Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
0answers
12 views

Does OAUth 2 allow authentication without UI (to an account with hard coded credentials)?

Note: this question is not about authenticating to an account after receiving a valid access token. This is about the first leg in the authentication process that would obtain the valid access token. ...
5
votes
0answers
40 views

Limiting Concurrent Login For System Admins On Windows Domain

Quick background: we are a smaller sized team meaning that we perform multi-function roles. Thus a developer is typically a DBA as well and some developers do have domain admin access. As a rule our ...
1
vote
0answers
44 views

Failure analysis to avoid locking permanently online accounts [on hold]

(I reposted here a question I previously asked in SuperUser, I think this section is more appropriate) Back in the days defining a path leading to loss of data or loss of online accounts was easy: ...
2
votes
0answers
23 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
-1
votes
0answers
16 views

is there a signature scheme for cramer-shoup cryptosystem? [migrated]

I have a project that I have to use cryptosystem and signature scheme for it, so I've read about cramer-shoup cryptosystem and I want to use it since it is more secure the elgamal cryptosystem, but, I ...
353
votes
21answers
67k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
2
votes
1answer
49 views

Two factor authentication: SMS/TOTP, but what if you only use your phone

I found a code by SMS or TOTP on a phone as a second factor of authentication to be a good solution for when you're using your computer to login to a website. Most people have a phone which can either ...
1
vote
1answer
77 views

How do banks determine when to ask for two factor authentication?

I was playing around with trying to figure out how my bank knows when to give me a two factor authentication prompt. I had originally thought it was based on my cookies and maybe my IP address. But ...
3
votes
2answers
258 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires authentication and authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
4
votes
1answer
202 views

Security of Yahoo's new authentication: On-demand password

Yahoo is trying to remove passwords from authentication and use on-demand password authentication system instead. I wonder how this new system will be secure? Even if somebody steal your mobile can ...
1
vote
1answer
37 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
5
votes
1answer
158 views

Securing REST API via Hawk

I'm currently using Hawk as the auth scheme for an API. Basically, the current flow (forced SSL) involves: User types in email/passwd on app App performs 1000 rounds of PBKDF2 using the email as ...
1
vote
0answers
25 views

Is it possible to secure an Android Intent from other calls from apps?

I'm looking at the architecture of Android and want to come up with a service that allows for multiple applications (3rd party) to call a local android service and fetch data. Think of this as a ...
1
vote
2answers
101 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
3
votes
1answer
210 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
2
votes
1answer
43 views

Using RSA for Web Application Authentication

I have a network that is only accessible through bastion servers over ssh. In it, I am developing web applications that are exposed to end users via GUI's served up over websockets. All traffic into ...
60
votes
7answers
17k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
-5
votes
0answers
26 views

How do redhat that the user can log in to x-resrver only once? [on hold]

How do redhat that user can log in to x-resrver only once, if user log in in x-server alt+F7, he not log in in x-server alt+f8? thanks
1
vote
2answers
76 views

Token-based authentication - what's a good token length?

What's a good token character length for a token-based login? Currently I'm using the following code: <?php $token = bin2hex(openssl_random_pseudo_bytes(16)); Is 16 sufficient or should ...
-2
votes
0answers
56 views

Why Social Security Numbers are still used for human authentication in USA? [closed]

Imagine that your bank requires that your login to consist of 9 digits and that your password must coincide with the last 4 digits of your login. Moreover, you must disclose your full 9-digit login to ...
3
votes
2answers
92 views

Comparing the 2FA Vendors

If we need to choose a vendor for the 2FA in our environment, what are the features that we should look for? Our selection process depends on the functionality and usability they provide. But when I ...
3
votes
2answers
52 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
3
votes
1answer
75 views

What's the weakness of keyed-MD5 for message authentication?

I've seen public web API's using keyed-MD5 to generate message authentication code rather than adopting the HMAC algorithm. People wouldn't just invent HMAC for fun, so it must have some advantages ...
1
vote
2answers
161 views

Why do I have to use multiple keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
22
votes
9answers
3k views

Is it helpful to have a captcha on a login screen?

