Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
0answers
26 views

Persona combined with stateless token authentication

My REST-Backend is using Mozilla Persona to authenticate users. Normally you would just use cookies to authenticate any further requests but I want to use token based authentication (out of personal ...
0
votes
2answers
71 views

password strength audits and mitigations

Reading this article about detecting bad passwords in the enterprise, made me want to ask if anyone here has attempted any audit like this. It would be an effective attack: There may be a good ...
34
votes
4answers
19k views

Demystifying Web Authentication (Stateless Session Cookies)

I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages. Here is my first ...
1
vote
1answer
90 views

Pros and cons of security images [duplicate]

Over the past year or so, I've noticed that all of the banking organizations I work with that have or had "security images" as part of their login process have removed or are planning to remove that ...
2
votes
2answers
132 views

Selfie as form of authentication for credit card transactions

I read in a news snippet on various sites (cnn for one), that one of the large credit card companies wants to implement some sort of authentication whereby credit card transactions are authenticated ...
2
votes
1answer
79 views

What reasons are there to not just send the API key as an HTTP header over HTTPS?

I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
1
vote
1answer
56 views

Encryption strategies for multi users access revisited

This is a follow up to this post: Encryption strategies for multi users access in production systems I don't see how this can work given the second bullet point: Kc is stored on the computer n ...
11
votes
3answers
9k views

What are the disadvantages of single sign-on authentication?

We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication. In the words of ...
0
votes
2answers
2k views

Security benefits of Single Sign-On [duplicate]

What are the benefits of a single sign-on implementation from the point of view of security? From my point of view, if the account is compromised the attacker has access to any resource, so ...
0
votes
0answers
54 views

Bluetooth LE 4.0 security issues [duplicate]

How does BLE secure communications between devices? BLE 4.0 supports AES128, and the key exchange is done using DH. However, it is often reported that BLE 4.0 has security issues. What specifically ...
3
votes
1answer
575 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
0
votes
1answer
58 views

WebCrypto, SOP and Yubikeys

I've been following some discussions on WebApp Security mailing list regarding WebCrypto and SOP policies (100+ messages). One of the things that kind of sprang out was keys held in WebCrypto were not ...
8
votes
3answers
242 views

What advantage does the Bloomberg authentication system have over traditional 2 factor?

Bloomberg clients have an interesting way to authenticate to the server. This seems involve some of the following: Logging into a secure website, that displays a flashing square Swiping your finger ...
4
votes
3answers
363 views

Message Authentication Codes (MACs)

What is the main difference between Message Authentication Codes (MACs) and hash function? Is there any difference regarding their usage domains?
1
vote
3answers
91 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
1
vote
2answers
382 views

Storing Seed for TOTP

We have a public website for employees which has access to some sensitive company information. To make the login process more secure we want to implement TOTP. The setup and implementation has been ...
1
vote
0answers
69 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
5answers
6k views

Does using WPA2-Enterprise just change the attack model vs WPA2-PSK?

As far as I can tell based on the reading I've done so far, WPA2-Enterprise uses the same encryption and security algorithms and methods as WPA2-PSK, with the addition of using another service for ...
7
votes
5answers
5k views

Is there a reason to protect SIM with PIN?

If the phone would be stolen then the SIM card will be thrown out by thieves just after the theft so that they can't be found. If the phone would be lost then it will be harder to find an owner for ...
20
votes
8answers
9k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
4
votes
3answers
177 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
1
vote
2answers
151 views

Questions about user authentication over REST API

I'm now trying to implement user authentication on my android app. I, however, have a few questions. I use a REST API. How do I safely request and send data to and from the phone? I'm assuming that I ...
0
votes
1answer
142 views

Authentication SSO token security - SAML, OpenID Connect

I am trying to understand how works various SSO technologies like SAML 2.0, OpenID Connect 1.0. In general, they work in a similar way providing tokens (XML, JSON) through Identity Provider to ...
2
votes
0answers
69 views

Zero Knowledge Proof Password Systems

I am wondering if there is a practical zero-knowledge proof system that can be used by humans to authenticate themselves to a server. Note that even the computer can not be trusted (at least with the ...
1
vote
1answer
76 views

How dangerous is reflected request query strings?

