Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
2answers
47 views

My IP address switched suddenly and then switched back

Sometimes I look at the login history of my blog account (a Tumblr blog) to make sure no one else is logging in (because I have private posts that I want to keep private). Even though today I ...
1
vote
0answers
11 views

Understanding Digital Certification as as a whole starting from a normal http request

I am very new to security and i do not come from an IT background. Please pardon me if i ask some very simple and questions that don't make sense. I am trying to understand the difference between ...
3
votes
1answer
87 views

OS login password: How does it work?

I am making an application to create a password for a user. I am a bit baffled over how it all works though. Namely I want to be sure that my application will store the correct hash so the user can ...
2
votes
4answers
490 views

Why self-signed https is less trustworthy than unencrypted http?

It wouldn't be far-fetched to guesstimate that at least 50% of the web traffic can be intercepted in 2014. However, a guesstimate of active interception attacks is likely an order of magnitude ...
42
votes
6answers
7k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
1
vote
1answer
54 views

How dangerous is reflected request query strings?

I have discovered a possible security flaw in a login for a site that many people rely on. I won't say the site but in the URL there is something similar to ...
8
votes
6answers
2k views

How do RSA fingerprints protect from MITM attacks?

I understand that RSA fingerprints are used to verify that you are really connecting directly to who you want to connect to, and not someone else posing as that site. Like when you do a git push, it ...
0
votes
1answer
68 views

Active directory authentication and authorization for an application

Currently all our applications are web based and our authentication and authorization mechanism is always through the database. eg database logins and access controls defined at database. However now ...
4
votes
5answers
4k views

Does using WPA2-Enterprise just change the attack model vs WPA2-PSK?

As far as I can tell based on the reading I've done so far, WPA2-Enterprise uses the same encryption and security algorithms and methods as WPA2-PSK, with the addition of using another service for ...
6
votes
6answers
922 views

Isn't it less secure to use something you are for authentication?

I have to think of this everyday when I close the doors of the shop I work in: A year ago we used to close the shop and arm the alarm using a key fob. This means the worst case scenario was that I ...
4
votes
2answers
314 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires authentication and authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
0
votes
0answers
5 views

Enabling MFA in Windows 7 [migrated]

How does one set on Windows 7 that you have to login with 2 methods? For example, first time with your password and then you are forced to use fingerprint or smart card ... and after that your PC will ...
1
vote
0answers
47 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising when wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide ...
2
votes
1answer
49 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
1
vote
1answer
45 views

Choosing token over Session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and send ...
3
votes
1answer
40 views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
0
votes
0answers
12 views

What is the goal of sign a key in BrowserID certificate?

I'm learning about the Mozilla Auth. it has an implementation of SRP protocol in https://github.com/mozilla/fxa-auth-server/blob/master/docs/overview.md and his client; example is ...
1
vote
1answer
50 views

Signup/Signin with Mobile+PIN

Telegram implements signup/signin with mobile number and a 5-digit one-time password. I believe the flow to be something along the lines of this: Grab the mobile number, generate an OTP, cache it ...
0
votes
1answer
18 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
2
votes
0answers
29 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
0
votes
3answers
3k views

3 way authentication

Can someone please tell me what does 3 way authentication mean? I cannot understand this concept? Now if there are two people A and B A challenges B with a question B gives the answer and B ...
1
vote
2answers
115 views

Ways to secure administrative pages of a portable site

I made a CMS (using PHP) that is basically drag and drop to be live (under linux/apache hosts), now I need the communications between the administrative/login pages of said CMS and the client (recent ...
3
votes
1answer
232 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
124 views

Ouath2 how does it work (Android client)

I have read a lot about Oauth2 but still cannot understand, how does it work. I will explain how do I understand this protocol. There are some main characters in Oauth protocol interaction. User, ...
-1
votes
0answers
23 views

Is this legally reverse engineering - unsecured API [migrated]

Is it (in a legal sense) reverse engineering to 'hack' into a completely unsecured API? Simple REST API used in Android app No SSL (just strait HTTP) Passwords are sent in plain text over this ...
-1
votes
1answer
45 views

Is there any authentication scheme relying only on the “secret” question?

