Tagged Questions
1
vote
1answer
60 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
29
votes
9answers
1k views
Use additional “password” in Referer to hide private site?
I have a private (= I'm the only user) site at example.com/private/. Nothing else is published at this host (it's my domain).
I don't want anyone to know that there is anything at example.com, ...
2
votes
1answer
120 views
Web service HMAC authentication/anti-replay
I am creating a web service, which handles various requests from web clients. The client and server share a big secret key S, and when one part wants to send data, it calculates the token as follows:
...
1
vote
1answer
132 views
Web Applications (http): Don't get how token based authentication is secure
See something like this:
http://stackoverflow.com/questions/10826293/restful-authentication-via-spring/10864088#comment21706215_10864088
Or more specific:
Token-based authentication - Securing the ...
2
votes
3answers
173 views
HMAC What is secure manner to distribute shared secret between client and server?
I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
7
votes
2answers
776 views
Why does HTTP Basic authentication encode the username and password with base64?
RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64.
To receive authorization, the client sends the userid and password,
separated by a ...
5
votes
3answers
384 views
Is my session-less authentication system secure?
So, I've created an authentication system. Poured over it for any kind of security flaws and tested the crap out of it. I think it's fairly secure, but there is one "different" by-design aspect of it ...
2
votes
1answer
86 views
What's the best way to enumerate log/sign in attempts?
For sign in via a website, what is the best way to count the number of attempts that is:
least vulnerable to tampering
reliable
quick
The system would:
use HTTPS throughout the sign on phase (at ...
-2
votes
1answer
84 views
Digest authentication - client side [duplicate]
Possible Duplicate:
Client side password hashing
How one design support for digest authentication in client side. HTML form probably won't help. Does one need javascript and set the header ...
6
votes
2answers
207 views
An adequate message authentication code for REST
My REST service currently uses SCRAM authentication to issue tokens for callers and users.
Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
4
votes
2answers
318 views
Do Client Nonces enhance the security of HTTP Digest Auth?
As far as I understand the answer at
http://security.stackexchange.com/a/3024/13447, client nonces are meant to prevent attackers from amortizing the costs of brute-force hash computations by being ...
3
votes
2answers
797 views
Help understanding basic user authentication with salts and hashing
I for some reason am not understanding how to execute a secure authentication between client and server for a user. I've read many resources, and I understand how to use the hashing and salting tools, ...
5
votes
3answers
982 views
HTTP Basic auth password storage more secure than Digest auth
If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
1
vote
2answers
338 views
Signed request vs HTTP digest auth for API authentication?
By signed request I mean something like this (simplified example):
Client creates a sig in his request:
$sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
0
votes
1answer
121 views
Securing communication
The problem:
I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
2
votes
2answers
309 views
Is DIGEST-MD5 secure if done over HTTPS?
If the DIGEST-MD5 negotiation is done over an HTTPS connection instead of HTTP, does that prevent this list of disadvantages from Wikipedia?:
Digest access authentication is intended as a security ...
6
votes
1answer
383 views
Inconsistencies found in OpenID Provider's HTTP Headers. Which one is the most secure that I should imitate in my STS, and Relying Party?
I'm comparing the HTTP headers of the various providers (LiveID, Google, Yahoo, etc) and notice a broad inconsistency in implementation on the sign in page, sign out page, and subsequent pages.
...
2
votes
2answers
627 views
SSL verification of host name of https server
I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
-1
votes
1answer
592 views
login with a password in clear text
Suppose that i do a login to a website.
When i type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can ...
34
votes
7answers
9k views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
1
vote
1answer
4k views
