New answers tagged

0

Try http://www.icanprove.de. You can remote control a browser and all screenshots and logs are signed digitally. If more is at stake contact a notary...


1

Google Authenticator uses the Time-based One-time Password Algorithm ("TOTP"), which works by computing HMAC with a secret key over a timestamp. HMAC is a message authentication code ("MAC"). The standard security requirement for a MAC is that it be able to resist existential forgery (an attacker who doesn't know the key should not be able to forge any (...


2

No. Thats the whole point of TOTP/HOTP. That it should be infeasible, given any sequence of valid codes, to generate future codes or recreate the seed. The reason is that the TOTP/HOTP algoritm, use HMAC-SHA1 as hash, given the "challenge" (either current UNIX time or a counter of usages) and the secret "seed" as key. The resulting hash output is then ...


0

Enigform uses this kind of approach, but I don think it currently works, as I have not updated in some time. There is a server-side component (for Apache, but mod_proxy helps extend this for non apache backend servers). There is a proof of concept wordpress authentication plugin... https://wordpress.org/plugins/wp-enigform-authentication/


0

First off: Open System Authentication is the default authentication protocol for the 802.11 standard. It consists of a simple authentication request containing the station ID and an authentication response containing success or failure data. Upon successful authentication, both stations are considered mutually authenticated - From Here WEP has two ...


0

Many answers already indicate that often forcing users to change their passwords isn't useful; I would like to add the opinion of Bruce Schneier, probably the most famous security expert. Basically he says that it depends on what that password is protecting, and how a stolen password can be used. This sounds obvious, but it is not obvious at all that ...


0

If the secret files and PHP application is on SAME server: Put them outside of the "web home". Eg, normally you have a directory like: /public_html/cgi-bin/file.php that maps to: http://www.example.org/cgi-bin/file.php What you then, do, is to put these files above the public_html folder, like: /somesecretdb.db The file /public_html/cgi-bin/file.php can ...


6

You already stated, that this is overkill. I suspect you will anoy the user. All your factors are knowledge factores. Drawing a line in a grid. Identifing the numbers according to the known line. Answering know facts about me. So as far as I understand you are combining several different kind of knowledges. But the idea about two factor or multi factor ...


3

Considering that mind-reading technology is still far from being able to read passwords from your mind, this question is largely hypothetical. But when "something you know" is unsuitable as an authentication factor, there are two others you can use: Something you are, also known as biometry (fingerprint, iris scan, DNA sample...). These come with their ...


1

A Yubikey is specially made for this. It's a kind of two-factor authentication USB-stick which generates and syncs pseudo-random passwords after a given amount of time. That way, even you don't need to know your 'second Yubikey-password' and don't even need to think about it.


1

I don't see any reasons why they can't work together, especially when they are different things? EAP -- Extensible Authentication Protocol. It is just a PROTOCOL which is used by 802.1x authentication server (RADIUS, for example) and client to authenticate each other. RADIUS -- Remote Authentication Dial-In User Service. It is SERVICE which use one or more ...


2

The simplest way to solve this would be with some form of second factor authentication. A method for making that immune to subpoena isn't immediately obvious. While telepathy is rather unlikely, as I understand current technology, hypnosis or other methods could be used to "pick someone's brain". So the scenario described isn't entirely ridiculous.


2

I suppose I'll indulge this. One solution to something like this would be to have a multi part key like bitcoins so-called "multisig keys" held in different legal jurisdictions.


2

Would a password combination of images be stronger for users login regarding keyloggers? Yes, it would be stronger... a little bit. That is not saying much. A keylogger will catch only the keystrokes and not the selected user images, right? If you want to be technical, a keylogger logs keys. In the real world, many "keyloggers" also log things other ...


0

Hopefully this helps. Identity Management Systems Identity Management System are often defined by trusted sources. These are the systems we rely on for a source of record for an individual. They are not really a single piece buy a combination of systems design to manage people. Identity Data Trusted Source This is data of people, typically found in your ...


11

Once the system is infected with malware it is compromised. Anything that is done on that system can be observed so there is no way to allow someone to log in securely from that system just using that system. Period. End of Story. You might come up with some oddball scheme for something the user has to do as part of the login process that the malware doesn'...


0

Your firewall is just working. Nothing to complain about. It's allowing only that IP, the others are getting blocked and logged so that you know someone else is trying to reach your RDP.


