Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
2answers
91 views

Authenticated sessions and Man in the middle

I see a lot of websites (including Stackoverflow) using this authentication mechanism: Client authenticates under HTTPS and gets back a session id. Client drops back to HTTP and accesses secure ...
35
votes
11answers
5k views

Sending passwords to someone remotely

As someone who usually works with people in other countries it has always been a problem to send login information to each-other. For development login details like debug databases etc sure I can ...
0
votes
3answers
204 views

failed Login attempts logic

I want to add security to the system login. So here's my idea: If a user tries to login with a valid username but invalid password, then count it as a failed login attempt and store it in the users ...
0
votes
2answers
324 views

Automated software hackers use to try passwords

Because of the eBay hacking, I had to go and look for other accounts that I have used the same password to change the passwords on those site as well. (I know that it's very bad to have same passwords ...
1
vote
1answer
61 views

what are security flaws on providing access to users through a unlisted/private/token/signed URL?

Some web applications enable registered users to grant temporal application access to un-registered users sending token/private/unlisted/signed URLs (I ignore the exact terminology for this), which ...
3
votes
3answers
280 views

PHP IP check as security?

Would just like some input on a PHP script I'm writing. It's just a simple script that only myself should be able to access. I don't have a dynamic IP address, so this isn't an issue for me, but I'm ...
2
votes
0answers
122 views

Why is AWS phasing out public/private key authentication? [closed]

I'm working on the authentication strategy for my app (again). My current strategy is a clone of the AWS strategy of issuing public and private keys and using them to sign requests sent to my API. My ...
6
votes
4answers
422 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
0
votes
1answer
84 views

Using encrypted data in session key instead of random

I am writing a service-oriented (REST) application that is (nearly) totally stateless: it can authenticate by API keys, but for web UI it uses the session where it stores nothing but an authenticated ...
1
vote
1answer
115 views

Challenge-response login without storing a password equivalent

A problem with many challenge-response login systems is that the server has to store a password equivalent. For example, if the server stores SHA1(salt + password), and an attacker captures that hash, ...
-1
votes
3answers
56 views

How would authentication when depositing, and withdrawing money from a fund, differ?

I have to do a presentation on developing an authentication plan for a financial services application used to manage an investment portfolio. I have to develop use scenarios for the 2 functions ...
4
votes
1answer
160 views

Is it a security risk for users not to logout of a website?

Is it a security risk to myself that I am not logging out of Twitter, Facebook, StackExchange, and a majority of the sites which I am using? Is there a chance for someone to hijack my session or cause ...
0
votes
2answers
107 views

Creating port-specific SSH authentication for the same user

I have a Linux server running SSHD and would like to know if its possible to configure it, such that from within the LAN you only need a RSA key to authenticate (on port X), but from outside the LAN ...
1
vote
4answers
287 views

Log in with email is more secure than a username?

Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
3
votes
1answer
176 views

How do OTP USB sticks work?

I just discovered the YubiKey NEO which seems like a pretty awesome device for maintaining security for a variety of different things including computer login, SSH private keys, GPG private keys, and ...
1
vote
2answers
585 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
0
votes
2answers
196 views

Determining the accuracy of a biometric system

How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?
0
votes
3answers
50 views

Restrict access to admin area by checking SSH connections

Assuming that the users have dynamic IPs (so I can't whitelist) and that setting up a VPN is not an option, is it a valid approach to restrict access to an administration area by only allowing IPs ...
1
vote
3answers
69 views

Is it ok to use the same password for many services with two-factor authentication?

Let's say that I've a relatively strong password, but I don't want to use many different passwords for each different service, and let's say that those services provide two-factor authentication using ...
3
votes
2answers
81 views

Does HTTP Digest Auth provide any increased security in this scenario?

Say I have a website running a popular CMS like Wordpress only over SSL through HTTP Strict Transport Security. Prior, the backend administrator login page could be accessed by anybody simply by ...
4
votes
2answers
140 views

What's the meaning of the term “ad-hoc MAC” (Message Authentication Code)?

