Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
5
votes
2answers
156 views
Authenticating client without hardcoding key?
A basic question, but I'm not a master and this is puzzling me-
How is it possible to authenticate a client from the server's perspective?
i.e. imagine you're the server, and you want to give the ...
1
vote
3answers
278 views
Login System Security Suggestions
I am creating a login system and was wondering if anybody had any suggestions. Here is my current setup:
nonce to check if the login originated from our login form
session and cookie auth mixed - in ...
2
votes
2answers
88 views
Are there any nice info sites dedicated to explaining how and why to (not) store user passwords in the database?
I keep finding various websites that are able to email me back my password. I try to email them every time, telling them about this. But it can be tricky to be taken seriously - it's just a random ...
0
votes
0answers
47 views
Security resources [closed]
I was interested in some resources (examples, analogies, real world examples) that, from your experience, were useful in explaining (understandable and convincing) basic security concepts.
Like ...
3
votes
1answer
219 views
Implementation of Blizzard's Mobile Authenticator
How is the Blizzard Mobile Authenticator implemented? Does it happen to use OATH-TOTP or something similar?
1
vote
2answers
91 views
How do i use a guessable ID for authentication
This question doesn't fit well in many categories but hopefully someone's run into it before.
I'm developing a web api that will interact with a physical device. Each new physical device has it's ...
1
vote
1answer
617 views
Google custom Search Engine api key: is it confidential?
Normally, I'd say yes, api keys should be kept secret, and Google's api console even says that. However, I'm just making an ajax get call and all the info is in the clear on my page in order to ...
1
vote
4answers
61 views
When (if ever) should web app force numerical, generated (hence hard to remember) logins?
Some bank sites force me to use system generated numerical login (ie. 8 digit number). Apart from singnificantly decreasing usability and giving impression of security (to some), does it serve any ...
1
vote
2answers
80 views
How are 2 Open IDs linked on StackExchange?
I have an account with Google & Facebook. Login IDs for them both are same (same gmail id).
When logging into StackOverflow using either of Google or Facebook logins would link to same account.
...
1
vote
1answer
199 views
What makes a secure smartcard secure? Is contactless/RFID better?
In short what security features exist that I should look for in a smart card?
What physical features exist, which are important?
It appears smart cards may exhibit different levels of wear and ...
2
votes
2answers
77 views
Using External Certificates on a network that doesn't permit outbound HTTP/S access
Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data
I can guess that issues with signature validation occur ...
5
votes
1answer
15k views
How do I clear cached credentials from my Windows Profile?
Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data.
How can I backup and purge this data?
3
votes
2answers
463 views
failed login attempts analysis
Is there any open source project that logs all the failed login attempts over a period of time and gives me analysis of the same,
the login failure is at windows or unix or mac user authentication ...
2
votes
5answers
544 views
Why does my bank use this verification method?
I hold my business account with Lloyds TSB [UK] and the process for logging in to their online banking service(s) is as follows:
Login page
Enter customer number
Enter password
Put debit card into ...
2
votes
3answers
168 views
How should one manage authentication on custom line of business software
I am writing line of business software for a company, and we want to authenticate users, so we can manage workflow and do some auditing. Basically my employers don't want me to piggyback off of ...
-4
votes
1answer
341 views
Can a Windows 7 password be hidden? [closed]
Is it possible to hide a password in Windows 7? If I get the SAM and SYSTEM files and decrypt them with a program, I am able to find the password, but when I try to enter it, then it doesn't work!
I ...
3
votes
3answers
1k views
How secure are “mobile authenticators” versus traditional key fobs?
Two-factor authentication, password + device, seems to be increasingly mainstream among consumers with products like Activision Blizzard's Battle.NET authenticators. However, I am curious what the ...
0
votes
1answer
633 views
tightvnc authentication failure problem [closed]
When I run a tightvnc client to establish a VNC session I sometimes receive an error message that suggests there are repeated failed VNC login attempts or a brute force attack.
The message dialog ...
1
vote
1answer
187 views
Using Tokens to Keep Users Logged In
I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? ...
-1
votes
1answer
161 views
About important hacks in history [closed]
I would like to know how important hacks happened, because I can figure out how they hacked a website but I can't figure out how did they hacked into NASA International Space Station source code. Or ...
11
votes
5answers
2k views
Could mint.com be more secure, and if so, how?
After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.
The site has a bunch of links explaining how they're so secure. I ...
198
votes
16answers
19k views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
35
votes
5answers
2k views
Do security questions subvert passwords?
Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
9
votes
4answers
780 views
Can .htaccess and .htpasswd really protect me?
I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
3
votes
4answers
239 views
Voting System, is there a hole here?
I had this idea a few years ago and improved it today as I notice a hole or two. I believe I have the system down right but If there was a hole the first time there may be a hole this time. I believe ...
30
votes
7answers
21k views
Where can I find good dictionaries for dictionary attacks?
I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks?
I've found some through Google, but I’m interested in hearing about where you get your ...
1
vote
1answer
165 views
Authentication for a batch script
It seems amazing that there is no industry accepted best practice for this problem yet (or maybe just one I'm not aware of):
What is the most secure way for a batch script, a program needing to ...
3
votes
2answers
414 views
Can we prevent a man-in-the-middle attack with symmetric-key cryptography?
Suppose that Alice signs the message M = "I love security" and then encrypts it with
Bob's public key before sending it to Bob. As well known, Bob can decrypt this to
obtain the signed message and ...
2
votes
2answers
233 views
Why superuser or administrator account should never locked?
Why should administrator or superuser account never locked regardless how many incorrect login attempts are made?
What should be done instead to alert the staff to the attempted instrusion?
18
votes
6answers
799 views
How to secure a WiFi network?
What do I have to do to secure a WiFi network? Is there any best practices?
I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
2
votes
3answers
143 views
Emerging Standards for file transfer and integrity check?
What are the emerging standards for file transfers (including online transactions)? How about for file integrity checks?
13
votes
2answers
1k views
Hiding user account names from unauthenticated RDP sessions
This is for a Windows 7 Ultimate system, which is not a member of a domain.
When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
4
votes
1answer
473 views
Is this admin area secure enough? V2
This is a response to my previous question, Is this admin area secure enough?.
There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here ...
3
votes
3answers
317 views
Is this admin area secure enough?
EDIT: Please view the revised question instead
The admin area has special access to the database (modifying orders, etc).
To help explain, I drew a diagram, so here is my process:
Notes:
I ...
2
votes
1answer
240 views
Cookie based session variables
I have a situation in which I cannot use a server-side session, but must allow users to log in, and for their logged in state to be persistent between queries.
As with anything that involves crypto ...
3
votes
2answers
210 views
RDP - Same login sufficient?
I just authorized remote access to my Windows 7 machine (not using NLA, since I run a mainly Linux network). I diabled Remote Assistance.
My user (JoeBlow) is protected with password 123456 and ...
2
votes
1answer
347 views
Implementing 2-step verification via email for web apps?
I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
1
vote
2answers
129 views
X509 mutual authentication: is there a security flaw?
On the client side, my application accepts the server's certificate in case of the client certificate being signed by this server cert. Is this correct or may it be dangerous? Is it better to ask a ...
0
votes
1answer
106 views
Authentication methods without trusting 3rd parties unless explicitly indicated
The plan is to have a situation in which no third parties have to be trusted unless you explicitly indicate so. For example CA's are only used when the contact explicitly added the CA as a trusted ...
1
vote
1answer
91 views
Viable way to authenticate certificate without a web of trust?
For SSL certificates we have a web-of-trust principle. If we are allowed to make alterations to the certificate format, are there viable ways to automatically or semi-automatically authenticate the ...
4
votes
2answers
2k views
Full disk encryption and multi-factor authentication
All serious full disk encryption schemes I have looked into use a static password for authentication. For example, TrueCrypt supports two-factor authentication with keyfiles, but not for system ...
4
votes
4answers
3k views
Secure use of psexec or better alternative to it
I want to remotely start VMWare virtual machines (I own VMWare Workstation) and to this end I need to execute on host something like "vmrun -T ws H:\VMWare\VM1\VM1.vmx nogui" with user desktop ...
8
votes
4answers
485 views
Is there any reason to show the same message for invalid username as password?
I've seen a security question/requirement that a website login return the same error message for invalid password as for non-existent user. The idea being that this it makes it impossible to discover ...
41
votes
5answers
10k views
Certificate based authentication vs Username and Password authentication
What are the advantages and drawbacks of the certificate based authentication over username and password authentication?
I know some, but I would appreciate a structured and detailed answer.
UPDATE
...
3
votes
4answers
421 views
Do any organizations use Smart Cards other than the military?
The military's Common Access Card (CAC) seems legit. Do other companies/organizations employ their use? If not, why?
UPDATE
What are the pros/cons of smart cards, compared to other methods?
3
votes
2answers
806 views
Is leaving the root user enabled in Mac OS X a security risk?
To those unfamiliar, the Mac OSX has the root account disabled by default. In order to enable the root user you have to go deep into System Preferences and authenticate yourself with an administrator ...
3
votes
2answers
2k views
What is single sign on versus federated login?
What is the difference between Federated Login and Single Sign On authentication methods?
1
vote
2answers
337 views
Appropriate strategy for preventing brute forcing of logins?
I am currently building security into a website. So far, I have the following rules, and am wondering if this seems sufficient.
5 failed login attempts for a particular username will cause that ...
3
votes
2answers
186 views
What algorithms can be used for device pairing?
I am to implement a system where android devices connect to a central server and have to register with different user accounts, so I have decided to create a pairing dance similar to what can be ...
1
vote
1answer
229 views
Hybrid key management doing it wrong?
I'm currently working on a project that needs be as secure as possible key-management. My experience with encryption, decryption and key-management are none whatsoever so i did some research on the ...
