Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
2answers
23 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
3
votes
1answer
149 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
33 views

Mobile authentication with password as param in get request over ssl

I'm building out a new services layer for an existing mobile application. The mobile application authenticates with the existing services layer by providing the user name and password as url params in ...
2
votes
1answer
17 views

Choosing a group of symbols that contains a password

My bank employs a step in its authentication process besides [the card itself and] the regular password, where the user has a secondary password (3 small sequences of letters, such as Hy X Ba) ...
-7
votes
1answer
32 views

How to attack on a web page to gain username and password? [on hold]

In a situation where a web page is not using SSL and someone wants to attack to gain the username and password. How it can be done? Given the situations: Passwords are not stored in plain text. ...
1
vote
0answers
21 views

Shared control scheme

For the shared control concept, each party has part of the key to avoid having 1 person having the entire key. I'm given the following rules, but whenever I try out numbers on the rules I do not get ...
2
votes
1answer
33 views

How to verify installed packages [on hold]

On Linux (Debian x64) I recently installed some software with: apt-get install the_package_name APT told me some packages couldn't be authenticated but I ignored the warning and installed anyway. ...
0
votes
2answers
107 views

Why do I have to use multiple Keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
1
vote
1answer
131 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
2
votes
2answers
201 views

How does a user get authorized wihtout authentication

I have a back-end (API) and a front-end, eg a web server, and I have users and ID-providers. The web server is provided by a third aprty and it may just as well be a mobile app, but whatever the case ...
1
vote
1answer
105 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
1
vote
1answer
223 views

secure use of psexec?

As of March 7, 2014 PsExec now "encrypts all communication between local and remote systems, including the transmission of command information such as the user name and password under which the remote ...
0
votes
2answers
48 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
1
vote
0answers
31 views

If I have the cell #. switch ID and name, can I locate an physical address? [on hold]

Only a PRO can help me! My husband had an affair, said it was over five years ago and I should not be concerned, ever again. Yet, the result was devastating, medically with cancer. I believe people ...
2
votes
1answer
83 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
1
vote
1answer
3k views

SAML and kerberos what to use where [closed]

I came across SAML and kerberos, both are used to establish identity using assertions (tickets) so is there an overlap in their use ? Can somebody highlight their differences and point which ...
-1
votes
0answers
49 views

Should one avoid banks that do not offer two-factor authentication? [on hold]

It seems that most banks do not offer two-factor authentication (in the form of one-time passwords sent via SMS, app, etc) and those that do either have poor interest rates or customer service. ...
9
votes
1answer
488 views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
13
votes
3answers
3k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
-2
votes
0answers
55 views

Copyright Issue? [closed]

Few months ago, I have created a few icons for my app and after copyrighting them, I published them on my website. I clearly stated on my website that it is illegal to use my icons for commercial or ...
2
votes
1answer
86 views

Protecting a statistics endpoint

When we download an application - it asks us whether it's ok to submit statistics, error reports to the vendor. Since this data is sent from the application to server endpoint - I am wondering how ...
11
votes
3answers
10k views

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial ...
0
votes
0answers
3 views

Zywall USG 100 - How connect to modem interface? [migrated]

I have an Zywall USG 100. My modem have this ip: 192.168.1.100 and is connected into WAN1 port on the Zywall. The Zywall have this ip: 192.168.1.1 I used the "quick configuration setup", and all ...
9
votes
4answers
311 views

NFC contactless payment security

This is really bugging me. Up until recently debit cards with an electronic chip were the most popular electronic form of payment available in Poland (I'd wager that in other European countries as ...
3
votes
1answer
2k views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...
1
vote
1answer
58 views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
3
votes
4answers
205 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
2
votes
1answer
28 views

Using Google Authenticator for SSH sessions

So I have an SSH tunnel which I use with dynamic port forwarding to the alternate http port on the client. For initializing this connection, I'd like to implement an additional verification step, ...
1
vote
1answer
79 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
2
votes
1answer
45 views

How to view all SSH authorized_keys for a unix server

How would I view all the authorised SSH clients from a unix server? I know that cat ~/.ssh/authorized_keys shows authorised keys if logged in from root. Can other users set their own authorised keys ...
18
votes
4answers
1k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
3
votes
2answers
301 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
0
votes
1answer
118 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
2
votes
2answers
90 views

Single-use password as the default authentication method?

The crazy password requirements (joke1, joke2) lead me to a situation where there is no way for me to memorize the passwords to the several sites that make those requirements. The result is that ...
2
votes
2answers
112 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
1
vote
0answers
22 views

AD Authentication using LDAP : Can I authenticate outside of DMZ/Domain [migrated]

The method I use to authenticate a user's credentials on active directory is (Simplified): New DirectorySearcher(New DirectoryEntry(path, user, pass, AuthenticationTypes.Secure)).FindOne() On fail, ...
3
votes
1answer
92 views

Client Certificates

After countless hours of reading I have come to the find that mutual authentication via client certificates seemed to be a viable and appropriate solution for the following scenario. I have a ...
2
votes
1answer
32 views

Is this system of authentication secure for a mobile app? What can I do to improve it?

Users authenticate with their phone number, get a pin text, and if it is correct, they get an access token. Store the access token in a DB in a Token model. The client always sends the access token in ...
1
vote
1answer
28 views

Pre-Requisites for Mutual Authentication

For Mutual Authentication, the client must contain the CA certificate of the Server and his own Certificates, and the server must contain the CA certificate of the Client and his own Certificates.In ...
52
votes
7answers
15k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
4
votes
2answers
833 views

Is secure web-app off-line auth possible?

I'm currently thinking about a web-app that can go offline (after being online) and still be able to provide authentication to the user securely. (For example, in a multiuser environment, it's quite ...
0
votes
0answers
7 views

Value of S and r in Fiat-Shamir Protocol [migrated]

In the book Cryptography and Network Security by Forouzan,in chapter 14, Fiat-Shamir protocol, its mentioned that two large prime numbers p and q are chosen and kept secret. However n=p*q is made ...
6
votes
4answers
373 views

Establishing a Reputable Pseudonym with PGP Key

This has become a bit of a thought experiment for me. Suppose someone would like to establish a pseudonym along with a corresponding PGP Key, how could other people verify the correspondence between ...
11
votes
7answers
2k views

Prevent denial of service attacks against slow hashing functions?

I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
0
votes
1answer
184 views

How can I handle user authentication and sessions in my app?

I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. ...
1
vote
0answers
18 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...
0
votes
1answer
107 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
1
vote
2answers
851 views

Could “receive SMS online” site be a scam?

There is a site that allows you to see all SMS received by a certain set of phone numbers (owned by the site). This seems to be meant for services that require two-factor authentication using SMS, ...
4
votes
2answers
258 views

Should email verification be followed by password-based login? Why?

[This is a duplicate, considered off-topic at http://stackoverflow.com/questions/26564992/should-email-verification-be-followed-by-password-based-login-why] A typical account creation process seems ...
3
votes
2answers
430 views

How to use TPM to perform platform authentication?

I am currently looking at TPM (Trusted Platform Module) and wondering how does TPM offer platform authentication. Suppose a legal host is deployed on the cloud. How do I use TPM to assure that the ...