC in this situation

I need to store a big message encrypted on a server. What I am about to do is: Encrypt the message with a AES key; (Authentication) Hash the message with SHA512 and encrypt the hash with RSA priv ...
0
votes
1answer
353 views

Shall I set “RSAAuthentication yes” in sshd_config if I use only ECDSA key?

In a context of proprietary client boxes and servers, I want to limit authentication to ECDSA keys. Historically, "RSAAuthentication yes" was used to enable authentication with RSA and maybe DSA keys. ...
1
vote
5answers
132 views

Is there a term for Authorizing before Authenticating? Is it even common?

In most scenarios a person identifies who they are (authentication/AuthN) via something like a username and password. Afterwards a system would likely evaluate what that validated identity can perform ...
1
vote
2answers
133 views

Prevent logging in by pressing Enter - security by obscurity?

An online banking site which I use, has a "feature" which disallows a user from pressing Enter to submit a login form. For example, if you have typed your username in the Username field, pressing ...
0
votes
0answers
36 views

Preventing “existing accounts” data leak during account creation [duplicate]

It is common practice for web apps to prevent mining of existing user accounts for logins (with "username and/or password does not exist" rather than "user does not exist"), and for password resets ...
0
votes
0answers
24 views

Client side ssl auth by signing with server key [duplicate]

So I followed this for setting up client ssl certs using openssl: http://drumcoder.co.uk/blog/2011/oct/19/client-side-certificates-web-apps/ It basically walks through creating a new CA key, and then ...
1
vote
0answers
434 views

automatic connection from LSASS to different IPs. Is this the usual behavior?

I'm using windows 7. firefox 22. connecting through a regular residential wifi router. In the last month I've noticed that when I connect to the internet and once in a while my firewall indicates me ...
2
votes
2answers
62 views

Best practice to secure an API of unknown structure that can come from end user device or server [closed]

I'm trying to create an API with minimum forced structure. The messages can come from end user device or from a backend server. I'm ok with opening separate API for end user traffic and from servers. ...
1
vote
1answer
66 views

Communication between two open endpoints, is this secure enough?

I'm building a (very simple) tool to communicate between two servers. I started by asking if there was a better alternative than making a home made scripts and we came to the conclusion that for ...
165
votes
7answers
28k views

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, ...
28
votes
7answers
2k views

If I include a Forgot Password service, then what's the point of using a password?

I've implemented a Forgot Password service in the following way: User goes to login page, clicks on "Forgot password?" User is presented with a form that asks for their email address. Email is sent ...
0
votes
2answers
164 views

Recovery plan in case of lost Android smartphone with Google Authenticator?

So I am using Google Authenticator as my two factor authentication. I'm not a security expert, but I was thinking late last night as I was about to fall asleep: How can I login to my favourite ...
0
votes
1answer
80 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
0
votes
1answer
257 views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
0
votes
3answers
68 views

How SplashData knows about Worst Passwords used by users annually

It is known that every reputable website stores their user passwords into their database after implementing some hashing algorithm on it, and even they don't know what the actual password of the user ...
3
votes
4answers
196 views

Hardware token to authenticate web application

My company is developing a web application, and I was asked to research how to do hardware-based token authentication to login into our web application. Let me repeat: basically there will be a web ...
1
vote
1answer
86 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
2
votes
3answers
149 views

Web site accepting authentication via GET

There is a sign-in form on the website, which submits login/password via POST method. Problem is, that code, which accepts login/password and authenticate user also accepts it via GET method (also, if ...
4
votes
3answers
359 views

How does EAP/PEAP integrate with modern security protocols?

How exactly does Extensible Authentication Protocol (EAP)/Protected EAP integrate into modern security protocols? What I know (or not know) so far... It's used by wireless networks utilizing ...
2
votes
1answer
750 views

Facebook oAuth2 for Javascript client application

When implementing Facebook login using oAuth2 (the Javascript version), I receive an access token back from the Facebook auth server. So far so good. The problem I have is that I want to implement a ...
-1
votes
1answer
52 views

How do server know the CSR sender is approved client?

Suppose have a server provide a POST url to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The prblem is anyone can POST a CSR to the server and then ...
0
votes
1answer
73 views

How do you log into Amazon Web Services if you lose your phone which has Google 2-factor authentication set up?

And if it is possible, how do you prevent other people from claiming they are you and lost their phone? Amazon only directs you to a page which does not exist. http://aws.amazon.com/iam/faqs/ If ...
6
votes
2answers
1k views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
3
votes
2answers
53 views

What is the name for “imperfect” verification options?

Let's say users log into a system using a voice-print. Software can read the input from the microphone, compare it to the stored sample, and tell the user "There is a 97.5% similarity to the ...
0
votes
1answer
62 views

Securing access tokens?

Preface: I have no experience with securing applications whatsoever. I'm building a web app that uses Google Plus authentication to sign users in. My initial thought is to save the access token that ...
3
votes
1answer
403 views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
0
votes
1answer
44 views

User-friendly public/private manual authentication protocol

I have a remote service which allows users to SSH login to the machine and they're automatically sent to the (command line) application (without access to a bash prompt, for instance). In the course ...
1
vote
1answer
269 views

Sharing RSA Public Key for decrypting JWT amongst Load Balanced servers

I'm trying to implement a cookie-less authentication mechanism for a web API that is stateless on the server (does not store session tokens) and can be load balanced across several servers. I have ...
0
votes
1answer
71 views

single sign on across two servers

I have been wondering how and what kind of tools are needed to do single sign on in the following scenario: 1) Alice is logged in to site X hosted by server W 2) Alice navigates site Y hosted by ...
3
votes
2answers
3k views

How does Authy's 2FA work, if it doesn't connect to the server?

I thought I knew how two-factor authentication works: I enter the password. Server generates a random number (token) and sends it to me via SMS. I enter this token. Server checks that the token I ...
5
votes
2answers
675 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
-2
votes
1answer
111 views

What is “Pass the hash” attack?

The article on Wikipedia doesn't explain how the attacker can authenticate to the remote server using the hash instead of the original password. According to the following article the attack is still ...
0
votes
1answer
134 views

Is the following PayPal Vulnerability a design/implementation flaw?

I am trying to understand the logic behind following vulnerability, I believe this a design flaw not only an implementation. To me the problem with the two-factor authentication service at PayPal is ...
0
votes
2answers
76 views

Detect Different Machine using Browser [closed]

Some web apps like Facebook and Gmail detect the first time we try to login from a device. Assuming that a browser can't read machine name, and MAC ADDRESS. What kind of variables are they collecting ...
19
votes
5answers
5k views

Why is “something you know” the weakest factor of authentication?

Quoting from CompTIA Security+ guide The first factor of authentication (something you know, such as password or PIN) is the weakest factor. Why? it makes sense when we say that humans/users ...