Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
33 views

How do “Confidence images” on my bank's login page improve security?

My bank recently change their login process to show a preselected image which they label a "Confidence image" - ostensibly to allow a human website user to authenticate the bank's website as not being ...
3
votes
3answers
65 views

Does revealing two factor codes reduce security?

If I were to publicly display the 6 digit code from my google authenticator, would my account security be diminished beyond it's valid life time? What if it were the code and the time it was ...
0
votes
1answer
133 views

What do think about this multi-factor authentication system made by me? How can I improve it?

I designed an authentication system as a project for a cyber security class. I want you to critique it please. Here is a quick explanation: Note: Sorry no images but I'll provide links to videos for ...
7
votes
1answer
130 views

How the AWS signature works in depth

I'm trying to understand how the AWS signature 4 works. I read the docs and I found a Python example where a signature is computed. I also ran into this answer which explains HMAC a bit. I'm curious ...
4
votes
4answers
154 views

Is there a way to prove some content came from a specific website?

I guess we can all agree that a screenshot of a website proves nothing; one can edit the HTML as much as one likes, take a screenshot and show a website displaying false information. As far as I know,...
16
votes
3answers
6k views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
2
votes
0answers
30 views

OAuth - initial log in to get API key

I've been reasearching how major web systems implement OAuth in their RESTful API. Here is how Paypal describes theirs: Basically the question comes down to the "note" part of the picture. Say ...
0
votes
1answer
38 views

Authentication in WPA from a user's perspective

I have read several articles that discuss the differences between WEP and WPA but I haven't seen an answer to my question, which is : How is the authentication used in WPA different from that used ...
0
votes
0answers
25 views

DMZ with Reverse Proxy for both Web and Email servers

I have both a web server and email server, instead of placing these two "public" servers in the DMZ, instead In the DMZ I was going to place a Reverse Proxy. for the Web Server: Firewall accepts port ...
7
votes
2answers
4k views

Kerberos vs. LDAP for authentication — which one is more secure

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? And Can we switch between them transparently?
436
votes
23answers
94k views

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
0
votes
0answers
31 views

iframe basic auth or token security

We have two sites, both are trusted. On site1 we store the username and password for the user for site2. We make api calls on site1's backend to site2 via basic auth (all over HTTPS). I know this ...
0
votes
0answers
16 views

IP authetication, usage stats and bad house-keeping [on hold]

If a content publisher using IP authentication stores overlapping or duplicated IP ranges in its access management systems are accesses, clicks, etc. counted multiple times?
1
vote
2answers
3k views

How to call webservice securely in Android

Hello I am working on an Android application in which I'm required to execute a few https web service calls. All my web-service URLs and Web API KEYs are in the code plus the IP address of the server. ...
0
votes
0answers
44 views

Login time duration [on hold]

I'm working on a project for improvement of hacking detection. One of my ideas is based on "login time duration" of the user spent while login on an online-banking website vs "copy/paste" fast ...
1
vote
0answers
21 views

Account Connected Devices ignoring Credential changes

Hello People of Security, one of my accounts got attacked, so they(Provider) did expire my password. I'm currently not able to log into my account. So when I started an older PC of mine, I was still ...
0
votes
1answer
128 views

Sharing access-tokens in response header?

What's the best way to share my access tokens, I mean, is it okay to share it in the header as plain-text? - Or do I need to look into e.g.: JWT? Current workflow: -> POST /api/login -d {**creds} ...
0
votes
1answer
90 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue We have a domain joined tablet that runs a Windows Store Application, we already have user identity and we need to call ...
0
votes
1answer
69 views

How to secure Web directories allowing only me to acess them

I have a web folder with some PHP files that are hosted in my website(e.g. www.mysite.com/myfiles/my_file.php) that I access and trade information using ajax for a Web App that I have. My question is,...
2
votes
1answer
77 views

Is installation id secure enough to authenticate device's user against a Web Service API?

...or interactively asking for password / or having some certificate is inevitable? Context My Android app wants to do secure transactions via my Web Service API. However I do not want to bother my ...
-6
votes
4answers
145 views

Keeping passphrase away from telepathic interception [on hold]

Assuming that someone is able to telepathically intercept thoughts and words in my mind, what mechanism will allow me to authenticate securely? A solution that does not yield to physical search or ...
1
vote
1answer
125 views

Is it secure to refesh a JSON Web Token (JWT) auth token using the user credentials?

As I understand the answers to this question JWT: Is refresh an expired token is a good strategy?, one should use a refresh token to refresh an expiring auth token. Since my web app should be ...
0
votes
1answer
17 views

Can 802.1X, EAP and RADIUS work together?

So this is an academic question I came up with while researching the topic. Can 802.1X, EAP and RADIUS work together to provide a secure authentication? If yes, how? Thanks!
12
votes
3answers
2k views

Would a (password + combination of images) be stronger for user's login regarding keyloggers?

The scenario: We have a login system for a web application that requires a plaintext password and 3 images (from a collection of images that the users select during registration, the images are ...
4
votes
2answers
142 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
0
votes
1answer
33 views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
0
votes
1answer
36 views

Windows Firewall: Restricted RDP to 1 IP, but still see login attempts from other IPs

I restricted the Firewall rules for RDP incoming restricting the Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. I did not ...
3
votes
4answers
2k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or “...
1
vote
1answer
47 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
0
votes
1answer
225 views

Is the following PayPal Vulnerability a design/implementation flaw?

I am trying to understand the logic behind following vulnerability, I believe this a design flaw not only an implementation. To me the problem with the two-factor authentication service at PayPal is ...
2
votes
1answer
274 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
0
votes
2answers
43 views

session credentials on the client

I am developing an IE11 based application running on a web server inside our corporate network The application makes calls to a 3rd party API which requires client certificates and username/password ...
2
votes
1answer
43 views

How to check whether NTLM v2 or v1 is used for authentication?

Which tool should I use to check which NTLM authentication is used? Consider the fact that I am a user of the web application and not the owner. Are there any security concerns if a site uses NTLM ...
0
votes
1answer
56 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
28
votes
5answers
5k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
1
vote
1answer
24 views

Instant signin links for users from trusted third party sites

I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
0
votes
0answers
12 views

How to enumerate smartcard logon attempts in Windows?

I need to provide my users with feedback when they log on at their workstations. This feedback needs to include: Date/time and workstation id of last successful login Number of unsuccessful login ...
2
votes
1answer
1k views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
84
votes
9answers
15k views

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
1
vote
2answers
77 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
0
votes
1answer
56 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
8
votes
2answers
190 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
1
vote
1answer
66 views

Is Auth0 Passwordless Authentication secure?

I see this advertised Medium post about building a React application with passwordless authentication through Auth0. from the link, here is the explanation of how it works: Passwordless ...
12
votes
5answers
2k views

What is the best way to transmit password hash over unreliable TLS?

I have TLS connection between my server and client. I have no certificate, so the connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept the password hash ...
51
votes
4answers
25k views

What is the use of a client nonce?

After reading Part I of Ross Anderson's book, Security Engineering, and clarifying some topics on Wikipedia, I came across the idea of Client Nonce (cnonce). Ross never mentions it in his book and I'm ...
52
votes
3answers
27k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
2
votes
2answers
112 views

My Yahoo accounts keep making random accounts for me on other websites. Why?

I have two Yahoo email accounts. Both will randomly recieve new emails about a new account that was made under my name and my email address, however, I'm not setting up these accounts. I have had ...
0
votes
1answer
50 views

Numerous login attempts detected from an internal machine to the active directory domain controller

We have recently identified numerous login attempts from an internal machine to the active directory domain controller. The attempts are directed at the domain administrator account. As an initial ...
13
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
0
votes
2answers
84 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...