Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
306 views

How to brute force HTTP Basic Authentication requested with XHR?

How can one brute force a website using HTTP Basic authentication using metasploit which uses XHR in background? I am getting error "No URI found that asks for HTTP authentication". Relevant headers ...
2
votes
2answers
291 views

Will Wordpress nonces protect against Login CSRF?

Can Wordpress Nonces be used to protect against Login CSRF? https://codex.wordpress.org/WordPress_Nonces I glanced through the code for the function and it seems to only be using the User ID for ...
0
votes
3answers
115 views

Access Key In URL - Securing The Unsecured!

I'm having some difficulties doing this the right way (as much as it can go). Some time ago, I've asked a question here, asking for help on how to implement sending an access link through email. ...
3
votes
1answer
107 views

Is a security question you just have to 'remember' a good idea?

I was setting my eBay security questions and one of the choices were: Now I've seen sites that allow you to "type your own question" and "type your own answer" but unless they forgot a text field, ...
-3
votes
2answers
91 views

Defense in depth

How is defense in depth strategy different from network security policy? What is the need to name it a "Defense In Depth", although you may simply name it "Network security policy"? Secondly if DID ...
5
votes
1answer
66 views

How do I verify that in-app social login dialogs are secure?

If I have a mobile app that supports some kind of social login feature, say, to login to the app from my Facebook account, and if the app opens the Facebook login page inside the app in a mobile, is ...
2
votes
2answers
95 views

What does it mean to have authentication without confidentiality or authentication without encryption?

I came across these functions m+EeA(H(m)) (for authentication without confidentiality) and m+H(m+k) (for authentication without encryption) and I'm having a bit of a difficult time understanding them. ...
1
vote
1answer
146 views

Saving encrypted username password in session

I have Node.js server which serves an app. In that app you could be asked to login. The login credentials would be authenticated against LDAP. That server could request/post data from other servers ...
8
votes
2answers
3k views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
24
votes
5answers
3k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
1
vote
3answers
2k views

How does DCOM authentication compare to RPC based authentication/auth?

The following paragraph from MSFT Best Practices for 2003 PKI says Windows 2000 authenticated via RPC vs 2003 that authenticates using DCOM A CA running Windows Server 2003, Enterprise Edition, ...
28
votes
7answers
13k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This ...
0
votes
1answer
127 views

Mail server security: Mails to internal receivers with faked sender address

I noticed that I am able to send emails from my company's mail server to internal receivers from faked inhouse sender addresses without problem and I'm wondering if this should be supposed a security ...
0
votes
0answers
36 views

Windows Integrated Authentication with OAuth2 - do I need SSP/APs for LSA?

I Need to develop an integrated authentication mechanism that trusts our OAuth2 STS. Yet implemented is a credential provider that collects the user credentials and asks our STS for authentification. ...
2
votes
2answers
473 views

What are my options for securely printing an OTP Scratchcard?

I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets) To me ...
0
votes
2answers
190 views

Default user names to avoid

Following this answer on a question about fake users, is there a general list of users which would be deemed to be a common username? The part of the linked answer I'm referring to is Don't use a ...
56
votes
7answers
10k views

Are passwordless SSH logins more secure?

I had a long discussion with my co-workers whether key-based SSH authentication (particularly for OpenSSH) is more secure than authentication using passwords. My co-workers always connect to servers ...
0
votes
3answers
114 views

How secure is this token url for subcontractors with no accounts?

Imagine you are a cab company that subcontracts independent drivers to drive within certain cities and towns. You send the subcontractor a link to a page that has fields for the subcontractor to ...
4
votes
1answer
67 views

Is it dangerous to publicly share a scopeless token?

If a service allows you to create OAuth tokens without any scopes (allowing 5k API requests / hour for public resources), is it dangerous to share these tokens publicly? The obvious problem I see is ...
1
vote
2answers
98 views

Does two factor authentication increase the attack surface?

Would adding two factor authentication to an application increase the attack surface of this application? I think it would, since by adding complexity the likelihood of a vulnerability in my ...
0
votes
0answers
39 views

Meeting HIPAA standards in a server-to-domain-client application?

Similar, inconclusive question by someone else found here: HIPAA requirements for local server The requirements are that the application runs on a Windows server and can be expected to connect to up ...
61
votes
8answers
14k views

Should I change the default SSH port on linux servers?

Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? ...
3
votes
2answers
201 views

How do online polls ensure only one vote per person?

For instance, TIME's Person of the Year poll. I can see that CAPTCHAs would prevent the worst abuses, but if the server just gets a bunch of POST requests, how does it decide that this one came from ...
5
votes
3answers
329 views

How bad is exposing valid user names?

Today like many other times in the past, signed for a new service and got a common error message: Your user name or password is invalid This time I am wondering how useful it is to notify "...
0
votes
0answers
17 views

Using Digital Signatures in isolated networks

Is it possible to use Digital signatures in isolated environments which do not have access to internet and work only on internal network. How does the certificate authentication happen in such case
0
votes
1answer
185 views

HTTP Basic Authentication - password missing

I am trying to retrieve a username and password send over the network. I was able to capture the following using Wireshark: GET /rcp_tunnel HTTP/1.0 Host: ***.***.***.*** Authorization: Basic dXNlcjo=...
15
votes
2answers
5k views

Secure communication between applications using SSL Certificates

I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the "server"...
6
votes
2answers
106 views

HMAC with or without data encryption?

I'm in the process of developing a system that periodically transmits a small amount of data (16/18 bytes), where the only part that will change is a 4 byte counter that will increment for each ...
2
votes
2answers
3k views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
2
votes
3answers
225 views

Is it ok to send plain-text password over HTTPS? [duplicate]

I understand why the password should be salted and hashed before being saved into the database, but my question is if it needs to be hashed on the browser side or just sending plain-text password over ...
1
vote
0answers
40 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication (2-...
1
vote
1answer
135 views

Could EA know my password across multiple sites?

A few days ago I received an email from EA stating they reset my password because it may be compromised: The password for your Origin account was recently reset because a standard systems analysis ...
2
votes
1answer
122 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
2
votes
2answers
239 views

How does t-mobile's secureauthentication Twitter app work?

If you try to get support from T-Mobile using Twitter, they'll try to get you to allow an app that only has permission to view your tweets and your followers. How does this help T-Mobile authenticate ...
3
votes
3answers
145 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
0
votes
1answer
44 views

2 step authentication hybrid

I'm all forward on 2 step authentication. I understand how it is way more secure than a simple password. However I'm always afraid to start using it because I believe that in some cases I could be "...
4
votes
2answers
240 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
1
vote
1answer
65 views

Risks of letting user know if the username is invalid? [duplicate]

I notice most websites simply say "user name or password is not correct", however some will tell you if the user name does not exist. Are there any security risks letting the user know if they ...
2
votes
2answers
498 views

Is it safe to use Google Authenticator app and SMS instead of passwords

I currently want to start web development where I will be making a login system and want an alternative to storing passwords. The question is: is it safe to use the Google Authenticator app as the ...
13
votes
6answers
15k views

Difference between authentication and identification [Crypto and Security perspective]

I am always confused by the way the word authentication is used in security literature (i.e., outside the crypto realm). Most of the time I understand that they are actually implying identification. ...
34
votes
3answers
3k views

Overarching term for 'authentication' and 'authorization'?

The internet is rife with 'authentication vs. authorization'-type questions. I'm not asking that here. I'm wondering if there is some overarching term that encompasses both of these. I've seen ...
0
votes
0answers
25 views

What is more secure for Authentication: PostMessage or Redirect

Apple iCloud has the option to either PostMessage or Redirect upon authentication. Which is more secure, and why?
1
vote
0answers
113 views

Passive authentication

I am a relatively new developer to advanced information security related features, hence please pardon me for any mistakes. I came across the concepts of passive authentication and active ...
0
votes
2answers
135 views

Disclosing too much info over email just to close account?

I have account with a stock option trading platform. They are well known and reputable. I had a couple thousand in the account, bought and sold for a while, and then cashed out and withdrew. So I'm ...
23
votes
4answers
5k views

Why did Richard Stallman recommend not to use passwords for wireless networks? [closed]

In a short interview, Richard Stallman recommends not to put passwords on your wireless network. In the OS Revolution documentary he also mentions how he's disliked passwords ever since his job at MIT ...
1
vote
0answers
115 views

Steam two-factor authentication algorithm? [closed]

I'm all on-board that Value is recently pushing for two-factor authentication on Steam accounts. I'm not happy that they force you to use the Steam mobile app because both on iOS and Android, it's a ...
11
votes
3answers
847 views

Steam and two-factor authentication

The Steam platform is designed to encourage users to use two-factor authentication. One of the community tasks (achievement-like objectives) on Steam is "Use the Steam Mobile App for two-factor ...
12
votes
2answers
3k views

Benefits and drawbacks of giving an Administrator two accounts for elevated rights and another for daily use, such as email

Microsoft has long promoted the need to separate administrative accounts from regular use accounts, as shown with this guidance MSFT even went to far as create ADMINSDUser rights to put ...
13
votes
2answers
3k views

Is this a secure data exchange scheme for a game?

I am writing a multiplayer game. I have a central server which processes everything. For data exchange I use HTTPS protocol. Because this is a game I cannot use computationally expensive systems like ...
4
votes
1answer
77 views

What types of trade-offs are appropriate when using encryption/authentication on devices with low bandwidth?

This is my first foray into this Stack Exchange, and I have limited knowledge of the InfoSec world, but I'll try to make this a pointed, answerable question. I'm tasked with investigating including ...