Tag Info

Hot answers tagged

145

From a raw security perspective, your password is simply "A B C", and the relative strength of the password is calculated accordingly. From a user perspective, this is arguably too difficult to be usable. The server isn't giving any indication as to the current state (is it looking for the second password yet?) and therefore the user can't tell which ...


140

The system outlined in the question is actually weaker than simply requiring a single password of length A+B+C, because it permits a class of attacks that can't be used against single passwords: Say your three-password combination is E F G. An attacker can send the passwords A B C D E F G, making five attacks (A B C, B C D, C D E, D E F, and E F G) for the ...


36

I'm going to address a few points here. First off, assuming that the attacker doesn't know the password scheme is a bad assumption, and you're correct that it's security through obscurity. If every user can learn this login scheme, then the attacker can too. Because of that, the knock is no better than if there was just a single password ABC. You might ...


27

How to uniquely identify users with the same external IP address? Is there any way to uniquely identify such users? Yes, there are lots of ways: Cookies Evercookies (nasty JavaScript code that uses lots of different techniques to store identifying information) Device fingerprinting: use the HTTP header (mainly User Agent, but the other headers and ...


20

Look at the authentication methods for unlocking phones. On my galaxy S4, there are: Swipe (no security) Face Unlock (low security) Face and Voice (low security) Pattern (medium security) PIN (medium to high) Password (high) From personal experience, the face unlock is kind of hard. You have to train it, and then you have to stick your face in the right ...


19

You can get users' internal IP address even from the Internet by using HTML5 & WebRTC. You can check out the article Local IP discovery with HTML5 WebRTC: Security and privacy risk? for more information and try it on http://net.ipcalf.com/.


19

It's security through obscurity -- if widely adopted, attackers will just try three times. At which point you might as well just have a single password but set a longer minimum password length to ensure it's as long as three separate passwords concatenated.


14

You don't mention what sort of service it's for, but as a user the least irritating auth method on phones for me is SSO. I'm already signed into Google & Facebook anyway, so typically it's just a case of pressing "Yes" and we're all done.


10

This is indistinguishable from your password simply being A || B || C.


8

Two-factor auth is more user-friendly yet more secure. Without, one password is still hardly less secure than password knocking. An attacker who can find your password is likely to find out about your knocking scheme as well. Choosing to knock is like choosing an algorithm. Consider it public. Though passwords are security by obscurity, they can be ...


6

If you have the user's mobile phone number (and if the user affirms during registration that this phone number can receive text messages), you can use this ability to enable 2-step authentication with SMS. Following successful authentication with a username and password, take one more step. Send the user a text message, by using the API to an SMS gateway ...


6

The concept of port knocking does not really apply directly to logging into websites. At least not in the sense that you have suggested. With port knocking, you connect to different ports in a certain order to open the desired port. In your example, you are putting all the passwords into one site. As others have pointed out, this isn't really any different ...


5

Positive It would fool standard brute-force attacks. Automated attacks from botnets or simple tools would not work out of the box. It might be possible to fool a keylogger this way. In the logs it would look like the user remembered the password on the third try. If the attacker uses this password it would not work. But only if he does not know or guess ...


5

Just a note: this methodology is already used in password-recovery schemes in some parts of the industry. If you forget your password, you can use your e-mail address to initiate a sequence of personal questions to recover your password (though many times it is just one question). It is made more palatable to the user, by usually limiting the context to a ...


5

PROS: This system does share some benefits with two-factor authentication. 1) Most browsers and password saving systems do not support it, so will remember only one of the passwords at most. So it at least won't be stored in plaintext somewhere. 2) People who use the same password everywhere will have to use at least two passwords which are not shared with ...


4

There isn't a non-spoofable method to my knowledge. If you already throttle the max amount of attempts to eight tries per minute with a one minute time-out. A one minute time out is generally not considered annoying as long as you give enough information to the user. Make sure to actively review these occurences where there are suspected bruteforces from an ...


