Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

4
votes
0answers
84 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...
4
votes
0answers
523 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
2
votes
0answers
51 views

Logging out of Basic HTTP Authentication

As seen on https://stackoverflow.com/questions/233507/how-to-log-out-user-from-web-site-using-basic-authentication, there are some interesting ways of logging out a user from Basic HTTP ...
2
votes
0answers
179 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
2
votes
0answers
184 views

How to verify a message?

I have a 192 bit data string and a 384 bit signature calculated with curve ANSIp192r1 as well as the public key. These readings originate from a SYM2 electricity meter and I would like to ...
2
votes
0answers
180 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
2
votes
0answers
59 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...
2
votes
0answers
84 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
2
votes
0answers
130 views

Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?

Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system? The scenario is as follows: I am a ...
2
votes
0answers
80 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
1
vote
0answers
29 views

Is the session key system that I use for authenticating users of my Google Cloud Messaging application secure?

The system works as follows: The user registers a username with the server over HTTPS, which generates a random 256 bit number, converts it to base 64, stores it on the server database alongside the ...
1
vote
0answers
52 views

NFS IP spoofing

I am using VirtualBox: where the guest is an Arch ISO and the host Windows/Cygwin or a generic Linux. For sharing host folders, VB native shared folders is not an option (since the setup requires ...
1
vote
0answers
41 views

Protecting data on a remote device

Background I have am developing a service which consists in a small headless client device (e.g. OLinuXino) which will contain sensitive data. The device will be plugged to a remote network (maybe ...
1
vote
0answers
38 views

Using a bearer token to get a federation token from ADFS

Why is it not possible to use a bearer token from an IdP STS to get ADFS (2.1) to issue a token? All issuedtoken endpoints require a symmetric or asymmetric key in the IdP token. Is there a specific ...
1
vote
0answers
17 views

IdM on apps we host for a client

We're looking at hosting some of a client's existing applications in our environment. My current thinking is we will have an encrypted channel back to the client's network over which authentication ...
1
vote
0answers
80 views

Secure login procedure

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the ...
1
vote
0answers
53 views

How to add user entries with password field in LDAP over HTTPS

I am new to this kind of stuff (HTTPS etc.) and pretty much confused on how to go ahead with this. An LDAP server (ApacheDS) at the back-end stores the user details. To add new users, the user ...
1
vote
0answers
50 views

Security for message queue in ActiveMQ

I am using ActiveMQ and WSO2 for my application. I need to protect my queue to restrict posting of messages by anonymous users(I need to protect my queue with some password). I know, there is a ...
1
vote
0answers
109 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...
1
vote
0answers
47 views

Considerations when implementing a key based SSH-like auth scheme

I have a SMTP server where all the users (for an unrelated reason) will have public keys tied to their username and registered with the server. I want to add a non-standard extension that uses these ...
1
vote
0answers
119 views

Can we create custom APDU for non-smart (memory type) contactless card?

I want to implement card-based authentication for the parking system in a university. Currently all students own a Java Card-based student ID card, if they have not broken or lost it. Can we create ...
1
vote
0answers
141 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
1
vote
0answers
270 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
193 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
1
vote
0answers
42 views

How exactly are physically unclonable functions used in authenticaton if they are unclonable?

There is ongoing and quite promising research with prototypes presented about using physically unclonable functions (PUFs) in authentication. If they are practically unclonable, how is a PUF-based ...
1
vote
0answers
116 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
1
vote
0answers
54 views

Is the digital declaration just an obscure proposal?

One professor from my university proposed me and some colleagues to work on a paper about the digital declaration (which is supposed to be better than the digital signature) for passing the subject. ...
1
vote
0answers
14 views

SSTP data traffic when multiple client approach?

I'm connecting 100 clients through SSTP to a centralized server containing a database. What happens when all clients approaches at same time and how the data traffic is managed in SSTP and how much ...
1
vote
0answers
92 views

How should I authenticate my SPA frontend with my API since I´ve got no authentication process in the site?

