Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

0
votes
0answers
16 views

Security concern of running auto-login script on server-side

Scenerio: I would like to fetch data from a website for data analysis purpose which process on a server. To archive this username and password are required for login to website. Then I suppose to ...
4
votes
2answers
311 views

How secure is a password app that stores both the password and two factor secret in one place?

Take for example 1Password, that now can store your password and one time password secret in a single place (your 1Password vault). I know it isn't truly two-factor anymore, but how much better is it ...
1
vote
1answer
31 views

Allowing VIP Access Credentials from Mobile Devices (smart-phones/BB) but not Desktops

What could be an explanation for such a decision by a company? Simple oversight, or deliberate choice? It seems like a mobile device is easier to lose/crack. ETA: The company is using it as a 2FA for ...
0
votes
1answer
350 views

How to avoid storing plaintext during CHAP authentication

When using CHAP authentication, passwords are stored in plaintext, then I used reversible encryption to store password. However, I recently found Citrix states " storing passwords using reversible ...
0
votes
3answers
72 views

Alice and Bob authentication and integrity problem

Suppose Alice needs to send a file to Bob, guaranteeing her identity and the file integrity (no confidentiality required); the two parties are sharing a secret w and make use of a hash function H ...
-4
votes
2answers
166 views

Do you need to restrict the possible characters of a username?

I was looking at Twitter login system and saw this error message when trying to enter a username Your username can only contain letters, numbers and '_'. Twitter offer the possibility to login ...
13
votes
2answers
6k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
1
vote
1answer
66 views

Not Asking Email Verification on Account Creation

Could we consider it as a security flaw to not ask an email verification on account creation? Let's say there is a service that ask you to enter an email address as a username and a password in order ...
2
votes
3answers
266 views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
0
votes
2answers
61 views

Access to system32 [on hold]

Is there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.
-8
votes
0answers
36 views

Hoomomorphic encryption for e voting [on hold]

I have to implement a online voting system in java using homomorphic encryption.Can anyone provide me the source code for it??
0
votes
0answers
13 views

Api key v oAuth for mobile apps

So we already have an oAuth setup for authenticating users. But there are endpoints that are not user specific that are currently open, we would like to restrict access to those open endpoints via API ...
1
vote
0answers
45 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
8
votes
5answers
10k views

What are the ways to implement two factor authentication?

We have devices that can generate tokens. So we can use tokens with passwords to perform two factor authentication. There are many ways to implement such systems to enhance security. One of two I ...
30
votes
6answers
4k views

How safe are employee laptops in China against International corporate espionage?

I recently took a business trip to China. Our IT department told me I could not take my normal machine, and instead gave me a loaner. This loaner had MS Outlook and was linked to my normal company ...
3
votes
2answers
512 views

Security measures for “Forgot password” link

I noticed that Facebook sends out a "Forgot password" code of six digits, which is very short for a validation code, so I assume they are doing the following: Set a session variable which is linked ...
1
vote
1answer
86 views

NFC - Felica / NXP (Desfire EV1) or ACOS3 which is more secure?

I am new to NFC, and just have been researching on security from different manufacturers, trying to find out which system is more secure with their password protected area. I only know that Desfire ...
7
votes
4answers
184 views

Must a system be insecure against physical access? If so, why?

Inspired by: Why don't OSes protect against untrusted USB keyboards? Related: What can a hacker do when he has physical access to a system? (I address the points of its main answers below.) There ...
0
votes
3answers
179 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
1
vote
1answer
107 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
16
votes
2answers
548 views

Which factors should I consider for devices that accept handwritten digital signatures?

These days many locations ask you to give your signature on a digital signature pad/device. As I am situated in Europe, the EU directive 1999/93/EC seems to regulate it. From what I have found out ...
31
votes
4answers
2k views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
1
vote
1answer
35 views

Handling session tokens when a users IP changes with extreme frequency

My web service is an API-driven Single-Page-Application. Once the user logs in they're given a temporary token to use for the rest of the session which is sent along with each API request. The token ...
2
votes
2answers
35 views

Is email OTP improving the security for 2 phase authentication?

There has been similar questions before where people say that using some other means (sms, hardware devices, etc.) is a more secure way to provide 2 factor authentication. Provided we don't have an ...
3
votes
1answer
82 views

Why attack detection based on the same user request from different places (e.g. by IP) is not widely used?

There are many ways how an adversary can pretend that he is a legitimate user (like session cookie stealing, bruteforcing the password and what not), but as far as I can see it should be rather hard ...
-5
votes
0answers
32 views

If there is a fair way handshake secret? [closed]

If there is a fair way handshake secret key ? I mean such way that it doesn't favour none of site.
8
votes
3answers
5k views

Why is there a minimum username length?

