New answers tagged authentication
1
The problem is with the phrase identity itself.
Technically Possible with History
There is no way to do this without using some sort of biometric verification. Retina scans would in theory be the only way (since you would not be able to replace an eye [2010]). If you were to do something like blood tests, even then in the case of twins they would carry the ...
1
Fraud prevention has always been a problem for Identity Management systems. Of course there is no silver bullet for this problem but I would like to suggest a few ideas.
The registrations to your service may involve some kind of physical verification of the user before he can really use the service. The idea is not to depend entirely on technology for user ...
4
An interesting question and I don't think there's one good answer to it. I'd say you could address this by a combination of measures. essentially no one measure can stop the fraud but using a combination you should be able to reduce the incidence of fraud to a potentially acceptable level
Request proof of identity and address. The standard for this in ...
-1
Looks like the simple solution (i.e., CSRF protection but with all-cacheable web resources) is to just add a separate cookie containing the anti-CSRF token but accessible to page javascript.
In other words, when the client logs in, I'll actually set two cookies (one HttpOnly sessionid and one non-HttpOnly anti-CSRF token, accessed by page scripts). So, the ...
3
For the level of security that your service sounds like it requires, I'd say that this sounds like a reasonable solution.
The risks are that someone will intercept a link and get access to the customers information, so you should make sure that access to the status page is encrypted via SSL.
For the timeout you could either go with the approach that you've ...
3
The idea itself is fine, your users are performing non-critical actions using a special URL. However, there are two things that could go wrong here:
Your identifier is SUBSTRING(PASSWORD(UUID()), 2), the problem is that UUID() isn't very reliable to generate unpredictable and unguessable identifiers.
WARNING: Although UUID() values are intended to be ...
5
CRAM-MD5 requires that the server knows the actual password, not just some image of the password by a hash function. So if the server has to support HMAC-MD5, it has to store the password in plaintext. (The server can encrypt the password, but since it also has to know the encryption key, that doesn't help.)
CRAM-MD5 was designed to avoid having the ...
2
There are three relevant weaknesses in this case:
Improper password storage: If your provider's database is compromised, your password is directly exposed. Although some implementations of CRAM-MD5 don't store passwords in plaintext, the hashed password is still unstaled. So far there's no known implementation that salts the password (the salt needs to be ...
3
Firstly, it's not necessary to use plaintext:
Looking at the HMAC-MD5 implementation in psuedocode:
you can at least store a modified version of the password:
if (length(key) > blocksize) then
key = hash(key) // keys longer than blocksize are shortened
end if
if (length(key) < blocksize) then
key = key ∥ [0x00 * ...
2
It gives no protection against MITM since an attacker could forward the challenge to the client. Requiring plaintext password storage is bad and the exchange can have have a dictionary attack run against it.
You are justified in being worried about this scheme and I'd personally suggest using a different e-mail provider.
1
First off, the plaintext bit is bullshit - most POP/SMTP *nix solutions can be retrofitted to not need this. With this out of the way...
...CRAM-MD5 has shocking vulnerabilities - coming from its MD5 tie. However, it's still better than plaintext. In order of appearance and "OMGWTFBBQ-ness":
A server using CRAM-MD5 can be spoofed/MitM-ed as the client ...
2
The client won't send a certificate unless the server asks for it with a Certificate Request message (see the standard, section 7.4.4). If the server does not ask for a certificate, the sending of a Certificate and a CertificateVerify message from the client is likely to imply an immediate termination from the server (with an unexpected_message alert). The ...
2
Does anybody know if it is possible to perform an authentication via
client cert if the server does not request it?
No. If a client certificate is not been requested by the server and the client attempts to send it anyway it's very likely that the server will simply abort the connection attempt since it doesn't match the expected reply.
And if it ...
0
I suspect the answer has to do with the "statelessness" of the WIFI router. Incoming and outgoing packets are treated uniformly. If some sort of encryption were negotiated on a per-connection basis, the router would have to maintain state for each communicating partner.
This would break the "layer" model; that packets are treated uniformly and higher ...
0
As mentioned by a number people - double submit is an ok CSRF protection, provided that you use a separate nonce. Using session id is very wrong in this context, starting with the fact that sessionid has to be HTTPOnly for XSS protection.
An argument of "what if there is XSS on this page/website" is not valid - when you have XSS, CSRF is the least of your ...
2
You're correct that they are not the same problem: Password authentication and symmetric encryption are fully independent concepts that can each be implemented without the other. However, a password is one of several ways to produce the key necessary to operate the encryption.
