Hot answers tagged

35

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine you have 50 users and 50 servers. For the sake of simplicity, suppose that all 50 users are supposed to have access to all 50 servers, they all have the same ...


27

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects. Another kind of two-factor authentication for which the user needs two devices (e.g. laptop and phone) would be more secure. Another good alternative is a Yubikey. A kind of device which generates a pseudo-random ...


26

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's say that this didn't exist in a simple network. User enters password to unlock their computer. User wants to map a network drive. They must now need to re-...


11

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes Basically, instead of just passing a magic token around (ie. your password), you obtain a "ticket", which is signed by a trusted source of truth (ie. Kerberos KDC, ...


9

Once the system is infected with malware it is compromised. Anything that is done on that system can be observed so there is no way to allow someone to log in securely from that system just using that system. Period. End of Story. You might come up with some oddball scheme for something the user has to do as part of the login process that the malware doesn'...


6

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of lateral escalation. If an attacker takes control of one server, they can remain silently present, sniffing passwords. These passwords can then be used to compromise ...


5

You already stated, that this is overkill. I suspect you will anoy the user. All your factors are knowledge factores. Drawing a line in a grid. Identifing the numbers according to the known line. Answering know facts about me. So as far as I understand you are combining several different kind of knowledges. But the idea about two factor or multi factor ...


3

Considering that mind-reading technology is still far from being able to read passwords from your mind, this question is largely hypothetical. But when "something you know" is unsuitable as an authentication factor, there are two others you can use: Something you are, also known as biometry (fingerprint, iris scan, DNA sample...). These come with their ...


2

Would a password combination of images be stronger for users login regarding keyloggers? Yes, it would be stronger... a little bit. That is not saying much. A keylogger will catch only the keystrokes and not the selected user images, right? If you want to be technical, a keylogger logs keys. In the real world, many "keyloggers" also log things other ...


2

The simplest way to solve this would be with some form of second factor authentication. A method for making that immune to subpoena isn't immediately obvious. While telepathy is rather unlikely, as I understand current technology, hypnosis or other methods could be used to "pick someone's brain". So the scenario described isn't entirely ridiculous.


1

I don't see any reasons why they can't work together, especially when they are different things? EAP -- Extensible Authentication Protocol. It is just a PROTOCOL which is used by 802.1x authentication server (RADIUS, for example) and client to authenticate each other. RADIUS -- Remote Authentication Dial-In User Service. It is SERVICE which use one or more ...


1

A Yubikey is specially made for this. It's a kind of two-factor authentication USB-stick which generates and syncs pseudo-random passwords after a given amount of time. That way, even you don't need to know your 'second Yubikey-password' and don't even need to think about it.


1

I suppose I'll indulge this. One solution to something like this would be to have a multi part key like bitcoins so-called "multisig keys" held in different legal jurisdictions.


1

JWT is a reasonable way to do this, as is OpenID or OAuth (With OAuth, what you are doing is creating a provider that will verify the userid). Try to use standard libraries as much as possible - it is really easy to get Tokens wrong (enabling replay attacks and similar). As well, all communications should be encrypted (TLS).


1

No because the browser dont change anything in the request when sending it over https (It will only encrypt it additionally). An attack with e.g. XSS will work exactly like it would work with http. https only prevents from another type of attacks like man in the middle reading the session.


1

Forms-based authentication over proper, validated TLS is the modern way forward for web application authentication that require non-SSO (Single Sign On) capabilities (e.g., SAML, OpenID, OAuth2, FIDO, et al). NTLM authentication is only utilized in legacy networks. Microsoft no longer turns it on by default since IIS 7. Microsoft Domains and/or Forests with ...


1

In short: client_id and client_secret are used for to authenticate the APP. username and password are used for to authenticate the user. It also means double layer protection. The specification says: the client MUST authenticate with the authorization server as described in Section 3.2.1. A client authentication is done by using a client_id and a ...



Only top voted, non community-wiki answers of a minimum length are eligible