Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
1answer
13 views

Does information security justifies Iphone 6's “error 53”?

An update of IPhone 6 software left several IPhones that were previously repaired by an non-certified phone repairer dead. See e.g. this news. Apple claims that this is due to security: A ...
0
votes
0answers
10 views

Purpose of nonce validation in OpenID Connect implicit flow

The OpenID Connect specification requires implicit flow clients to generate and validate a nonce: String value used to associate a Client session with an ID Token, and to mitigate replay attacks. ...
4
votes
1answer
80 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
4
votes
1answer
1k views

Website Login Security (Secure enough?)

I'm making a bigger site for the first time so security really matters, unlike for my really-bad boards with maybe 10 users. So I wanted to ask if the way I'm doing it is secure enough for a semi-big ...
0
votes
1answer
42 views

Security concerns of running auto-login script on server-side?

I would like to fetch data from a website to do data analysis on a server. Username and password are required for login to the website. Therefore I will need to run an auto-login script on the server. ...
5
votes
2answers
323 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
1
vote
1answer
33 views

Allowing VIP Access Credentials from Mobile Devices (smart-phones/BB) but not Desktops

What could be an explanation for such a decision by a company? Simple oversight, or deliberate choice? It seems like a mobile device is easier to lose/crack. ETA: The company is using it as a 2FA for ...
0
votes
1answer
352 views

How to avoid storing plaintext during CHAP authentication

When using CHAP authentication, passwords are stored in plaintext, then I used reversible encryption to store password. However, I recently found Citrix states " storing passwords using reversible ...
0
votes
3answers
73 views

Alice and Bob authentication and integrity problem

Suppose Alice needs to send a file to Bob, guaranteeing her identity and the file integrity (no confidentiality required); the two parties are sharing a secret w and make use of a hash function H ...
-4
votes
1answer
170 views

Do you need to restrict the possible characters of a username?

I was looking at Twitter login system and saw this error message when trying to enter a username Your username can only contain letters, numbers and '_'. Twitter offer the possibility to login ...
13
votes
2answers
6k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
1
vote
1answer
66 views

Not Asking Email Verification on Account Creation

Could we consider it as a security flaw to not ask an email verification on account creation? Let's say there is a service that ask you to enter an email address as a username and a password in order ...
2
votes
3answers
267 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
0
votes
2answers
65 views

Access to system32 [on hold]

Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
-8
votes
0answers
37 views

Hoomomorphic encryption for e voting [on hold]

I have to implement a online voting system in java using homomorphic encryption.Can anyone provide me the source code for it??
0
votes
0answers
13 views

Api key v oAuth for mobile apps

So we already have an oAuth setup for authenticating users. But there are endpoints that are not user specific that are currently open, we would like to restrict access to those open endpoints via API ...
1
vote
0answers
47 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
8
votes
5answers
10k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
30
votes
6answers
4k views

How safe are employee laptops in China against International corporate espionage?

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. This loaner had MS Outlook and was linked to my normal company ...
3
votes
2answers
514 views

Security measures for “Forgot password” link

I noticed that Facebook sends out a "Forgot password" code of six digits, which is very short for a validation code, so I assume they are doing the following: Set a session variable which is linked ...
1
vote
1answer
87 views

NFC - Felica / NXP (Desfire EV1) or ACOS3 which is more secure?

I am new to NFC, and just have been researching on security from different manufacturers, trying to find out which system is more secure with their password protected area. I only know that Desfire ...
7
votes
4answers
187 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
0
votes
3answers
179 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
1
vote
1answer
107 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
16
votes
2answers
549 views

Which factors should I consider for devices that accept handwritten digital signatures?

These days many locations ask you to give your signature on a digital signature pad/device. As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
31
votes
4answers
2k views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
1
vote
1answer
37 views

Handling session tokens when a users IP changes with extreme frequency

My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token ...
2
votes
2answers
35 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
3
votes
1answer
82 views

Why attack detection based on the same user request from different places (e.g. by IP) is not widely used?

There are many ways how an adversary can pretend that he is a legitimate user (like session cookie stealing, bruteforcing the password and what not), but as far as I can see it should be rather hard ...
-5
votes
0answers
32 views

If there is a fair way handshake secret? [closed]

If there is a fair way handshake secret key ? I mean such way that it doesn't favour none of site.
8
votes
3answers
5k views

Why is there a minimum username length?

In some (web) applications there is a minimum length for usernames, usually there is a restriction for a minimum of 6 characteres length. For example, free gmail accounts and miiverse (Nintendo ...
2
votes
3answers
64 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server ...
3
votes
2answers
137 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
3
votes
4answers
280 views

Can the identity of a person in Nigeria be confirmed? [closed]

I need to find out if a person is who they say they are. Can that be confirmed?
1
vote
3answers
142 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
2
votes
2answers
99 views

Is encrypted cookie without authentication secure enough?

I have some sensitive data in the cookie, e.g. it contains the user id that is later on used to execute the query and we trust the cookie because it is encrypted. All communication happens only on ...
107
votes
19answers
27k views

How should I securely type a password in front of a lot of people?

I am a manager in an office where the company does not provide a company email, so I use my personal email. Often, I will receive jobs lists by email from my general manager. How should I log in to ...
2
votes
2answers
74 views

Should it be possible in a good software, using a “Change Password” link for a single user, to try to guess passwords for every user of a Application?

I am having a fight with the "Security Expert" of my team about this very basic question and I need help in getting a good valid argument(s). The pretext is as follows: Should it be possible/valid to ...
4
votes
1answer
38 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own ...
0
votes
2answers
115 views

Computer Security vs Privacy

Probably this is a redundent post but in fact I have been searching online about a precise clear distinction between computer security and privacy. I'd like to know the difference of between them ...
4
votes
6answers
310 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
0
votes
0answers
53 views

Account Signup/Login: Code-via-SMS + email verification

In an effort to make the sign-up / login to a mobile app more streamlined, I am considering alternatives to the username/password signup/login. In this case (as is with most mobile apps) login event ...
0
votes
0answers
18 views

TPM based authentication without a trusted third party

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed. In general, what are the TPM operations that ...
-1
votes
1answer
87 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
5
votes
1answer
153 views

Why are JWT's secure?

I want to make sure that my use of JWT's in authentication is correct. There are a couple of issues that I don't understand. This is my current understanding: When a user logs in, the server will ...
3
votes
4answers
109 views

How secure can you be on an untrusted machine?

I feel like most of what is written about web security assumes you are using a trusted / secure PC. I'd like to consider the opposite: you are using a PC (say, at an internet cafe) which is known to ...
7
votes
2answers
95 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
3
votes
1answer
22 views

Automatic client executable updating

Scenario I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an ...
-1
votes
2answers
97 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
0
votes
1answer
133 views

Tie key to computer

I have client server application. Is it possible to tie an encryption key to some computer (say my client) such that is key is stolen attacker won't be able to use that key from another computer? ...