An encrypted connection such as that between your computer and your AP is ...
1
You could, but it seems a bit unwieldy to me. Any CSRF-prevention mechanism works like this:
Make the server only accept requests that satisfy some conditions
Ensure that the conditions are something that can't be forged
Write your HTML so that the requests it generates follow the conditions set by the server.
The tried-and-tested method is to use ...
14
Quoted from OWASP's CSRF Prevention page:
Double Submit Cookies
Double submitting cookies is defined as sending the session ID cookie in two different ways for every form request. First as a traditional header value, and again as a hidden form value. When a user visits a site, the site should generate a (cryptographically strong) pseudorandom value ...
10
No because you should never allow scripts to be able to access your cookies. Refer to HTTPOnly on the OWASP website.
To prevent people from being able to steal session id's, should XSS be present, you should always set this cookie flag. Your mechanism would not work anymore as it would not be able to access the cookie.
4
The other answers have already explained that Firesheep-style attacks (basically MitM trhough ARP spoofing) have nothing to do with WiFi itself. This is a link-layer issue.
As for why open WiFi networks don't have encryption. Well, they just don't. I don't really know why they decided not to, I can only speculate. One very obvious reason is MitM attacks, as ...
2
When you are talking about "no password" and "same password," I imagine you are referring to the pre-shared key. This is not actually a password, but used as a known value by the station and AP to generate and securely (at least from outside sources without the known value) exchange keying material for the encrypted traffic. WPA/WPA2-Personal do not ...
10
Firesheep has nothing to do with the WiFi encryption. If you and I were both on an encrypted WiFi connection, I would still be able to Firesheep your data.
What Firesheep does happens at the router level. It does not intercept the waves on air (well, not exactly)
Basically, it runs an ARP spoofing attack. This sort of attack can be run on a LAN network as ...
12
The question (to most people) is an oxymoron. By definition, people will think that "open WiFi" means "un-encrypted WiFi. To me you seem to be asking "Why did the people that wrote the 802.11 standard way back in 1997 make the decisions that they did?"
The short answer - we can only find out by asking them (or seeing if there are any discussion documents ...
5
Bypassing the activation key checker on any software usually isn't a problem. It's a relatively simple task of reverse engineering the binary and making the necessary modifications.
Can a cracked antivirus perform it's job? Yes, most definitely. The problem is that you have no idea what other modifications have been made to the binary in the process of ...
2
If I don't know you beforehand, then what sense can it have, for me, to be fairly sure that I communicate with the real you ? For all I know, I cannot be sure that you exist at all, and your existence will remain irrelevant to me as long as you do not interact with me.
That's the main, big, blatant failure of PGP's Web of Trust: it tries to ensure strong ...
3
In the end, you can sign whoever you want to. There's nobody to control you and nothing to check what you're doing (and how you're doing it).
I would consider signing a well-known (to me) person's key valid, if I can be sure I'm receiving his key untampered over a secure channel. If you're totally sure to be able to recognize his voice or make some other ...
0
There's a big difference in trusting a person and knowing that some item comes from that trusted person. You're describing your trust in the user the key is supposed to belong to, but the PGP question inquires about the latter - how sure are you that the key you're about to sign really belongs to that person it says it does. This is the question you have to ...
0
If you maintain a Web site in which users can sign up and protect their account with a password, then you should edict a policy of minimal password length -- and, please, nothing else. Stricter rules, more often than not, backfire. For proper security, you need to enlist user cooperation, which will exist only on a voluntary basis. The more you enforce, the ...
0
No. You should use federated logon and avoid the entire problem. Select an identity provider who matches or exceeds the risk level of the information you're protecting. Let them worry about passwords.
5
CAPTCHA systems are in no way a replacement for a good password policy. They aren't tackling the same problems.
CAPTCHA systems only help when someone is attempting an online attack against your system. If your application has some hole that allows an attacker to dump a database full of password hashes, placing a CAPTCHA on every page won't do anything.
...
0
Captchas can be cracked using automated tools. Complex passwords make it harder for attackers to brute-force password attempts and helps to reduce the number of 'common' passwords.
Password policies should be in place for web sites, no question. Work with your users to determine a policy that makes sense.
Sometimes a super-secure password policy can give ...
1
I would think that you should enforce some level of password requirements. If your password hashes get compromised and some unfortunate soul used password123 as his password, his account could be compromised very quickly even if the passwords are hashed and salted. A human attacker with the plaintext password and the username could easily just fill in the ...
0
Out of band authentication relies on the added difficulty an attacker faces when trying to simultaneously eavesdrop on two communications. This difficulty arises due to the two channels being completely separated.
