Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
34
votes
7answers
3k views
Are passwordless SSH logins more secure?
I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
3
votes
1answer
675 views
what is the role of RADiUS server and Active Directory to increase the security in wireless networks?
In the CBT Nuggets Video Training, one slide about Wireless networks :
i want to know about the role of Radius to increase the security and how? in this project: Deploy Active Directory and ...
2
votes
4answers
255 views
Client Certificate in SSL HandShake insecure?
Imagine we have an application which is trying to establish a secure connection to a server by using SSL. Now we want the user to authenticate himself with a client certificate which he stores in an ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
1
vote
1answer
155 views
Pre boot authentication for Android phones
is there any way to have pre boot authentication on android phones? It would be nice if it would work with YubikeyONE's one time password mode.
3
votes
1answer
180 views
What is the opaque field in HTTP Digest Access Authentication used for?
Is the opaque field really used for anything? It is specified in the RFC, but is not implemented in Apache. Also, the RFC does not state a reason for having opaque, it is only mentioned as a value ...
4
votes
4answers
326 views
Throttling failed login attempts: exponential timeout? by IP? using a session cookie? captcha?
I'm beginning to think this is not as simple as it looks, and many "accepted" answers here and in SO have alternative answers that criticize them. Here is what I have gathered so far
Most of what I ...
7
votes
2answers
663 views
Keeping user session alive - security considerations
We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
0
votes
1answer
165 views
Protect database resources from fake data inputs via web forms
Scenario:
I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
11
votes
4answers
2k views
Google Account: implications of using application-specific passwords
In the wake of the recent Mat Honan story I decided to try out two-factor authentication on my Google account. But in order to keep using it with Exchange, the Android OS, Google Talk and Google ...
2
votes
1answer
85 views
What's the best way to enumerate log/sign in attempts?
For sign in via a website, what is the best way to count the number of attempts that is:
least vulnerable to tampering
reliable
quick
The system would:
use HTTPS throughout the sign on phase (at ...
0
votes
1answer
486 views
How to create trusted chain of certificates if I have the last certificate?
Good day.
During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using)
My server is:
telnet xmpp.odnoklassniki.ru ...
2
votes
4answers
235 views
Login form authentication logic
I am building my login form action, and I want to make sure my logic is solid and as secure as possible.
1.) First I check if the provided e-mail address exists in database, if not, I show a generic ...
15
votes
12answers
2k views
Why do we even use passwords / passphrases next to biometrics?
In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
-1
votes
2answers
339 views
How can Facebook 2FA mechanism be hacked? [closed]
two-factor authentication process that uses one-time random code,I think season hijack can be used, I would like to know if there are more techniques to crack it.
With season hijack, I think that if ...
3
votes
3answers
427 views
How to distribute client certificates without exposing private key?
I'm desgining a B2B web service based on WCF. As the number of clients is relatively small and security is a priority, i have chosen to go with X509 client certificates for client authentication.
I'm ...
6
votes
4answers
565 views
why a client authentication is not commonly performed in the TLS protocol?
Is there any reason for this other than key/certificate management on the client-side?
3
votes
2answers
149 views
Secure login across two web apps
I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1.
APP2 needs to know an ID of the user who is ...
3
votes
1answer
73 views
SRP: Can the client authenticate using only the stored hash?
Based on the description of SRP, it seems that it would be possible for a client application to cache the hashed password x and reuse it for subsequent authentifications. The actual password p doesn't ...
3
votes
2answers
184 views
User authentication + database encryption with same password
I'm working on a private project where I need to store a users financial data in a database. I'll encrypt this data using AES, and I'll be using scrypt to generate a AES ecnryption key from a more ...
12
votes
2answers
326 views
Which factors should I consider for devices that accept handwritten digital signatures?
These days many locations ask you to give your signature on a digital signature pad/device.
As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
48
votes
12answers
2k views
How do you log in from an unsecured computer?
Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
4
votes
2answers
721 views
When using symmetric key encryption, do we need to sign?
Say we're using a shared key between two parties, that has been distributed using public key encryption, is it still necessary to sign any data that's encrypted using the shared key? Or is it enough ...
5
votes
3answers
239 views
DHE exchange and client authentication
If a server has a known public key and a Diffie-Helman exchange is performed and signed by that key, is there any benefit to authenticating the client before establishing a secure channel instead of ...
-2
votes
1answer
83 views
Digest authentication - client side [duplicate]
Possible Duplicate:
Client side password hashing
How one design support for digest authentication in client side. HTML form probably won't help. Does one need javascript and set the header ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
6
votes
2answers
205 views
An adequate message authentication code for REST
My REST service currently uses SCRAM authentication to issue tokens for callers and users.
Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
5
votes
2answers
185 views
How to login and encrypt data with the same password/key
I've made a "vault" web app in PHP for storing passwords, credit card numbers, etc. It's mostly just for myself, but I'm practicing building it with multiple users in mind. I use two way encryption to ...
5
votes
1answer
318 views
False negative in biometrics
In biometric systems preventing false positive is usually far more important than preventing false negatives. In what situations can false negatives be more serious than false positives?
5
votes
3answers
957 views
HTTP Basic auth password storage more secure than Digest auth
If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
6
votes
2answers
2k views
How does ssh public key authentication work?
My basic understanding is this:
The (connected to) server's sshd uses the public key to encrypt some message
The client's ssh or ssh-agent decrypts it and sends something back (the message's ...
6
votes
3answers
180 views
How to suspend a user from my website and prevent them from creating a second account?
I am an outsourcing person, not a programmer. My website is a shopping website (think eBay). My website will need a user suspension feature, in case a user violates the terms and conditions. The ...
2
votes
1answer
117 views
Can Diffie-Hellman Anonymous be used as a cipher for SSL for one-way certifiate-based authentication
I want to use Diffie-Hellman anonymous cipher for SSL. I also want to use a one-way certificate for server authentication. Is this possible?
3
votes
1answer
147 views
Payment security on Android App
I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs.
I know there are many payment services available. One of ...
3
votes
4answers
117 views
Strong authentication over insecure links
Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the ...
3
votes
1answer
107 views
Mitigate risk of security questions [duplicate]
Possible Duplicate:
Do security questions subvert passwords?
Many Web sites nowadays require a (hopefully strong) password along with some pretty easy security questions. Sometimes it is ...
2
votes
1answer
156 views
Password authentication using DynamoDB
I'm working on a Mac app. I have users stored using DynamoDB.
Authentication is needed to enforce access control on system-internal operations, such as uploading files to Amazon S3. Of course, I ...
9
votes
2answers
417 views
My bank makes me enter my password using the mouse. What's up with that?
Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
4
votes
2answers
309 views
Do Client Nonces enhance the security of HTTP Digest Auth?
As far as I understand the answer at
http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...
1
vote
0answers
131 views
Verifying Authenticode signed executables and DLLs using OpenSSL API [closed]
I have installed openssl and now the rsa_test.c is running fine. What I want to do is:
Open any exe or dll digital certificate. Extract the Thumbprint and PublicKey.
The public key contains the ...
0
votes
0answers
129 views
Roundcube login only looks at first 8 characters of password entered? [closed]
I have two hosting accounts with WebFaction, and I am using RoundCube webmail interface to access my mail that is associated with those accounts. I have multiple mailboxes on both accounts. It seems ...
4
votes
1answer
87 views
Does DPAPI works if a user hasn't a login password?
I was wondering if the DPAPI will still work properly if a user doesn't have a a login password (like most of the home users). I can't find this information on Google or in the official documentation ...
1
vote
1answer
157 views
Device authentication mechanism
I am doing a project that needs device authentication with a gateway. What are some of the best ways of doing that ? Whether a certificate based mechanism is feasible in this case ?
2
votes
1answer
234 views
How does DCOM authentication compare to RPC based authentication/auth?
The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM
A CA running Windows Server 2003, Enterprise Edition, ...
2
votes
2answers
268 views
Wi-fi security using WPA or WEP
In current years we have used WPA and WPA 2 for the encryption of data sent over an 802.11 network. But in the past WEP is used . From time to time, many people say that WEP (Wired Equivalent Privacy) ...
7
votes
2answers
274 views
BCrypt's 72-character limit and using it as a general digest algorithm
Goal: have token/cookie-based authentication that doesn't require keeping sessions on the server
TL;DR: What, if any, is the accepted mechanism to work around the 72-character limitation of BCrypt?
...
1
vote
1answer
185 views
Silent (no user interaction) utility to clear cached credentials on Windows [closed]
Is there any way to clear cached credentials on Windows, that doesn't require:
user interaction (e.g. a confirmation window);
administrator access; or
making a persistent change to the ...
19
votes
7answers
2k views
How to prevent cheating (extra votes) in online contests?
Mitigating Cheating & Voter Fraud in Online Contests…
We run online contests of various sorts that involve users voting on entries (usually one vote per user per day). The prizes range from ...
4
votes
1answer
223 views
How to disable caching of form data?
A web page accepts user name and password data within an HTTP POST request. This POST request actually shows up as an entry in the browsers history. After user logout from the application and ...