In some (web) applications there is a minimum length for usernames, usually there is a restriction for a minimum of 6 characteres length. For example, free gmail accounts and miiverse (Nintendo ...
2
votes
3answers
63 views

Verify password hashed with nonce when the password is already hashed on the server?

I found this picture in the Wikipedia nonce article: To avoid sending the password in clear text and prevent replay attacks, the password is hashed together with one random number from the server ...
3
votes
2answers
137 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
3
votes
4answers
280 views

Can the identity of a person in Nigeria be confirmed? [closed]

I need to find out if a person is who they say they are. Can that be confirmed?
1
vote
3answers
140 views

why not use hashed password as password [duplicate]

Why dont we use our mobile phone tho hash a password and then enter the hash on a website as the password ? This way the password for the website would be much more complex. Would this even increase ...
2
votes
2answers
99 views

Is encrypted cookie without authentication secure enough?

I have some sensitive data in the cookie, e.g. it contains the user id that is later on used to execute the query and we trust the cookie because it is encrypted. All communication happens only on ...
107
votes
19answers
27k views

How should I securely type a password in front of a lot of people?

I am a manager in an office where the company does not provide a company email, so I use my personal email. Often, I will receive jobs lists by email from my general manager. How should I log in to ...
2
votes
2answers
74 views

Should it be possible in a good software, using a “Change Password” link for a single user, to try to guess passwords for every user of a Application?

I am having a fight with the "Security Expert" of my team about this very basic question and I need help in getting a good valid argument(s). The pretext is as follows: Should it be possible/valid to ...
4
votes
1answer
38 views

Keeping login in sync with third party providers

When you use a third party for authentication (E.g. Google/Facebook javascript SDK), their SDK keeps track of the login status. If I have my own server, which requires an access token of it's own ...
0
votes
2answers
114 views

Computer Security vs Privacy

Probably this is a redundent post but in fact I have been searching online about a precise clear distinction between computer security and privacy. I'd like to know the difference of between them ...
4
votes
6answers
310 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...
0
votes
0answers
52 views

Account Signup/Login: Code-via-SMS + email verification

In an effort to make the sign-up / login to a mobile app more streamlined, I am considering alternatives to the username/password signup/login. In this case (as is with most mobile apps) login event ...
0
votes
0answers
18 views

TPM based authentication without a trusted third party

Consider a scenario - Device manufacture provides in advance the TPM’s endorsement key certificate(containing EK public key) for device to be deployed. In general, what are the TPM operations that ...
-1
votes
1answer
87 views

Does the page that links to my login page need to https?

So I realise the login ajax call must be https, and the page that ajax call is made from should also be https to prevent a man in the middle potentially changing the page and changing the form that ...
5
votes
1answer
152 views

Why are JWT's secure?

I want to make sure that my use of JWT's in authentication is correct. There are a couple of issues that I don't understand. This is my current understanding: When a user logs in, the server will ...
3
votes
4answers
109 views

How secure can you be on an untrusted machine?

I feel like most of what is written about web security assumes you are using a trusted / secure PC. I'd like to consider the opposite: you are using a PC (say, at an internet cafe) which is known to ...
7
votes
2answers
95 views

How can I implement a secure download area on a website which requires an electronic signature?

For quality management purposes, the company I work for would like a system which requires a client to read through a disclaimer and then provide an electronic signature, acknowledging said ...
3
votes
1answer
22 views

Automatic client executable updating

Scenario I am currently developing an application which should automatically update (if applicable) every time it is executed. The update would involve replacing the main.exe and any assets in an ...
-1
votes
2answers
97 views

Decrypting a very simple key [closed]

I'm doing a basic cryptography course and a question is asking to to decipher: ...
0
votes
1answer
133 views

Tie key to computer

I have client server application. Is it possible to tie an encryption key to some computer (say my client) such that is key is stolen attacker won't be able to use that key from another computer? ...
-1
votes
2answers
46 views

what is the different between X.509 certificate and 2-way SSL? or both are same? [duplicate]

Can anyone clarify what is the difference between an X509 certificate and two-way SSL? or both are same?
2
votes
2answers
82 views

staying not signed in: is it the safest procedure?

each time I do connect to a private or public network I log into websites by keeping the option "stay signed in" or "keep me signed in" unselected, so I have to re-type my username and passwod as ...
13
votes
6answers
3k views

Is it a security issue to allow nearly identical email addresses when registering?

Say you have a website where it is possible to create accounts for all of the following email addresses: 'test@test.com' 'test@test.com ' 'test@test.com;' 'test@test.com;test2@test.com' Should this ...
25
votes
10answers
7k views

Two passwords for one account

Would it be a good idea if you had one account which would require two different passwords ? For example your login details were: email: example@gmail.com password 1: P4$$w0rd1 password 2: ...