An attacker that can bring the two channels together defeats this defence. In the case of the Zeus malware, an infected PC attempts to infect ...
-1
I understand that a smartphone it's a computer with an OS, installed programs (apps) and connectivity to the Internet. So it's vulnerable to viruses. If a hacker gets your banking access data through malware, it shouldn't be difficult to get your phone number, as lots of websites are always asking that number (begining with Google, Facebook, etc.). Maybe ...
2
Fraud management. The bank's website may be using Geo-location and device fingerprinting.from Wikipedia
Geo-location is the identification of the real-world geographic
location of an object, such as a mobile phone or an
Internet-connected computer terminal.
Device fingerprinting is information collected about a remote computing device for the ...
2
Many such apps do not have a shell script part, and do everything through a PHP/Perl script instead.
I think we must consider what information does the installation have about who its master is. Certainly not "anyone who can connect through HTTP", since as you say, a bot might just scan for half-baked installation.
The simplest thing would be to require ...
3
The threat is when the MITM owns the login screen.
If, for instance you click a link in an email that purports to be a link for https://yourbank.example but is actually a link to http://yourbank.evilbob.example, and enter the username and password you use for your bank website, Evil Bob merely needs to forward those on.
Then, https://yourbank.example ...
3
The scenario that this is designed to prevent is keylogging. It is fairly easy to get a keylogger that will report back but somewhat more complex to make a program that will actually execute an attack remotely on another computer. Since you don't regularly enter your security question answers, if an attacker obtains your password via a key logger, they ...
3
I'm willing to bet that they don't actually identify the computer, they just send you a persistent cookie once you've successfully logged in, and as long as your browser returns that cookie, they know it's a previously used machine.
You should be able to test this quite easily using something like Firefox's Web Developer toolbar which will let you both ...
0
Found a list with free public NTP servers supporting autokey.
http://support.ntp.org/bin/view/Servers/ServersAuthenticatedWithAutokey
0
I wouldn't send his credentials via SMS, but perhaps a code that can be used to reset his password. Sending the password unencrypted back via sms is sometimes seen as a violation of privacy. (it shouldn't be possible to do the unencryption in a good setup)
5
In short, somebody misplaced an OR where an AND should be. Indeed a big mishap on the part of the developer. Your assumptions about its security are correct.
5
Yeah, what you describe looks like a bug. Regardless of the alleged security value of "security questions", or lack thereof, there is no way that "John" can be considered as a valid response to "Where do you live". It is even more than a bug: it is a vulnerability (an even bigger than merely using "security questions" in the first place). Indeed, in your ...
5
Security questions are bad, security questions which ask for your name and place where you live are even worse. The fact that you can use either answer for one question isn't a bug, it's poor coding.
Passwords resets by using security questions are bad if they aren't used in combination with something else. For instance, if they ask you questions, but stuff ...
0
Generally speaking ,,
Do not trust Any Thing (headers, hidden form, validation, etc..) that depend on the browser(client side)
use burpsuite , WebScarab or any other proxy to intercept your request, you'll see how dangerous is it.
You can imagine that if your authorization depends on "referer" and user change the refere to the valid one during browsing, ...
21
Google Authenticator supports both the HOTP and TOTP algorithms for generating one-time passwords.
With HOTP, the server and client share a secret value and a counter, which are used to compute a one time password independently on both sides. Whenever a password is generated and used, the counter is incremented on both sides, allowing the server and client ...
2
It'll work on a seed based on time so it's similar to the way the RSA key fobs work. i.e. they also don't require any connectivity.
I've just had a look around and this is answered here: http://stackoverflow.com/questions/8340495/how-rsa-tokens-works
1
This is often known as a service or API key. You are trying to setup a web service. Generally, the client site will submit a request for some action to be done with a publicly shareable identifier that lets your system identify who sent the traffic your way. It should likely be paired with a private code that is used for your server to respond back to ...
2
There's a little detail here on how Paypal issue Application IDs for issuing on servers which will host applications making API calls to PayPal on behalf of merchants/service providers - https://www.x.com/developers/paypal/documentation-tools/going-live-with-your-application#register
The approach you're taking above is similar so it's a way of providing ...
1
Make it require a password when the screensaver comes on. Make the screensaver come on after 5 minutes. I've also used a small utility (BtProx) which uses bluetooth to determine if you're close. When you walk away with your phone it locks the computer. You can also use something like LemonScan which uses your webcam to determine if you're using your computer ...
Top 50 recent answers are included