I have discovered a possible security flaw in a login for a site that many people rely on. I won't say the site but in the URL there is something similar to ...
-1
votes
1answer
60 views

Authenticating users by checking if the key can decrypt a phrase vs by checking a password against a database [duplicate]

I'm kind of curious: Why would we store a password in a database when we can just encrypt a phrase such as "unlock me" using that password and then, at login, seeing if the encrypted phrase can be ...
0
votes
0answers
19 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
2
votes
2answers
90 views

How can Authenticity be achieved in SMS or Text Messaging?

What tools or information is needed to verify the authenticity of a SMS message... or to send one so that such authenticity is intact? This answer describes something as a "message center", but I'm ...
0
votes
1answer
2k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: ...
3
votes
1answer
74 views

What are the security implications of having login dialog inside of an iframe

I have the page to render some content and I allow it to be embedded at any third party page, so I can't use X-Frame-Options. One of the requirements is to ask user for login/password when content ...
2
votes
0answers
145 views

Astonishing Recent Belkin Router Auth Bypass Vulnerability: CSRF Used to Exploit?

I was visiting the CERT site main page today for another reason when I glanced at the list of recent vulnerability bulletins and came across some news I had somehow missed before today: a notice that ...
53
votes
3answers
100k views

What is the difference between authorized_key and known_host file for SSH?

I am learning basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
3
votes
2answers
54 views

Can a Meta Tag be Spoofed? (Is a Metatag Sufficient to Declare a Page is Protected?)

Background I am working as a front-end developer, and I have very little security experience. We are working with a very obscure backend setup, using a 4D database and WebClerk on top of it. ...
-1
votes
1answer
144 views

Information Security Thesis idea [closed]

I need advice. Currently I'm doing my Masters in Information Assurance, and I only have my Thesis left to graduate. I chose a topic for my thesis but for some reason I don't feel confident that it's ...
2
votes
2answers
1k views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
1
vote
1answer
106 views

cryptographic session token vs stored random session token [duplicate]

I am building a web API and I have a hard time choosing between cryptographic session token and stored random session token for user authentication. I see several pros & cons for each: stored ...
1
vote
3answers
2k views

Determining the accuracy of a biometric system

How is the accuracy of a biometric security system (its ability to minimize false acceptance rate and false rejection rate) determined?
13
votes
3answers
1k views

BCrypt's 72-character limit and using it as a general digest algorithm

Goal: have token/cookie-based authentication that doesn't require keeping sessions on the server TL;DR: What, if any, is the accepted mechanism to work around the 72-character limitation of BCrypt? ...
8
votes
3answers
972 views

Two factor authentication with my bank

My bank requires a security dongle. Place the debit card in the card reader and enter a pin code. An 11 digit code appears which is entered on the bank's website and access is granted. But if I ...
3
votes
1answer
297 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
1
vote
2answers
891 views

Risks of having SSH private key stolen

I'm afraid this is quite a common question, but searching several times through the questions did not prove useful, and I'm really eager of knowledge here :D I understand that keeping SSH private key ...
11
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
0
votes
0answers
59 views

Is authentication/authorisation necessary between a web server and an isolated application server?

If I have a system that consists of an application server which responds to requests made only from the web server. a web server that responds to client requests over the internet. Is it necessary ...
34
votes
5answers
14k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
7
votes
3answers
36k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
2
votes
3answers
471 views

Strategy for updating stored passwords to more secure hash? [duplicate]

I know that we cannot update our hashed passwords without having the plain text password to re-hash. When a member logs in with login/password, we have the plain text, so that gives us an opportunity ...
5
votes
1answer
527 views

How can a system verify an online password using a phone keypad?

I phoned into a financial company's website, and it prompted me to key in my password on the phone keypad, converting the alphabetic characters to the corresponding digit, and special symbols to '*'. ...
1
vote
2answers
144 views

Difference between KMS and PKI

While the PKI System deal with digital certificates life cycle and Key Management System (KMS) deal with keys life cycle. What is the the fundamental difference between them? Is it possible to ...
2
votes
4answers
117 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
16
votes
4answers
358 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...