I know it's standard for websites to use usernames and passwords to authenticate users. From what I've read, question based authentication is usually used to either reset a password, or employ ...
-2
votes
0answers
11 views

Aptexx resident anywhere broken authentication [closed]

I have tried to understand how to exploit this vulnerability and i didn't understand it so, i want explanation about how to exploit those kind of vulnerability Description Summary: When an actor ...
3
votes
2answers
68 views

Saving Authentication Tokens to Third-Party Websites

So Flickr allows you to authenticate users to your app via app_key and secret and returns an authentication token. I want to securely save that authentication token in my database, but also be able to ...
5
votes
2answers
2k views

How do I make or get computer certificates to use with IPSEC user authentication on Windows?

I am having trouble and need some direction using computer certificates with Windows 7 firewall IP Security rules, using certificates only for user authentication. I can get everything to work ...
1
vote
1answer
61 views

Does the carrier network autheticates itself to the SIM card?

From my understanding this is how SIM authentication works: When the mobile device starts up it obtains IMSI from the SIM card and send it to the operator network Operator network finds the Ki(128 ...
1
vote
2answers
132 views

Different password for each login - based on some variable

This might sound a silly question, but I was thinking this as and extra option(which is not required) mainly for advanced users, who want to protect their accounts even more. Lets consider that other ...
1
vote
2answers
175 views

Why do I have to use multiple keys for each direction and purpose?

I'm currently writing an examen about 'Lessons Learned in the IT-Security'. I already found some thing, which shouldn't be done. But right now I'm in trouble finding the reasons why not to do so. ...
2
votes
1answer
205 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
-2
votes
0answers
21 views

Checks to perform on application if we have the normal user credentials? [closed]

Suppose we have any web based application. If we want to find its vulnerabilities, how can we start the process? Moreover, there are two situations: if we don't have credentials to enter the ...
0
votes
2answers
128 views

Should I create one key pair per customer as Service Provider in SAML?

This is more or less the reverse of what's asked in this question. I recently added SSO with SAML to a SaaS Web application making said application the Service Provider (SP). This is done so ...
2
votes
1answer
69 views

OpenVPN username and password authentication only - unsafe?

Is it safe to only use username and password (and server certificate) for OpenVPN connection authentication? Are username or password ever transmitted in plaintext to the OpenVPN server? I found a ...
0
votes
2answers
107 views

Diffie-Hellman and MIM attack, and server identity

Diffie-Hellman and MIM attack: When variants of Diffie-Hellman algorithms like DHE, ECDHE etc. are used in SSL handshake for key exchange then can it become prone to man in middle (MIM) attack. ...
10
votes
6answers
4k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
3
votes
1answer
152 views

SIP Provider stores credentials, is it required for some SIP phones?

My SIP provider stores my SIP call time password as AES encrypted in stead of hashed. I understand that SIP authentication has the capability to NOT store the password, and in stead store a ...
0
votes
0answers
54 views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
11
votes
1answer
964 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
1
vote
3answers
118 views

How to prove ownership of a website?

We all know how banks identify themselves to users. No, not through TLS certificates. The users pay no attention to those. No, I'm talking about branding-- all those fancy logos and stock photos that ...
0
votes
0answers
27 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
0
votes
1answer
41 views

Use PIN or Password [duplicate]

Which one is better, using PIN or password ? I want my app using PIN number to user login and register. Does not matter if I use PIN number only for user login and registration in my web application ? ...
-2
votes
0answers
59 views

implementing a secure client-server system

I am creating an Android app that communicates with a server. I need a safe way to transmit sensitive data so this is what I planed to do: Use ssl pinned to the app, so the app knows the server. Use ...
2
votes
1answer
51 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
5
votes
1answer
170 views

How secure is docker container-to-container traffic?

I'm working on building a web application using the microservice architecture pattern in a set of docker containers and I'm wondering about the importance of securing the communication between the ...
2
votes
2answers
75 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
2
votes
1answer
135 views

Storing server generated passwords

There are some applications that generate passwords for you. Consider a case where you sign in via Facebook, the application (let's call it NEWAPP) verifies your sign in on the server using FB tokens ...
2
votes
2answers
54 views

Verification code within mobile phone applications

In most phone applications with two factor authentication I noticed that the verification code is usually 6 digits long. I wonder why 6 digits are needed - we already know that the user is associated ...