Tagged Questions
-1
votes
0answers
51 views
Which is the most popular one time password based authentication scheme? [closed]
Which is the most commonly used (popular) one time password based authentication scheme?
15
votes
6answers
825 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
1
vote
1answer
60 views
Simple and secure remote installation method that accepts input via a web page?
When installing software on a remote server: Is it possible to let the admin (i.e. the user that installs the software) define admin username and password via a HTML page, in a secure manner?
...
3
votes
1answer
75 views
Are there any uses of having a non-deterministic salt value for hashes?
So I've been toying with the idea of having non-deterministic salt values for hashes.
Let me explain what I mean:
Basically, I applied some properties from Bitcoin including a "difficulty" (ie, ...
2
votes
1answer
99 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
5
votes
6answers
284 views
What's the most secure technique for authenticating user in a website?
I usually ask user for his username and password and run a query over database to return true or false, do you think it's secure enough? do you think it's better to add some steps to procedure?
6
votes
3answers
194 views
What is the value in asking for a second password for sensitive operations?
When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions?
Does it provide any benefit over ...
2
votes
2answers
156 views
user authentication by decrypting a random blob
Normal user authentication is done by comparing "hash"-values. A simple example of this:
The user password is hashed with PBKDF2 on the client using a salt (the salt is the hash of the user password ...
7
votes
4answers
819 views
Why does getting a password wrong takes more time than not
I type my password to login to Win or Linux.
Case 1: I get it right. Almost instant reaction.
Case 2: I misspelled it. It takes a while, and then rebounds.
Why does it takes longer to identify a ...
10
votes
3answers
427 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
2
votes
2answers
123 views
MySQL Access Control?
I have read somewhere that it is better to have two different MySQL logins in order to prevent hacking. What I mean is having one MySQL login for read access (SELECT permission) and another login for ...
139
votes
18answers
7k views
Passwords Being Sent in Clear Text Due to Users' Mistake in Typing it in the Username Field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
7
votes
3answers
261 views
Is it inconsistent to tell users to “not click on password links in email”, and requiring clicks on “forgot password” links?
On one hand, IT Security shops have been telling users to not click on links in email because they can do damage to your computer, or phish your personal information. Many of those issues are ...
2
votes
7answers
234 views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
0
votes
1answer
147 views
What type of attack should be used in order to pass this authentication
I am practicing the Astalavista Wargames and i came across this challenge. The question is:
Bob wrote a piece of software but the password verification doesn't seem to work. You must find a way to
log ...
2
votes
3answers
89 views
Is password authentication worse that signed messaging if done over SSL?
Let there is a public API:
HTTP-based
via SSL
there are no browsers, just connections between custom written programs
The first authentication scheme that came to my mind was... client signs their ...
5
votes
1answer
152 views
How does SRP prevent man-in-middle attacks?
SRP is designed to resist both active and passive attacks, how does SRP prevent man-in-middle and packet modification attacks?
-1
votes
1answer
73 views
What makes EAP-SRP-256 better than SRP? [closed]
What is the advantage of the EAP-SRP protocol? Is it only used in wireless?
7
votes
2answers
238 views
What is the risk and mitigation of accidentally typing a YubiKey password in an open forum?
I have a YubiKey in my laptop (for testing) and accidentally broadcast my YubiKey password out to the Internet. Since this is only a test key, and has no access to anything of value, here are some ...
1
vote
1answer
95 views
Pure SRP authentication without TLS
IF using a SRP for client/server application authentication without TLS. Will it be vulnerable to man-in-middle attack, since if using SRP, the public info doesn't really useful to calculate the ...
9
votes
4answers
940 views
Demystifying Web Authentication (Stateless Session Cookies)
I'm currently researching user authentication protocols for a website I'm developing. I would like to create an authentication cookie so users can stay logged in between pages.
Here is my first ...
3
votes
4answers
172 views
Securing opensource web application
I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
1
vote
1answer
85 views
What are my options for securely printing an OTP Scratchcard?
I want to print and distribute several One Time Passwords (OTPs) that can't be easily disclosed to a 3rd party in transit. (think the physical version of a TLS session for private secrets)
To me ...
7
votes
3answers
154 views
If multi factor authentication is enabled, how should that affect self-service password reset?
Given that security is only as secure as its weakest link, suppose I have website with additional authentication enabled in any of these ways: (example, multiple conditions may be required)
...
5
votes
3answers
248 views
Mutual authentication for humans
Is there any way for two people to securely authenticate each other without access to any special software (like PGP)? For example, when speaking over the phone or by sending SMSes to each other or ...
3
votes
1answer
201 views
Is this acceptable login security?
I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2.
I discovered that I could input my password, followed by garbage, and it would be accepted.
How is this considered ...
0
votes
1answer
133 views
Storing Private Keys Generated on Server with specific User's Password Securely
I am currently building a system (PHP Web Application Framework) that creates an RSA Key Pair for a user to allow other users to send secure information from one to another. The public key is ...
0
votes
3answers
230 views
Is it possible to change the wifi password with a script?
I was wondering if it is possible to change the password for a wifi with a script instead of having to log-in to the routers firmware?
0
votes
3answers
101 views
Lowest possible threshold for smartphone app login
I am developing an iPhone/Android game app. Currently users must register USERNAME (3 chars min, letters only) + PASSWORD (8 chars min, ascii only) before allowed into the game.
Testing shows some ...
1
vote
4answers
145 views
Secure login feature with low CPU power
I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
7
votes
5answers
377 views
Are we concentrating too much on password complexity?
As a developer and/or user, do I really need to worry about password strength if the system does not allow brute force attack to be feasible (implements a delay or attempt counter) or implements a ...
3
votes
3answers
607 views
Choosing a session ID algorithm for a client-server relationship
I am developing an application which has a client-server relationship, and I am having trouble deciding on the algorithm by which the session identifier is determined. My goal is to restrict ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
2
votes
1answer
86 views
What's the best way to enumerate log/sign in attempts?
For sign in via a website, what is the best way to count the number of attempts that is:
least vulnerable to tampering
reliable
quick
The system would:
use HTTPS throughout the sign on phase (at ...
19
votes
11answers
924 views
Is it safe to use a weak password as long as I have two-factor authentication?
I'm careful to use strong passwords (according to How Big is Your Haystack, my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and ...
3
votes
1answer
73 views
SRP: Can the client authenticate using only the stored hash?
Based on the description of SRP, it seems that it would be possible for a client application to cache the hashed password x and reuse it for subsequent authentifications. The actual password p doesn't ...
48
votes
12answers
2k views
How do you log in from an unsecured computer?
Suppose that you are on a cybercafe, at a friend's home or at your work office, and you need to log in on a site, but you feel that the the computer can not be trusted (e.g. your friend isn't ...
2
votes
1answer
156 views
Password authentication using DynamoDB
I'm working on a Mac app. I have users stored using DynamoDB.
Authentication is needed to enforce access control on system-internal operations, such as uploading files to Amazon S3. Of course, I ...
9
votes
2answers
421 views
My bank makes me enter my password using the mouse. What's up with that?
Internet banking login process for Westpac requires user to enter the password using the mouse. It's annoying, what's up with that? Is it just to try and stop keyloggers on public computers or is ...
6
votes
3answers
2k views
Why is Chrome asking for the application-specific password and my account's password every time?
I enabled Google's two-factor authentication and found it ironic that Google Chrome Sync requires #1 You account password, and #2 an application-specific password. First of all, don't applications ...
2
votes
1answer
76 views
What authentication threat data exists?
I recently read an article that said there was not much data on which authentication threat vectors were actually being exploited in the real world. Eg what percent of password theft was by ...
13
votes
2answers
3k views
How secure is Windows 8's Picture Password login?
The final Windows 8 build has been released to manufacturing. One of the new features of Windows 8 is "Picture Password", where the end user logs on to Windows by clicking a specific pattern on the ...
6
votes
1answer
384 views
Store user passwords in NoSQL database?
I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
2
votes
2answers
83 views
Is this login authentication safe?
I have been thinking of a way to authenticate users so as to pick out the users using cracked versions of my game from the people who have actually bought it. I came up with this idea:
The client ...
2
votes
1answer
435 views
Should we block all plaintext authentication and require authentication over an encrypted channel?
Should we configure our servers to require the authentication happen over an encrypted channel and block all methods of unencrypted, plaintext authentication over?
I recently configured my servers to ...
3
votes
2answers
799 views
Help understanding basic user authentication with salts and hashing
I for some reason am not understanding how to execute a secure authentication between client and server for a user. I've read many resources, and I understand how to use the hashing and salting tools, ...
3
votes
1answer
214 views
How strong are google's Application-specific passwords? [duplicate]
Possible Duplicate:
Google Account: implications of using application-specific passwords
In 2-step verification of google accounts, we need to use the Application-specific passwords ...
5
votes
3answers
243 views
How can Microsoft validate a shorter password on Microsoft accounts (MSDN)?
I recently ran across this when logging into MSDN. (I saw this screen after typing my initial credentials.)
I have a 20+ digit password, however there's apparently a new requirement for Microsoft ...
5
votes
3answers
987 views
HTTP Basic auth password storage more secure than Digest auth
If you are using SSL already, it appears Basic auth is the way to go since you can perform bcrypt with the password when you store it in the database, where as Digest auth only allows md5. As we know, ...
3
votes
4answers
470 views
Is it okay for API secret to be stored in plain text or decrypt-able?
Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