29

Nope. Keyloggers can often also do screen-capturing and mouse-coordinate-logging. So the attacker can still see what image the user selects. Another kind of two-factor authentication for which the user needs two devices (e.g. laptop and phone) would be more secure. Another good alternative is a Yubikey. A kind of device which generates a pseudo-random ...


1

In short: client_id and client_secret are used for to authenticate the APP. username and password are used for to authenticate the user. It also means double layer protection. The specification says: the client MUST authenticate with the authorization server as described in Section 3.2.1. A client authentication is done by using a client_id and a ...


0

You rely on OAuth providers to have users share their identity with you. If you want apps to read info from the users from your database, you effectively have to become an OAuth provider yourself. Your apps should only deal with you and your user identities, not any third party providers that your book club uses. How this would look if a user signs up and ...


1

Forms-based authentication over proper, validated TLS is the modern way forward for web application authentication that require non-SSO (Single Sign On) capabilities (e.g., SAML, OpenID, OAuth2, FIDO, et al). NTLM authentication is only utilized in legacy networks. Microsoft no longer turns it on by default since IIS 7. Microsoft Domains and/or Forests with ...


6

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of lateral escalation. If an attacker takes control of one server, they can remain silently present, sniffing passwords. These passwords can then be used to compromise ...


1

JWT is a reasonable way to do this, as is OpenID or OAuth (With OAuth, what you are doing is creating a provider that will verify the userid). Try to use standard libraries as much as possible - it is really easy to get Tokens wrong (enabling replay attacks and similar). As well, all communications should be encrypted (TLS).


0

The primary benefit of Kerberos is to enable account change and password change to synchronize immediately. I have solutions on hand for centralized administration of distributed accounts, and client-side password agents that respond to 99% of password prompts after login, but all of them assume that user changes password is rare and that we can wait until ...


0

Out in the wild we have a users table. A users table is usually ID | username | salt | encrypted_password | horridly_insecure_reset_key =========================================================================== 1 | user1 | foo | 09b6d39aa22fcb8698687e1af09a3af9 | NULL 2 | user2 | bar | 6c07c60f4b02c644ea1037575eb40005 | ...


0

As Tom has pointed out, the only obvious risk is that the credentials are persisted on the client when you use local storage. Your description of the application has confused me somewhat. I presume you mean this actually runs on the browser, is served from a local webserver, but calls an ajax service on a remote system. If so, why not just store the ...


0

At the end of the day, if the computer is owned by a single user AND is inside a secure network, it shouldn't be too terrible storing it as plain text. Of course, problems might arise if the user leaves his computer unattended - But since the API you're using doesn't return session keys (which is really odd...) there's no real better solution. Additional ...


35

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine you have 50 users and 50 servers. For the sake of simplicity, suppose that all 50 users are supposed to have access to all 50 servers, they all have the same ...


11

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes Basically, instead of just passing a magic token around (ie. your password), you obtain a "ticket", which is signed by a trusted source of truth (ie. Kerberos KDC, ...


26

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's say that this didn't exist in a simple network. User enters password to unlock their computer. User wants to map a network drive. They must now need to re-...


0

By putting the token in the cookie and setting that cookie HttpOnly, you can prevent access to the cookie by malicious client side script (ie, XSS) - there is no access to an HttpOnly cookie from JavaScript, the browser will protect it and handle sending the cookie only to the right origin. https://www.owasp.org/index.php/HttpOnly


0

Ok, let's start by understanding what's JWT (quoted from their website): JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties. JWT.IO allows you to decode, verify and generate JWT. The goal of JWT isn't to hide data, but to prove your identity to the server. Anyone can decode the ...


1

No because the browser dont change anything in the request when sending it over https (It will only encrypt it additionally). An attack with e.g. XSS will work exactly like it would work with http. https only prevents from another type of attacks like man in the middle reading the session.


1

Fundamentally, this sort of authentication is only as strong as the email account the user is using. However, the same criticism can be levied at any relegated authentication model - OpenID or OAUTH included. However, I think that this is still well worth it - by leveraging existing services that users value, it means that they are not tempted to use throw-...


0

Migrated comment to an answer as it should steer you down the correct path. First Determine Failure Type Are these Kerberos Pre-auth failures (Event ID: 4771) OR Actual login attempt failures (Event ID: 4776)? Then ID the Specific Failure Reason View the alert and ID the hex code that explains the failure. Then look it up here: 4771 ...