4

Your best bet might be to use the standard methods as mentioned in Ohnana's answer along a strong second-factor authentication using U2F. Yubico's YubiKey NEO allows secure TLS-channel second-factor authentication, even over NFC, if I remember the spec correctly. You're using a hardware security module, so this, combined with a strong inconvenient password ...


4

Your developer is trying to mix three different process into one: password registration, email validation and robot detection. Unfortunately, that makes the whole setup less secure and less resilient than it should be. Email is clear text and, nowadays, it pretty much guarantee to live forever and be included into several indexes and often kept for a long ...


4

I assume you mean Message Authentication Code. The major difference between a MAC and a hash function is that the MAC also takes a secret key as input. Therefore the MAC provides both integrity and authenticity for the message. Example how it is used: Both Alice and Bob know the secret key k. Alice wants to send an arbitrary long message m. She ...


3

You could utilize some form of near field communication. For example, write some tags that unlock the phone when the tag is tapped to the back. Another good thing to check out is Yubikey: https://www.yubico.com/products/yubikey-hardware/yubikey-2/


3

This falls under the area of Adaptive Authentication, although that term covers the whole package - deciding who you are based on multiple factors, and getting more reassurance using multiple resources, including pushing out cookies to act as a factor in future authentications. A couple of well known examples are: RSA Adaptive Authentication OpenAM / ...


3

The second version of the website escapes single quotes to two single quotes. Is there a way I can log in as the user hello_world? Yes, because this kind of protection is not secure at all (I also would not call it escaping). Attack Imagine an attack like this: Username: hello_world Password: \' OR 1=1 # Which would be transformed to: ...


3

I don't know of a packaged solution to do this. I expect it would be quite tricky to do, as you need a two-step request/approve system, and there is nothing like that in standard Linux systems. One possibility is to use an out-of-band two-man system. For example, the reboot command could require an additional password. One half of the admins know that ...


3

As others have stated, this is equivalent to just having a password that's equivalent to A\nB\nC or the like. However, there is one advantage I can think of to this scheme: it helps to reduce phishing-type things; if a system accepts the first password in lieu of accepting the others, then you know that the system is compromised and simply logging your ...


3

Computing entropy for a randomly chosen password can be broken down to a simple rule that can be used in virtually all cases, with some caveats. It's the log2() of the password character set space raised to the power of the password length. So, with a completely random password where all characters are independent, this is an easy calculation. E.G., For a ...


2

Since you want to change the user information, you presumably already have a db with (email, first name, last name) so I would add the token there too (plus an expiration time). If you would use it in a stateless way (eg. just to confirm subscription), that's an acceptable approach, but you should be using a HMAC rather than a hash of concatenated values.


2

I know that people often suggest slow functions like - PBKDF2, Scrypt etc.. Listen to them. Use scrypt, bcrypt or PBKDF2. These functions are designed for hashing password. See How to securely hash passwords? for details. This is the recommended approach to hashing passwords. but is using HMACSHA256 safe too? It's fast => brute-force is cheaper => ...


2

Gmail requires CAPTCHA solving when it detects suspicious behavior for an account, even if the requests originate from several IPs. There is always a balance to be set between user experience and user security. If a celebrity uses Gmail, she'd rather enter a CAPTCHA each time than having her emails publicly disclosed. Moreover, even if not yet "default on", ...


2

You should have a look at https://github.com/flix-/pam_openssh_x509. Its a collection of PAM modules for OpenSSH. What they do is obtaining a x509 certificate from an LDAP server on every login, validate it (trusted? not expired?) and synchronizes the public key to the appropriate authorized_keys file on the server. Besides access permissions for OpenSSH can ...


2

As per my understanding of your needs, use SSL/TLS with mutual authentication (ie. client cert): It will guaranty both ends identity, Protect the communication confidentiality and integrity, It is a well known standard, largely available allowing quick implementation.



Only top voted, non community-wiki answers of a minimum length are eligible