I introduced recaptcha to the login screen of a system. My goal was all about security things like dictionary/bots attacks or other thing of that type. The users now hate it, Some did not even ...
2
votes
1answer
174 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
0
votes
2answers
99 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
3
votes
2answers
79 views

Email for the second factor in 2FA systems

the scenario is in a corporate environment and not connected to internet. The other day I was arguing with my colleague on whether email is good enough to be the second factor in a 2FA system. My ...
18
votes
4answers
4k views

Should I implement incorrect password delay in a website or a webservice?

With arguments expressed in this answer, there is a few seconds delay between user enters an incorrect password and when he/she actually learns, that password was incorrect. This security solution is ...
3
votes
1answer
131 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
0
votes
2answers
169 views

Are the Microsoft Windows images found on the internet safe?

Microsoft has stopped offering the Windows images for download. It is now only possible to get the image if one has a key of a retail version of the corresponding OS. The question is now, whether the ...
22
votes
2answers
20k views

Why does HTTP Basic authentication encode the username and password with base64?

RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64. To receive authorization, the client sends the userid and password, separated by a ...
-1
votes
1answer
74 views

SQL and Command injection Handling [closed]

My PHP code is: $password = md5(md5($pass); if (is_array($data_array)) { $key = array_keys($data_array); for ($i = 0; $i < count($key); $i++) ...
0
votes
3answers
185 views

What is the most secure way to save user authentication: Cookies or Session Variable?

I'm developing a web application that is basically for all our employees. Right now we have 3500 employees and all of them will access this web application. All of them will use really confidential ...
10
votes
4answers
2k views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
7
votes
1answer
153 views

Using RSA-SHA as/instead HMAC in OpenVPN?

While reading the manual of OpenVPN 2.3, I came across the --auth alg option. The manual says: Authenticate packets with HMAC using message digest algorithm alg. (The default is SHA1 ). HMAC is a ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
1
vote
1answer
34 views

How to migrate users? (Changing the login system)

Let's say that you are about to change your log in system and you have a few millions of users that you want to switch to the new system. Specification Old System Username : email address Password ...
3
votes
5answers
107 views

Any security risks for the login authentication and change password on the same page?

I want to ask if there are any security risks for the login authentication and change password on the same page? Normally the user needs to authenticate first in order to see the password change ...
1
vote
1answer
123 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
1
vote
1answer
60 views

Prevent brute force attacks on web publishing logins

Presumably, if someone tries to brute force into your website's control panel at your web host's site - they will be throttled/locked-out etc. But what about the web publishing logins (Web-Deploy, ...
2
votes
2answers
57 views

Justifying strong 1st factor in the context of multi factor authentication — beyond passwords

I am wondering if you need strong 1st factor (for theoretical correctness, please note it is the knowledge factor -- not necessarily a password, but definitely also includes strong passwords)? What ...
1
vote
3answers
220 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
4
votes
2answers
446 views

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
6
votes
1answer
74 views

What real life scenarios require separate end user certificates for Signing and Identity?

Based on this question, I'm interested in any rational argument that would support the idea of maintaining separate signing and authentication certificates. Conventional logic & wisdom says there ...
3
votes
2answers
351 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
1answer
54 views

Time tracking proof of identity

Does anyone know any other way to determine who is logging into a system, tracking if worker is on the clock and physically there working? Time tracking is awful in the hourly service world, because a ...
1
vote
1answer
36 views

Are there any simpler ABAC implementations available for big data systems? [closed]

Can any one suggest simpler Attribute Based Access Control implementations available for big data systems like Hadoop, Hive etc? I have checked Apache ranger they dont have any support for ABAC yet ...
11
votes
1answer
560 views

Is Postgres's uuid_generate_v4 securely random?

I'm using Postgres's uuid_generate_v4 in a uuid primary key column to generate secure one-time authentication tokens. Is this okay? Does Postgres use a secure random number source for generating these ...
1
vote
0answers
34 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : ...