Hot answers tagged authentication
163
This combination is called a Secure attention key. The Windows kernel is "wired" to notify Winlogon and nobody else about this combination. In this way, when you press Ctrl+Alt+Del, you can be sure † that you're typing your password in the real login form and not some other fake process trying to steal your password. For example, an application which looks ...
61
Ctrl-Alt-Del is the Secure Attention Key on Windows. The operating system enforces a strong non-interception policy for this key combination.
You could make an application which goes full-screen, grabs the keyboard, and displays something which looks like the normal login screen, down to the last pixel. You then log on the machine, launch the application, ...
27
The answer to this can actually be found on our sister site, ServerFault. How does CTRL-ALT-DEL to log in make Windows more secure?
To quote the accepted answer by Oskar Duveborn,
The Windows (NT) kernel is designed to reserve the notification of this key combination to a single process: Winlogon. So, as long as the Windows installation itself is ...
21
Google Authenticator supports both the HOTP and TOTP algorithms for generating one-time passwords.
With HOTP, the server and client share a secret value and a counter, which are used to compute a one time password independently on both sides. Whenever a password is generated and used, the counter is incremented on both sides, allowing the server and client ...
14
You've come to the right place. Welcome to IT security!
is there any sql injection for this code?
Yes
if there is what is that Entry?
username: [any username from your website]" /*
password: sux0r")*/ OR ("1"="1
It will run this query:
SELECT * FROM `config`
WHERE `config_admin_username`="[any username from your website]" /*
AND ...
14
Quoted from OWASP's CSRF Prevention page:
Double Submit Cookies
Double submitting cookies is defined as sending the session ID cookie in two different ways for every form request. First as a traditional header value, and again as a hidden form value. When a user visits a site, the site should generate a (cryptographically strong) pseudorandom value ...
12
The question (to most people) is an oxymoron. By definition, people will think that "open WiFi" means "un-encrypted WiFi. To me you seem to be asking "Why did the people that wrote the 802.11 standard way back in 1997 make the decisions that they did?"
The short answer - we can only find out by asking them (or seeing if there are any discussion documents ...
10
Some additional questions have been raised regarding Windows 8 SAS support, and a later deleted by owner separate question was posted about it, too. Since I've already started writing my answer to that question, and Windows 8 has also been mentioned in this thread, I'm thus posting it here. If that deleted question reappears, I'll move my answer there. ...
10
Firesheep has nothing to do with the WiFi encryption. If you and I were both on an encrypted WiFi connection, I would still be able to Firesheep your data.
What Firesheep does happens at the router level. It does not intercept the waves on air (well, not exactly)
Basically, it runs an ARP spoofing attack. This sort of attack can be run on a LAN network as ...
10
No because you should never allow scripts to be able to access your cookies. Refer to HTTPOnly on the OWASP website.
To prevent people from being able to steal session id's, should XSS be present, you should always set this cookie flag. Your mechanism would not work anymore as it would not be able to access the cookie.
8
There is a handy script distributed alongside openssl, CA.sh to do most of this stuff. Its location is distribution specific. In Debian and derivatives you can locate it using:
# apt-file search CA.sh
openssl: /usr/lib/ssl/misc/CA.sh
And RedHat and derivatives the (approximate) equivalent is:
# yum provides */CA
1:openssl-1.0.1e-4.fc18.x86_64 : Utilities ...
6
TildalWave has a great answer, but there is a great mediation to SQL injection that was missing from the answer. Prepared Statements. As Tildal said the entire statement with user input is parsed with no parsable distinction between variables and constant parts of the statement. The solution is sending the constant part of the statement with variable ...
5
Security questions are bad, security questions which ask for your name and place where you live are even worse. The fact that you can use either answer for one question isn't a bug, it's poor coding.
Passwords resets by using security questions are bad if they aren't used in combination with something else. For instance, if they ask you questions, but stuff ...
5
Yeah, what you describe looks like a bug. Regardless of the alleged security value of "security questions", or lack thereof, there is no way that "John" can be considered as a valid response to "Where do you live". It is even more than a bug: it is a vulnerability (an even bigger than merely using "security questions" in the first place). Indeed, in your ...
5
CAPTCHA systems are in no way a replacement for a good password policy. They aren't tackling the same problems.
CAPTCHA systems only help when someone is attempting an online attack against your system. If your application has some hole that allows an attacker to dump a database full of password hashes, placing a CAPTCHA on every page won't do anything.
...
5
Bypassing the activation key checker on any software usually isn't a problem. It's a relatively simple task of reverse engineering the binary and making the necessary modifications.
Can a cracked antivirus perform it's job? Yes, most definitely. The problem is that you have no idea what other modifications have been made to the binary in the process of ...
5
CRAM-MD5 requires that the server knows the actual password, not just some image of the password by a hash function. So if the server has to support HMAC-MD5, it has to store the password in plaintext. (The server can encrypt the password, but since it also has to know the encryption key, that doesn't help.)
CRAM-MD5 was designed to avoid having the ...
4
The idea is that a trusted Windows process called Winlogon, and only Winlogon, can read the Ctrl+Alt+Del key sequence. This key sequence is called the secure attention sequence (SAS). By entering this key sequence, you are basically "proving" to yourself that it is Windows that is accepting your input. This guards against a malicious program intercepting ...
4
Ultimately, authentication of this kind is very hard when the person being authenticated is the attacker. If there are reliable government records, requiring these be presented (if allowed) is probably a good start.
Proper training of security staff is also critical to ensure that they perform a thorough check regardless of the possibility of conflict. ...
4
The other answers have already explained that Firesheep-style attacks (basically MitM trhough ARP spoofing) have nothing to do with WiFi itself. This is a link-layer issue.
As for why open WiFi networks don't have encryption. Well, they just don't. I don't really know why they decided not to, I can only speculate. One very obvious reason is MitM attacks, as ...
4
An interesting question and I don't think there's one good answer to it. I'd say you could address this by a combination of measures. essentially no one measure can stop the fraud but using a combination you should be able to reduce the incidence of fraud to a potentially acceptable level
Request proof of identity and address. The standard for this in ...
3
There is a good reason for preventing concurrent connections - if they are not needed by your users.
A good rule of thumb is to not allow more functionality than that which is needed. If your users are never going to connect more than one simultaneous session, disallowing it would reduce the risk of attack (as an attacker would not be able to conduct their ...
3
I must admit I find your question and the security measures you're describing rather disturbing, to say the least. Parts of it literally screamed welcome to Orwellian Dystropia directly into my inner ears. In stereo, no less - the previous, and the newly proposed version both at the same time, like some off-key punctus contra punctum.
The levels of identity ...
3
Two factor authentication with Biometrics will definitely do the job but I would like to point out some issues with this technology.
It is costly. This includes the cost of the devices and the manpower required to develop the system handle the registrations.
There is no single standard to store the biometric data that the world follows. Different devices ...
3
Having a CSRF token in the body of the page is a standard way of preventing CSRF attacks. The token is different for every form that's presented by the application. so when a form is submitted the submission can be checked for the validity of the token.
If an attacker takes a token from a page that he sees essentially that token won't be of use to him as ...
3
There's no right or wrong answer to this, it all depends on what information you have to protect. If you are storing people's personal information or sensitive intellectual property on your intranet then using facebook logins are a bad idea because FB has no interest in security. FB does not enforce strong passwords. They allow very simple passwords and ...
3
This is very VERY much rolling your own and is not a good idea. Why is the existing standard of using a hash of an encryption of a timestamp derived value sufficient for your needs? The first attack that comes to mind is simply masquerading as the server to obtain codes from the card. The victim wouldn't have a good way to know it wasn't the server and ...
3
I'm willing to bet that they don't actually identify the computer, they just send you a persistent cookie once you've successfully logged in, and as long as your browser returns that cookie, they know it's a previously used machine.
You should be able to test this quite easily using something like Firefox's Web Developer toolbar which will let you both ...
3
The scenario that this is designed to prevent is keylogging. It is fairly easy to get a keylogger that will report back but somewhat more complex to make a program that will actually execute an attack remotely on another computer. Since you don't regularly enter your security question answers, if an attacker obtains your password via a key logger, they ...
3
The threat is when the MITM owns the login screen.
If, for instance you click a link in an email that purports to be a link for https://yourbank.example but is actually a link to http://yourbank.evilbob.example, and enter the username and password you use for your bank website, Evil Bob merely needs to forward those on.
Then, https://yourbank.example ...
Only top voted, non community-wiki answers of a minimum length are eligible