We are designing a web site for selling financial products online. The following is a high level description of the components: Our frontend will be a SPA built with AngularJs. The frontend will ...
1
vote
0answers
105 views

Does Diffie-Hellmann (DH) key exchange protocol lower Off-The-Record protocol (OTR) security level?

Off-the-Record protocol employes Diffie-Hellman key exchange protocol (DH). DH protocol does not provide authentication of the communicating parties and, according to many sources, is vulnerable to ...
1
vote
0answers
590 views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
1
vote
0answers
461 views

Simple Session Management Across Multiple Application Servers

How should I handle authentication for a simple iPhone chat app? Backend I'm building the backend using two application servers: Sinatra REST Server It lists users & old messages. Node.js ...
1
vote
0answers
134 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
0answers
75 views

how to implement 4-legged authentication for mobile application?

I have a REST web service which already implements oauth authentication mechanism via browser. I would to expose my API to a number of mobile clients programmed by third parties. In this scenario 4 ...
1
vote
0answers
71 views

Login details security using salt n hash and a login role in postgresql

I am coding up the security for a website in express.js and postgresql db. Now I have been reading about salting and hashing and I have the code set up with pdkdf2 using the crypto module, but my ...
1
vote
0answers
75 views

Putty Event Log

Can anyone explain me the Step by step process of Key Exchange that takes place while accessing Linux machine using Putty ? I found the Event Log of Putty but the Various Key Exchange didn't make very ...
1
vote
0answers
18 views

Get Service_key in the course of kerberos authentication

Built environment 1) Exchange server: The operator system of Exchange server is Windows Server2008R2, We configured it as Active Directory (primary domain controller) used for client authentication ...
1
vote
0answers
35 views

How to get Service_key and the corresponding function call interface from the Samba source TGS_REP part

1, My existing configuration environment are as follows: (1), Server_side, Redhat5.5 Enterprise with samba4.0.0 installed, Ip Address: 5.5.5.149; domain name: EXAMPLE.COM; (2), Client_side: windows ...
1
vote
0answers
52 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
1
vote
0answers
62 views

Is what flexi_auth does with its use of its $this->auth object good practice?

I am looking at the authentication library Flexi_auth for CodeIgniter. To use the library you have to create a object one time in the controller before the lib is used Like this: `$this->auth ...
1
vote
0answers
212 views

Implementing OAuth flow in JavaScript

I am making a custom auth flow for the application. It is inspired by OAuth 2.0. Dev sends user to an auth page on my domain, passing callback_url and api_id. I redirect user to callback_url, passing ...
1
vote
0answers
424 views

Safe communication via rest api between two known servers

i would like to have some advice on the following scenario: I'm using kinvey as backend but because it doesn't provide the ability to run custom code i have set up another server. So basically when x ...
1
vote
0answers
50 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
1
vote
0answers
150 views

Routing Protocol Encryption

As far as I know 'newer' versions of routing protocols support authentication between routers. What about encryption and integrity checks? Some implementations like this one from Cisco use MD5, which ...
1
vote
0answers
128 views

Remote desktop connection different networks password non VPN

I'm looking for a solution to bring support to users from a big network to other users into little networks. The idea is to keep control of content (no VPN). Also it's important that always users who ...
1
vote
0answers
163 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
0answers
13 views

How to evaluate authentication for a WAP portal?

I am trying to evaluate a security authentication for a WAP portal. The authentication works by asking the customer for his unique MSISDN and then a secret pin code is sms to client. In this is a ...
0
votes
0answers
43 views

Security considerations for RESTlike HTTP API of an embedded system

I'm designing a HTTP service for an embedded device and wondering if the following security concept is good enough: SSL(Up to Version 3) is enabled by default, TLS is not by limitations of the ...
0
votes
0answers
34 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
0
votes
0answers
17 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...