1
vote
1answer
40 views

Web Application Authentication Using Computer Properties

Introduction: I am in the process of building a web-based game that requires user authentication. The vast majority of other gaming sites utilize the typical username/password method for ...
1
vote
1answer
83 views

Confused about the most relevant way to secure my APIs

I own a Javascript application (Single Page Application) hitting some apis from my own RESTful backend. What I expect for my authentication/(authorization) mechanism is three things: Preventing ...
6
votes
3answers
1k views

What's wrong with my own authentication scheme?

So I want to write my own authentication scheme for a web-app server, as follows. I assume this is a Bad Idea from either security or cost-effectiveness reasons and I know the conventional wisdom is ...
1
vote
3answers
24 views

Secure Custom Registration Links

I'm working on a website that allows a current user to invite another individual to be friends by typing in the non-user's email address. The non-user would then receive a custom registration url by ...
1
vote
0answers
81 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
0
votes
1answer
34 views

Web Application Security Tools For Login Authentication

currently i doing my final year project. I want to do a comparison of different types of web security tools to pen test login authentication. But, this is too broad and pointless. So, any one of you ...
1
vote
2answers
85 views

Is checking against password lists a good way to enforce a secure password policy and possibly detect dictionary attacks on a web-based app?

I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts. I am thinking about incorporating it into ...
3
votes
2answers
105 views

Separation of secure login steps

I'm redesigning a login screen for a financial services application. Currently, this requests user ID and password, then (on the same screen) 2 digits from a 6-digit PIN are requested - these 2 digits ...
2
votes
2answers
168 views

What are the benefits to a two-page login system for a webapp?

I have noticed many website going to a two-page (not two-factor) login system - where you enter your username on page 1 and click submit, and then enter your password on page two and click submit. ...
1
vote
1answer
134 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
0
votes
1answer
32 views

How could a comments plugin be securely loaded from domains people are already logged into?

The fundamental idea is to load a blog comments plugin (like Disqus) from a domain someone is already logged into to save users time and increase engagement. I like the facebook comments plugin ...
3
votes
1answer
245 views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
2
votes
2answers
94 views

Website doesn’t always log me out – Privacy concern or am I overreacting?

I’ve been applying to for some jobs and use one certain careers page somewhat regularly. I’ve started to notice that I don’t always get logged out even if I do click “log out” and see a message that ...
4
votes
4answers
399 views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
3
votes
2answers
550 views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...
2
votes
2answers
139 views

Authentication for external applications

I need to design an application for internal corporate use. The application must be hosted externally. Ideally I'd like that application to be able to authenticate and authorize against the corporate ...
5
votes
3answers
794 views

Is it possible to use a GPG or SSH key for web based authentication in a secure fashion?

Let's say hypothetically I am writing a web application targeting technically inclined, security-conscious users who have no problems generating and using GPG or SSH keys. Is it possible to use said ...
1
vote
3answers
165 views

Are subdomains a cure for phishing?

Seeing as phishing is getting more popular and users are becoming less concerned about security, I am trying to come up with a solution for a new site of mine that can stop phishers. For instance, any ...
4
votes
2answers
100 views

Is there a security advantage to requiring a user id instead of just /me in an api request?

Is there a security advantage to requiring a request to conform to /api/1234 instead of /api/me? Both would obviously have access tokens. My guess is that api/1234 is more secure because if someone ...
4
votes
3answers
299 views

Using GET to submit username/password? [duplicate]

From what I understand using GET to submit usernames/passwords is a security issue because the username/password are part of the URL which can show up in browser history. Is this still an issue if ...
3
votes
2answers
95 views

System for securely authenticating content acquisition

I'm having trouble designing a system for authenticated content from my site distributed by other people. I'm working in Ruby on Rails, but I don't think that at a theoretical level my question isn't ...
2
votes
1answer
431 views

Website: Pre-Shared-Key Authentication

We have this web-application with high valuable (business) data. All communication is encrypted through TLS/SSL. While i consider this a really safe protocol, it can stil be compromised if someone ...
4
votes
2answers
294 views