In SSL literature, I've noticed the use of the term "ad-hoc MAC". I understand the meaning of MAC (Message Authentication Code) and how it works, but what does the term Ad-hoc MAC mean? Note: With ...
0
votes
1answer
132 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
2
votes
1answer
149 views

SAML and OpenID, centralized and decentralized

I'm learning SAML, which is said to be centralized. To understand the difference with decentralized, I'm reading about OpenID. I find it difficult to understand the difference between the two, ...
7
votes
1answer
329 views

How to stop password recovery attempts on accounts?

I am using social networking services such as My Banking GMail PayPal Facebook Twitter Google+ LinkedIn All of these services text messages me a six digit code to login from anywhere, even a ...
2
votes
5answers
492 views

What is the most credible timestamp I can create for a digital file?

Is it possible to create a timestamp that is so hard to fake, that it could be used as proof or simply strong evidence in a court of law, that something was not created after a certain point in time? ...
2
votes
4answers
338 views

how secure is rsa encryption for a web login without https?

I have a server running rstudio. This is basically a web application, and it is currently only accessible over the local network. The web app takes your Linux username/password in order to log you ...
0
votes
2answers
70 views

Is it safe to use a ECDSA public key as a password seed for GCM/AES?

Two peers already exchanged their ECDSA (curve secp256k1) public keys using a secure channel. They want to establish an authenticated encrypted channel between them. They will use CCM mode and with ...
1
vote
2answers
123 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
10
votes
2answers
711 views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
2
votes
1answer
358 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
1
vote
1answer
110 views

Securing Javascript plugin

My company offers a Javascript plugin that is meant to be embedded with websites. It works in a similar fashion to Google Analytics, in which you add a bit of Javascript and then it does some magic on ...
0
votes
2answers
76 views

Can session data be manipulated without access to source code

When implementing a web-based application, how secure are any session variables against manual manipulation beyond the scope of my code? i.e. when a user is authenticated, if I were to initialise a ...
0
votes
1answer
150 views

What is a AUTH-KEY in the security of the computers?

I don't know if this is the right section to post my question and if it is not I apologize. I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL ...
1
vote
1answer
140 views

SSL Handshake random number?

I realized all of the phase of the handshake but I do not understand how it does that from the two randomly generated numbers are unable to generate a session key that the client and the server uses ...
1
vote
1answer
91 views

Amazon Turk - How secure is it? Strange behavior

I just had this really strange experience with Amazon Turk, where suddenly I was logged into someone else's account. I was logged into the company's Turk account, left my computer for a while, ...
0
votes
0answers
61 views

Can the device seed be recovered from the iPhone/Android RSA SecurID app?

The Windows RSA SecurID app allows the device seed to be determined and cloned from one machine to another (see this blog post). Do either the iPhone or Android RSA SecurID apps suffer from the same ...
3
votes
2answers
152 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
1
vote
3answers
457 views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Several systems rely on using UID of smart card for identification/authorization. For example database stores list of smart card UIDs and corresponding privileges. Given that today there exist cards ...
0
votes
1answer
808 views

Use SSH config file with Putty [closed]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
1
vote
3answers
141 views

How can I add a layer of security to cleartext passwords and SSL?

I'm creating a web API in .Net for a web application. I'm wondering what the industry standard for login authentication is. I know that most people believe that sending cleartext username/passwords ...
3
votes
2answers
171 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...
1
vote
2answers
194 views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
1
vote
1answer
115 views

Web Application Authentication Using Computer Properties

Introduction: I am in the process of building a web-based game that requires user authentication. The vast majority of other gaming sites utilize the typical username/password method for ...
0
votes
1answer
49 views

Evaluation of cryptosystem for authentication and keyexchange

I'm a masters student in computer science who works part time with my own company as a consultant. My lastest project is based on my bachelor thesis which handles everything except the security. The ...
1
vote
2answers
179 views

How to make an efficient bruteforce attack on Windows? [closed]

I've been trying to figure out a way to efficiently bruteforce on Windows, but the method I currently have isn't very efficient. I did some profiling and found out that on average it can go through ...
1
vote
0answers
113 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
0
votes
0answers
107 views

Client-server authentication protocol suggestion

I'm designing an authentication methods for my client/server system consisting of: a windows desktop client application (.NET) windows/linux servers (C++) one "security server" which authorizes the ...
-4
votes
3answers
6k views

How do I hack this login page by using SQL injection? [closed]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
1
vote
1answer
149 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
1
vote
1answer
68 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...