Tag Info

New answers tagged

1

HMAC is generally more applicable to situations where two entities want to communicate securely over the internet. It provides two key things, confidentiality and integrity. confidentiality by proving the remote client has possession of the "secret" ingredient, integrity, through validation of message digest. In your use case, local storage encryption, ...


2

The option names are not part of the SSH protocol; they are specific to a given implementation. I suppose you are talking about OpenSSH. As per the documentation: RSAAuthentication Specifies whether pure RSA authentication is allowed. The default is “yes”. This option applies to protocol version 1 only. So this does not apply to your case, ...


0

I just read some of the specs because I wanted to know if the device stores the actual (private) keys. I can try to answer some of the questions. OTP are simply one-time tokens, while U2F is based on public key cryptography; more specifically, the Yubico Fido U2F key seems to use elliptical curve cryptography. U2F should help to protect against phishing ...


0

Some banks have JavaScripts that encrypt/hash the data on client-side using for example a public key or a hash algoritm, and then sending it. Submitting the form with ENTER on a computer with JavaScript disabled, would send the details "over the clear" (note: The site might still be SSL-encrypted if it use SSL, but the login details would get sent in clear ...


0

Google for Amazon cookie management. Authentication is only valid for a certain period of time, and once it expires they will not let you perform critical operations without going through it again. That is they first check if your "low quality" identity is authorized to perform an operation, and otherwise ask you to authenticate again to obtain a "strong ...


0

You are actually bringing about a very interesting point. Instead of just seeing authentication as proving your identity (the fact that you are indeed Bob), see authentication in a broader sense whereby your prove the authenticity of a claim. For instance, you could claim to be 21 years of age, you could claim to be an EU citizen, or you could claim to ...


0

I guess what is really confusing about this is that it goes against the typical way things are done. But if you want to break it down, let's look at the ways you've proposed. Authentication then Authorization This way, a user must prove they are who they say they are (in this case with a username and password, and once they do, the session is authorized ...


1

I have seen systems that filter by a list of allowed IP addresses first, so in order to even attempt to use an authentication method you have to be coming from a specified IP address or range. This is similar to what you are describing. But in general, authorization refers to deciding what an authenticated user can do, and so logically comes after the ...


1

What you are describing is, in fact, authentication. It is just a more explicit description of the steps involved in authenticating than you might generally see. Specifically, the steps in the authentication process are identification, and authentication. First you get an identifier (such as a username) and if it is a valid identifier and can be matched ...


2

I suspect this decision was not security related at all. Probably they had issues with users accidently changing focus on the form before they were ready because of their enter key behavior. Facebook is very bad about this. This company just wanted to give the user the option to prevent the enter key from doing anything but inserting a cr/lf.


2

I'm answering my own questions but for future seekers, I found this great article: http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication. Maybe I didn't explain my question well but this was the answer I was looking for. -- UPDATE -- Rory Alsop, asked to post a summary. You should definitely read the source. But in case you ...


5

You cannot trust the client, ever. A malicious user may abuse legitimate client software (theirs, or someone else's) An attacker may reverse engineer enough of the API to pretend to be a legitimate client Instead of trusting the client, work to ensure that the client's input is trustworthy. input validation input sanitization schema compliance velocity ...


5

I have not yet fully explored the spec. But: U2F is not using an OTP. It is really about site authentication and using possession of a private key as a factor. Time-bound OTP systems do an excellent job of combating phishing (stealing credentials) because they are hard to steal. U2F is really meant to combat MiTM attacks. Brute-force attacks would not ...


3

You are relying on "security through obscurity", and implementing this type of security is never a good idea. You can create a vastly more secure and easier solution by implementing SSL (or TLS) on your solution. Here is a very good tutorial on Stunnel: you install stunnel create custom certificates encrypt everything transparently Using stunnel you can ...


9

U2F is capable of using an encrypted channel using public key crypto to ensure ONLY the right server can get the one time token. This means plugging it in when on a phishing site means nothing happens, they can't get into your account. Instead they have to rely on technical attacks like XSS and local malware. It is supposed to be able to hide the fact that ...


1

Before I give my answer, lets first go over the subject of HMAC. Hash-based message authentication code (or HMAC) is a mechanism for calculating a message authentication code involving a hash function in combination with a secret key. This can be used to verify the integrity and authenticity of a a message. Now HMAC authentication guarantees the ...


2

First make sure nobody can abuse your codes. This may be even more harmfull than you not being able to login for a short time. So encrypt your phone and your external SD card if data is stored there. This requires that you use a PIN or password to use the phone. So nobody can use Authenticator without knowing that PIN. Don't use 0000 or 1234 but something ...


0

It's probably too late for some sites, but I would suggest taking a screenshot of any QR codes and saving that somewhere secure. That may mean print them and put them in a fireproof box. That will allow you to re-scan them at a later date. If you have that option on any sites, I recommend you do it. A similar option is to scan the QR code with Zxing ...


1

Be careful, you should not confuse keys used for encryption/decryption and keys used for signature, since there usage is different. So the key couple A-pub/A-priv is used for signature only, while the key couple B-pub/B-priv is used for encryption only. Be also careful that you should sign the ciphertext and not the plaintext, otherwise having the hash of ...


0

To answer your questions: 1) How do you handle a situation with a compromised token secret which is shared between a client and the server? Add an expiry date to your token. Make the sure the token cannot be used after the expiry time. But this doesn't prevent unauthorized access within the token's expiry period. So, to overcome this problem you can ...


0

The use of encrypted OAuth tokens is good approach to satisfying the security requirements in RFC-6749 section 10. Encrypted OAuth tokens are in common use, Facebook is a good example. OAuth tokens expire based on the expires_in parameter. Which means that a given token would be valid for a short time after the user logs out, which is very low risk issue ...


0

I can't comment yet, so I will post an answer. I can think of two things that they could do: Run a list of bad passwords through their hashes and see how many correspond to their database of password hashes, then count and rank them. Reverse engineer a sample set of their password hashes(why devote too much time to this?) and aggregate data on the brute ...


2

Your first link says what the source is: This list is from files containing stolen passwords posted online during the previous year. In a perfect world this would not happen. Not only would everyone salt and hash their passwords with an expensive algorithm, security would also be good enough that password lists won't get stolen. Unfortunately the world ...


1

While "reputable" websites may do this, there are just as many that do not securely store them and get compromised. Compromised password databases are available, and if you acquire them, you can construct such a list as the one that SplashData has constructed.


1

Robert - I recently was faced with the same issue. Wireshark does not decode SSL over EAP. What you can do is fake Wireshark out and take the entire ssl conversation and build it into a pseudo tcp session with the SSL data from the original eap packets and retransmit the frames. I used Python raw sockets to generate the tcp session and then capture the ...


1

An RSA token might be another option. This requires the user to enter an OTP which is displayed on the RSA token. Works well but is not inexpensive.


1

In addition to sebastians answer you might also consider not using yubicos backend server but to run your own system, so that the authentication request is not forwarded to yubico but handled on your own system or within your own (your customers) subnet. Alas, you need to install/run such a backend system. Yubico themself provide an authentication server but ...


2

To specifically address the scenario, Facebook doesn't need to wait until a user logs in to capture an OAuth token. Since you're trusting Facebook as your authentication provider, they can generate a valid OAuth token for any user in their system anytime they please. Given that, there are three potentially correct answers here. This is not a threat, ...


2

I would then suggest Yubikey ( http://www.yubico.com ). Yubikey is a OTP hardware token that does pretend to be a keyboard (Thus requiring NO extra software installation), and then sends a 128 bit encrypted secret to the server. The tokens are fully programmable by the administrator, and its possible to use the token in a variety of ways. You could either ...


1

The CryptoStick uses the Web Cryptography API to expose a keys to the browser. Its likely that the proposed USB security token product product would use a similar technique. CryptoStick is open source, so it is easy for 3rd parties to verify it's security. The 2-factor authentication that I use regularly is Google Authenticator, which makes it very easy ...


1

You are asking "what's bad about accepting (but not otherwise enabling) get based authentication?" The answer: it's a bad practice that may eventually lead to a vulnerability, but it doesn't directly create a vulnerability. For a vulnerability to exist, it must be exploitable in some way, and it must grant the attacker something they don't already have. In ...


-1

If login form is vulnerable to CSRF (no matter POST or GET), this is unsecure and known type of forgery: "login CSRF" http://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests related question: How to protect against login CSRF?


1

So I hope I do not make myself look like a idiot but I will try to help explain this from my understanding of it. I should note, this is not my full time job so please be kind if I have something really off:) These protocols, and I believe eap is a protocol, peap is protected eap, so it is probably the same protocol with additional encryption, are used to ...


0

The analogue of PPP in the EAP world is 802.1x or EAPoL (EAP over LAN). It is a very basic multicast protocol that sits atop Ethernet frames and which is only available on the interface itself. From that point on, it is up to the Authenticator (more commonly known as the Access Point or NAS) to propagate the authentication information to some higher layer ...


2

Question 1: this is not considered secure for a number of reasons: The password can be seen on the URL The password can be seen on browser history All the passwords will be on server logs If the user logs on the site, and there's a link pointing to an external site, and the user clicks it, the password is leaked Spyware with URL monitoring will be able to ...


0

It does work by either having a meta refresh, or a JavaScript, that continually send request to hold your session alive. Basically, it works by having a session identifier, that is a random string. This session identifier might be valid for lets say 3 minutes. Each minute, that webpage will either execute JavaScript code, or do a meta refresh, causing the ...


0

I guess you want to enroll users by POSTing CSRs. There is already enrollment schemes builtin browsers so you dont have to POST CSR's. Those enrollment schemes will also automatically install the client certificate in the browser store, so Everything is done in one shot. Here you have Everything to get started: ...


4

Redirection the user after a successful login is common in the most webapps. For instance when the user try to access the dashboard directly within its url, the system keeps the requested url and brings the user to the login page, after user signed in he is redirected to the dashboard not the homepage or something.


1

You fix the typo in the url https://aws.amazon.com/forms/aws-mfa-support/ (notice the 'r' in 'forms' that was previously missing


2

Probabilistic or statistical authentication are probably the best fit, the alternative to deterministic authentication. (Though technically, there's a degree of probability involved when password hashes are used, rather than plaintext passwords, let's just ignore that for now.) Biometric implies a probabilistic system, but the converse is not true, e.g. ...


1

Anyone who is watching network traffic on my web app can see the token (in headers) and can copy it and form their own malicious calls. That is correct. This is why you would want to make sure you use a secure connection (HTTPS in the URL), which will prevent man in the middle attacks.


4

Your understanding is already pretty good. As you say, there are a variety of EAP protocols: LEAP, PEAP, EAP-FAST, EAP-TLS, etc. Each one works differently, but they all do the same thing: authenticate a user before allowing them access to a wireless network. You could call EAP a protocol, or you could call it a framework of protocols, where each variant ...


1

Depending on metrics such as the false acceptance rate and the false rejection rate of your authentication system, you can set a similarity percentage for which your biometric authentication is acceptable. Also, I don't think you can speak of passwords regarding voice authentication because it relies on an inherence factor as you can see on Wikipedia.


0

Not really a detailed description, but from what I understood, I have few questions :) In step 1: The Diffie-Hellman key exchange is vulnerable to a man-in-the-middle attack. Even if it is running inside a secure connection TLS/SSL. The only way to avoid that is to use PKI certificates. In step 2: How do you plan to recycle the secure token. I mean for how ...


1

The YubiKey NEO is a unique One-Time Authentication device which combines the functionality of a YubiKey Hardware Authentication device with the extended capabilities of a smart card, without requiring additional drivers or software. The YubiKey NEO has 3 major elements - the first is the YubiKey element, which allows the YubiKey to be used as a ...


1

I guess you use SSH-keys as authentication? Reauthentication and key exchanges happens all the time during the SSH protocol, so having a Active session is secure enough. Another thing is confirmation, eg, you want that the user really wants to commit a action that might be irreversible. Lets say deleting something. To solve this problem, I would suggest ...


0

If you don't want to share keys AND you use asymmetric keys then you can key each server separately and have each server set a different iss (issuer) claim. Then the recipient of the JWT can "look up" the appropriate public key based on the iss claim. Our lookup was basically a config file that mapped the iss value to a file system location of the public ...


2

This is called federated authentication. In the enterprise world, this is often accomplished with Kerberos (for non-web based systems) or SAML (for web-based systems.) In the non-enterprise world, far and away the most popular federation framework is OAuth 2.0. There is an extension to OAuth 2 called OpenID Connect (much different from the older OpenID ...


4

Could there be some miscommunication between you and the IT department head? As Xander had already pointed out, such a scheme does not work, and I would even add that it is ridiculous. In order to authenticate a user, a database lookup has to be performed on the login email address in order to retrieve the corresponding hash used for comparison: SELECT hash ...


9

As far as I can tell, this scheme doesn't make any sense. As you've noted, you still need to store the plaintext email address for the user, so there isn't any significant security benefit to using the plaintext email and email + password + salt hash vs just using plaintext email and password + salt hash. As I'm sure you've already noted, without the ...



Top 50 recent answers are included