Login security without SSL

I have a web app without SSL (I know it's not good, I try to take it as a challenge). The login is two step. First the admin sshs into the server and runs a maintenance companion program that provides ...
3
votes
2answers
215 views

Risks for a new type of website login feature

What would be a security risk for a website feature that allows you to connect to your account without typing your password, given that you allowed such a login for the next say 10 seconds from a ...
2
votes
2answers
161 views

Dual Authorization (Social Auth 2.0)

Can you see any obvious challenges to requiring 2+ users to confirm authentication requests using an association such as a friendship type of relationship. A practical application would be an ...
3
votes
4answers
450 views

Is it safe to show user a message if account is locked

I am working on a web application, security is high priority. So, if a user has failed to login more than 3 times, the account will be locked. Should I display a message to the user saying "your ...
0
votes
3answers
349 views

Why do you need to login after you change a password?

I can't recall a website that after resetting my password I was automatically logged in, I had to type the password again - which seems quite silly. From a security perspective, why do websites do ...
0
votes
1answer
234 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
1
vote
0answers
110 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
3
votes
1answer
289 views

Why do major sites (eBay, Github) not ask for a password when I attempt to change email addresses?

When users change their email addresses within a web application's user account, I see the following problem: An attacker (who has access to your session) could change your email address to a new one ...
6
votes
3answers
240 views

Should password be cleared after unsuccessful logon attempt?

Lets assume following workflows a) On a device with keyboard: I type my username and password Press enter [realization] I made a typo Password field is cleared: not a big deal, I can type ...
1
vote
2answers
338 views

Asynchronous vs. Synchronous authentication process

I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database). I'm at the stage where I have to design the authentication and I had a question about ...
2
votes
1answer
164 views

Is it secure to use a URL to automatically authenticate to an OAuth-protected API?

I'm looking for a way to create a URL that allows a user to login to our application without providing a username and password. We have created an API which is protected using OAuth 2.0. I want to ...
2
votes
1answer
394 views

Authenticating users on offline devices such as ipad

We are wanting to authenticate the user inside a webapp (javascript/html inside browser) running on a tablet, but want to be able to do this when the device is offline from the network. I realise this ...
0
votes
2answers
138 views

How to allow only the public key owner to submit requests to my site? And what is this type of security called?

This was probably asked many times here, but I'm not finding any because I'm not sure what to look for. I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
2
votes
3answers
189 views

How good is validating source with request.referer than checksum?

I have 2 portals(both are under my control & domain names are different) In 1st portal, there is a link on click of which User can directly get logged into 2nd portal. Link which will be hit in ...
2
votes
4answers
2k views

Is it safe to allow users multiple login at different browsers & computers?

We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
8
votes
3answers
9k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
2
votes
1answer
180 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
1
vote
1answer
234 views

Basic Authentication with WebAPI and HTML/JS Client?

I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
6
votes
3answers
246 views

What is the value in asking for a second password for sensitive operations?

When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions? Does it provide any benefit over ...
10
votes
2answers
219 views

Preventing Voter Fraud on a Social Media Contest

I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
3
votes
1answer
307 views

Will using external OAuth providers for authentication protect users better than custom authentication?

On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
1
vote
3answers
2k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
1
vote
1answer
92 views

Java applet authenticity problem

I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
7
votes
1answer
1k views

What possible use does an iFrame have for security?

I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password. But just before the end </table> tag there's a blank iFrame which ...
0
votes
2answers
128 views

Senario:SSL Enabled Online Banking Application. Question: Should card numbers be provided back to a user un-masked, when there is a failed login?

For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login. Would this be a violation of PCI DSS 3.3 or not as the ...
11
votes
3answers
704 views

How much information about the reason for an unsuccessful login should a web application give?

After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
2
votes
4answers
355 views

When logging out of a website is anything else required then destroying the session?

In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out. session_start(); session_destroy(); Is there anything else that needs to be done? EDIT: I ...
3
votes
7answers
358 views

How to provide security for passwords stored in Database? [duplicate]

Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...