4

If you are uncertain whether your account has been hacked, you should immediately reset the password. If your account was hacked, some damage may have already been done, but setting a new password will prevent any further damage. However, some sites allow you to create an account without first verifying your email address. This should not be alarming, and ...


0

If you are getting mails from websites which you haven't signed up for, there is a risk that your account has been hacked. Things you can do if you suspect that your account was hacked: Immediately change your password. Unsubscribe accounts by using third party services like mailstorm and unroll. Use people search sites like pipl and spokeo to search your ...


0

your question title is different to the question in your post. is it secure to get the token via JavaScript from the server - this depends on the server side validation method in place. assuming these are OK manipulating the token in JavaScript and then sending to a web socket should be fine as long as server side validation is good.


1

Simple Terms OpenID is about verifying a person's identity. OAuth is about accessing a person's stuff. OpenID Connect does both. All three let a person give their username/password (or other credential) to a trusted authority instead of to a less trusted app. More Details To understand something, look at its history. OpenID & OAuth have ...


0

HTTPS only is a must. Apple's recent App Transport Security also enforces this and TLS1.2>. As you control both the app and the api, I would implement Certificate Pinning. Certificate Pinning can be defeated but it is a solid deterrent against the casual inspector. You can add another layer with Payload Encryption. That comes at the cost of making sure ...


1

What does salting give you? Attackers have pre-calculated databases of hash values for passwords, common and not. If they capture your database and have the hash of the passwords for every user, it's simple to check their hashes against those values without a salt. With a random salt that is stored along with the password, this insanely quick method is no ...


0

According to this article on Wired, it is. https://www.wired.com/2016/06/hey-stop-using-texts-two-factor-authentication/ The attack: "... The hackers, as he tells it, had called up Verizon, impersonated him, and convinced the company to redirect his text messages to a different SIM card, intercepting his one-time login codes."


2

If you're sure that you don't want to get your site indexed on this perticular Search Engine, then you can block the Crawler by modifying .htaccess file. In .htaccess file you need to match the bot with the specific User Agent and respond with a custom response. This can be done with Apache RewriteEngine(similar functionalities would be available for other ...


1

If I didn't misunderstood, you mean the URL of asd.com. The visit is made by a crawler/robot of a search engine. The string starting with Mozilla and including the URL is the User Agent provided by its HTTP request. It tells the server of your website what kind of client it is, and the URL tells you which search engine does it belong. They simply fetch the ...


0

There seems to be some merit in the idea of not storing some controlled number of bits of the salt, which is independently configured and is independent of the salt size. Suppose we have 32 bit salts. We could choose to store only 22 bits, and brute-force through the remaining 10 when we authenticate. The effect of this is as if more rounds were added to ...


3

You could use the salt in this way. It would be a sort of hash-stretching process. Typically you stretch a hash by repeating the algorithm several thousand times, which slows attackers and users by 1000fold, but users typically don't mind the slowdown. Using a salt in this way would have the effect of doing a hash stretching algorithm by having to repeat ...


2

Rather than thinking of salt in terms of brute-forcing, I like to think of it in terms of saying that it makes it impossible to tell anything about a password, including its relationship with other passwords, by looking at it. If the system uses no salting, looking at two users' hashed passwords would indicate whether their real passwords matched. If a ...


121

A 'secret' salt is known as a pepper. From Wikipedia: A pepper can be added to a password in addition to a salt value. A pepper performs a similar role to a salt, however whereas a salt is commonly stored alongside the value being hashed, for something to be defined as a pepper, it should meet one of the following criteria that define it a more ...


20

Background: You should be using a Slow Password Hash. (i.e. bcrypt) By 'slow' I mean computationally expensive, taking more than 100ms (on your hardware) with DoS protection * to test a single password. This is to increase the processing power needed (on attacker hardware) to find the password by brute force, should the hash be stolen. Per-user unique salt ...


16

Your professor isn't correct. The point of a salt is to increase the entropy of the hashed passwords to prevent any sort of pre-computation attack on them as well as preventing the same password from different users from having the same hashed value. Being able to try all possible salt values means that you must have a very LOW amount of entropy in the ...



Top 50 recent answers are included