Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
2answers
46 views

Effective Free and Anonymous Web Form Encryption

I've got a website and I would like the users to be able to login securely but I don't want to spend any money on SSL / certificates and I would like to stay anonymous i.e. not give the certificates ...
0
votes
1answer
32 views

SSH and shared secrets

There was a question on a quiz I took, about different authentication methods that SSH uses. The answers were combintions of the following four: username/password public key authentication shared ...
0
votes
2answers
33 views

Access token vs. UserID + access token

My goal is to associate (authenticate) hardware devices to users in the database. The access token is generated via webinterface. It is then entered into the hardware device by the user, and the ...
1
vote
2answers
87 views

Is it possible to restrict email accounts within one computer?

can emails(e.g gmail)can be configured to open-up only in my laptop ,my operating system is windows 8 and is it possible to restrict my gmail account to be opened up only in my computer?Usually we ...
2
votes
1answer
17 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
20
votes
1answer
681 views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
0
votes
1answer
81 views

HMAC based algorithm for publicly sharing authenticated messages

I am trying to design an algorithm for publicly sharing authenticated messages. Obviously, asymmetric public/private key schemes do this, but I want to avoid the requirement that users have to keep ...
0
votes
0answers
12 views

How does WebID fit in the SAML picture?

How does WebID fit in the SAML picture? Are they related or completely unrelated? Can they work together? If yes, what are the benefits?
0
votes
2answers
64 views

Legality of cookie(set by other sites) tracking

I have created a website A which asks username & password, there exists another closed source website B which again asks for login credentials. A user uses both these websites .I want to ...
0
votes
2answers
83 views

Open email accounts on public computers

When I use a public computer at a certain location, logging into the workstation and going to a site like gmail.com (to check my email) I find that another user is already logged in. Same happens for ...
-2
votes
1answer
70 views

HTTP status code for successful login [on hold]

I have a web application for testing. It has a login page. For unsuccessful login attempts, the developers have made a custom error page so that the response from the web application shows 200 OK, ...
0
votes
0answers
22 views

How to evaluate authentication for a WAP portal?

I am trying to evaluate a security authentication for a WAP portal. The authentication works by asking the customer for his unique MSISDN and then a secret pin code is sms to client. In this is a ...
3
votes
1answer
951 views

How is NFC tags copy prevented?

Ten years ago, we opened our building's front door with a badge. Five years ago we paid public transports with an RFID card. Today we pay our bread with the same system and tomorrow we would probably ...
1
vote
1answer
188 views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
21
votes
4answers
3k views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
1
vote
1answer
38 views

Using cookies for cross domain authentication

I have an web app 1 which would do the authentication of the user. After that I want to forward the request to another web app 2. Now web app 1 will generate some hashcode which I can authenticate in ...
3
votes
1answer
502 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
3
votes
1answer
90 views

How is a Tor hidden service authenticated based only on trusting the address?

While being fascinated by how it is possible to create hidden services with Tor, there's a few details around the address collision issue I can't seem to wrap my head around. Quote from Hidden ...
0
votes
0answers
19 views

implementation help :: 2 locations, different authentication, mixed environments [closed]

We are a PHP Shop but trying to add C# into the mix as well as adding an external team that's outside of the network. Problem: Internally we use Active Directory for users but not applications since ...
1
vote
1answer
70 views

Authenticated Diffie Hellman Key Exchange

It appears that the textbook version of Diffie-Hellman is susceptible to man in the middle attack and the use of digital signatures could prevent this attack from occurring. Digital signatures could ...
5
votes
2answers
142 views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
4
votes
4answers
349 views

Should both user ID and Password be masked for online banking?

Is there a best practice for security purposes requiring masking of both User ID and Password for online banking? Is there any rationale for or against masking both?
0
votes
1answer
46 views

What's the typical approach to caching invalid authentication attempts?

Clients (actually software pieces developed by some random dudes all over the Internet) are authenticating on a web server using "basic" authentication scheme and to do so they are passing the ...
2
votes
1answer
193 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
1answer
36 views

BTLE pairing: Where does the code come from?

When trying to pair 2 bluetooth LE devices (e.g. 2 iPhones), a popup shows up that requires to input a code displayed on the other device. I am aware of the concept of out-of-band authentication, and ...
1
vote
1answer
190 views

What is a AUTH-KEY in the security of the computers?

I don't know if this is the right section to post my question and if it is not I apologize. I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL ...
1
vote
2answers
62 views

is IPSEC Authentication between local domain hosts a part of normal behaviour in a Windows network?

I am seeing lot of IPSEC Authentication messages in eventlogs of Windows domain hosts. I was wondering if this - setting up IPSEC connections between domain workstations is a part of normal Windows ...
0
votes
1answer
111 views

How does the Dell Sonic wall Authentication works?

My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged ...
6
votes
4answers
1k views

How to prove Bob has received Alice message

I have read up on Digital signature and it is stated that it provides non-repudation. Assuming Alice signs the message using her private key and sends it to Bob, Bob can use Alice's public key to ...
0
votes
1answer
60 views

Does encrypting the message protect it against length extension attacks

Assuming the following HMAC is used : HMACK(M) = Hash(K||M) = H which is "secret-prefix" hashed function. M is the plaintext message , K is the secret key used The ciphertext is generated as follow : ...
8
votes
3answers
293 views

Security of pronounceable passwords

Some random password generators support the generation of pronounceable words of any given length n. Assuming that words are derived using 26 lowercase letters, the number of possible words of length ...
1
vote
0answers
35 views

Best way to authenticate for Funding balance with API call [closed]

I have an API call where a user adds to their balance when funds are low. The actual payment is done via Braintree, but I need to allow the user to make that call via their API. What would be a good ...
5
votes
2answers
180 views

SSH key auth, but still need password for sudo?

SSH with public-private key authentication comes enabled by default with most Linux distributions. This is great because when I create accounts for remote users I don't have to email them sensitive ...
4
votes
1answer
143 views

Logging out of Basic HTTP Authentication

As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP ...
5
votes
2answers
84 views

Using Client-side certificates for Authentication

Why aren't client-side certificates used for Authentication? Then user has to remember only 1 password to unlock his windows account which stores the certificates. I understand that if user access ...
1
vote
0answers
11 views

Pros and cons between HOTP and TOTP [migrated]

I'm reading the RFC6238 (TOTP) and RFC4226 (HOTP) standards and can't get which one is to prefer? I've searched around a bit and it seems like TOTP is the one that is most used, but some argue that ...
0
votes
2answers
46 views

Ubuntu backup to only specific devices

I am looking into setting up a secure Ubuntu server with daily backups to two different external hard drives that will be swapped with the external hard drive that is stored in a safe deposit box. ...
2
votes
1answer
294 views

Facebook iOS SDK Authentication

The Facebook iOS SDK only needs your bundle & app IDs of your iOS app to match those of your Facebook app. If I find out an app's app ID, can't I just create another iOS app with that app's ...
54
votes
6answers
6k views

Four-factor authentication

I'm sure you've all heard of two-factor/multi-factor authentication. Basically it comes down to these factors: Knowledge - something you know (e.g. password, PIN, pattern) Possession - something you ...
54
votes
13answers
8k views

Do we really need a long and complicated password for websites?

Most of websites that handle important information (Gmail, for instance) have some kind of brute force protection. Sometimes if you try more than X times it will lock the account or at least give you ...
5
votes
1answer
158 views

Why should I persist OAuth 2 access tokens along with refresh token

That's something I've came across in a couple articles about OAuth 2: when it comes to persisting refresh tokens to database some authors prefer to store access token as well, or at least mention it ...
1
vote
3answers
504 views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
2
votes
1answer
57 views

L2TP/IPSec: Mutual authentication BEFORE user can access VPN

I came across a question You are the network administrator for your company. You have deployed Windows Server 2008 on all server computers in your company. You have deployed the Network ...
27
votes
5answers
4k views

Could mint.com be more secure, and if so, how?

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit. The site has a bunch of links explaining how they're so secure. I ...
3
votes
0answers
58 views

Zero Knowledge Example using discrete log [migrated]

I've been exploring Zero Knowledge Proofs and while the classic cave example by Jean-Jacques Quisquater makes sense, I find the discrete log example problematic. Since the Verifier is given p, g and ...
5
votes
2answers
139 views

What are the weaknesses of my authentication scheme?

So, recently, after going through some infosec training (FutureLearn's Introduction to Cyber Security, which I heavily recommend as well-explained newbie material), I decided to take the plunge and ...
0
votes
2answers
136 views

Steps to create user authentication system between mobile and server

First time doing a secure login from a mobile app to a server (built in java). I want to understand if I got this right. Login in for the first time: 1. On the mobile device hardcode a security ...
3
votes
2answers
98 views

Are AWS security groups sufficient to authenticate communication between instances? (HIPAA)

Say I have a private service that exposes sensitive information (PHI) via a REST API, and that I want to permit access to it from only one other service. Is it enough to partition these services ...
11
votes
2answers
1k views

What are the dangers of allowing “less secure apps” to access my Google account?

According to https://support.google.com/accounts/answer/6010255: Google may block sign in attempts from some apps or devices that do not use modern security standards. Since these apps and devices ...
0
votes
1answer
81 views

How to test ldap that authenticates with kerberos

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ...