Tag Info

New answers tagged

2

Skimming the NaCl PDF I think they just generate such a shared secret. In an interesting fashion: Section 5: Alice, using Alice’s secret key a and Bob’s public key B, computes a 32-byte secret k. Bob can compute the same secret using Bob’s secret key b and Alice’s public key A. Using that shared key they then seed a pseudorandom generator. The first ...


0

Most attacks happen on the network while the SMS is in transit. Once it reaches your device, the fact that it's displayed or spoken won't change anything as long as that device is secure and trusted and as long as the TTS happens on the device and doesn't call any online TTS API (and if the device is compromised, using TTS or even morse code flashes won't ...


2

While unencrypted, Ninja sessions are signed: A Ninja session is a hash of key/values, signed but not encrypted by default (see next section to enable encryption). That means that as long as your secret is safe, it is not possible for a third-party to forge sessions. So integrity is ensured for the sessions. The warning you quoted is talking about ...


0

On second thought - a great way to authenticate an API that exposes your systems' functionality to partners is OAUTH2 - what is terrific about OAUTH2 is that you have a good choice of libraries, and you can use a flow that fits your user relationship - server flow, web browser flow, mobile flow, password flow without changing your underlying API business ...


2

The only way you can ensure you are secure is if you use a trusted mobile application, such as Chrome, and you see the padlock and HTTPS at the start of the address bar. Note that here you are trusting both Chrome and the domain of the website that is HTTPS. If you're using a third party application that integrates a browser, you are trusting that ...


5

It is not clear for me which kind of problem you are trying to solve and it might not even be clear to you. If you have a clear idea what you are trying to achieve with the authentication than you would not need to offer the client multiple authentication schemes but stick with the one which solves your problem. If you fear a compromise of the ...


5

Well curl with basic authentication is acceptable - remember thought that the syntax is curl --user name:password https://yoursite.com and this means that you will have to hard code credentials in the code that invokes your REST API - typically if it's Ajax - then we're talking client side code and that means exposing credentials in the browser (or in a ...


2

I presume if a user's computer is compromised or the user loses their U2F dongle then all bets are off, right? But phishing no longer works? The documentation I'm making statements in regards to this comes from the Protocol Design + User Flows document at https://sites.google.com/site/oauthgoog/gnubby Malware on a machine can generate fake origin ...


2

In my opinion U2F lacks on thing at the moment: The privacy of your secret key. Each device comes with it's own secret key. A site specific key is derived from this secret key to do the challenge response when logging in to a site. This is ment to keep you anonymous and easily register and authenticate at a site. But! Each U2F device that is sold nowadays ...


2

Subquestions 1 and 2 are already answered, so I take the other two: How do I know that my credentials are encrypted between my device, the access point I'm connected to, and the authentication servers? Make sure that you use an encrypted WLAN connection (otherwise your credentials can be sniffed from the air) and secure protocols like https. Then ...


-2

In general 2 factor authentication is required in very senstive applications like military and highly sensitive financial transaction. Note that many home banking applications don't use 2 factor anymore. 2 factor versus TOTP is a trade off of risk threat against countermeasure cost. BTW - most of the answers to your questions are here ...


0

This is pretty secure, assuming you've put into place a way of dealing with collisions and someone randomly trying to guess other strings. Since it is over ssl, and assuming it's end to end terminated exactly at your server, is resistant to someone trying every combination for the validity period of the string, and the intermediate isps are not saving the ...


1

There are several scenarii you have to think about. If you are sending the URL over HTTP you (and your customers) are vulnerable to man-in-the-middle attack (the attacker will have access to the information sent to you by the subcontractors) and even if you are sending it over SSL that will protect your URL only during the transit, and if you are rely on ...


1

Using Active Directory for SQL Server has a number of advantages, which makes it the recommended approach. SQL DBAs will often want to have the database in Windows Integrated Authentication (WIA) mode only (instead of "Mixed mode" where SQL Authentication is also support) because of it: When using AD, account authentication is centralized. You have one ...


0

Though, this sounds like homework, its possible that a technical person sometimes doesn't understand some things. You need to make sure that the person entering the info is the one meant for it. The two standard way of checking john doe is actually john doe is to have their email and send the link to their email, or to have their phone(cell) and send random ...


3

Ideally, the user or application accessing SQL Server should be using the set of credentials that identifies them correctly, and that has been assigned the appropriate level of access to the SQL Server and/or database(s) as needed to perform the actions they need to perform. SQL Authentication is a legacy authentication mechanism that in a properly ...


0

So I think that, given the lack of physical security of the devices, whatever you do will be only best-effort. You just can't stop someone from stripping the device down, reading the data, modifying it, etc... Let's just take that as a given and move on. This solution utilizes HMACs. An HMAC takes two inputs, a string and secret, and produces an output ...


4

If such computation is a concern for you (for instance if you have a lot of successive connections), depending on your usage you may be interested in SSH ControlMaster Session feature. It allows SSH to multiplex several sessions inside one TCP connection, so the handshake is realised only once then each new session can just reuse the already established ...


2

The computation is not that heavy regarding the security advantages because if the server is spoofed or compromised, the attacker can not get the private key (and pwd); at best he can the signature which can not be very interesting for him because a signature cannot be re-used: that is why it is a worth while to perform some calculations for the sake of ...


0

When a user access a website, in order to encrypt communication between the the user and the website, a symmetric key is to be use. Yes. *In order for the symmetric key to be used by both the client and server, information about the creation of the symmetric key must be encrypted using the asymmetric key Yes, unless it is diffie-hellman. ...


5

How is eduroam different from a VPN in terms of security? Eduroam is only an infrastructure for authentication, it allows your institution's servers to prove that you're indeed the one you're pretending to be. It only authenticates you, but doesn't tunnel your traffic or similar - your traffic is still at the mercy of whatever network you're ...


1

First, I think that you're confusing some terms. The term is "digital certificate", "certificate", or simply "cert". Not "digital certification". If you really mean "digital certification" then this answer is likely wrong. Yes. Symmetric keys are used for bulk encryption because symmetric encryption algorithms are much faster than asymmetric ones. No. This ...


1

Change your password. Regardless if this is a genuine compromise or not password hygiene is vital, especially when anything that is suspicious is flagged up. You should also set up two factor authentication. There are number of innocent reasons why this could happen though, I've listed a few below, which are in no way ment to be an authoritative final ...


1

As schroeder states it's much more likely that something between you and your ISP caused your public facing IP address to change. The vast majority of consumer internet dynamically allocates you an IP address, so simply restarting your modem will probably result in it changing.


1

You get different values because different salts are used. The salt is the second field in the hashed password. There exist large rainbow tables that make the lookup of hashes of common passwords very cheap. The point of salt is to dramatically increase the cost of precalculating hashes for all commonly used passwords. So salt basically makes a password ...


0

You can host all the phishing emails there. For example: We have detected suspicious behavior on your account. All furthur login requests will be denied. Please use the alternative login form at http://example.com/ to do a secure log in and unlock your account.


0

The short The MITM needs the private key of the server to pose as the server and decrypt private messages you send to to the server. The public key of the server is for authenticating messages signed by the server and sending private messages to the server, so you still need to verify its fingerprint. It's okay if the MITM has the public key too. All that ...


1

Biding your applications to your AD can be done by using a single sign on solution (Web seal) such as (among several others) IBM Tivoli Access Management. This requires you to create the objects accounts (users, systems and computers), set the permissions through groups, implement the web seal login and an authentication interface for every single target ...


1

in psk authentication and 802.1x authentication methods, five main keys are generated. master session key,group master key,paired master key,paired transient key and group temporal key.paired transient key and group temporal key are generated after four way handshake. when you switch from one access point to another,the four way handshake starts again.


2

Most businesses require employees to cooperate with thieves to the best of their abilities, along with insurance to replace anything lost during a fire, theft, or natural disaster. It is hugely more expensive to repair the bad press and pay your workers compensation (or worse, pay when your spouse sues them after you die)! It's just not worth it! If you ...


1

Yes, your guessing is correct. OpenVPN has a built-in certificate management feature. This is the role of the Easy-RSA, I am guessing you already know that. The Easy-RSA is an RSA key management package based on OpenSSL. It allows you to build your own root CA and generate and manage the client's certificate/key pairs and the server certificate/key pair. ...


0

A token and a session is basically the same thing on a different view. A cookie would be a different thing. As the HTTP protocol is stateless, the server must have a way to maintain the state of the connection. A session (generally) is a file stored on the server, with all the state variables of the client on it. The token is the value send back from the ...


1

After reading the linked blog post and after cross referencing his issues with the OAuth 2.0 RFC I have a few issues with his concerns. In the first section of his blog post, he has two major issues with using OAuth within a single page web application using the Resource Owner Password Credentials Grant: The client_id and client_secret are baked into the ...


0

This is mostly secure. To intercept localhost traffic an attacker would need root privileges and at this point you've already lost as the attacker can also read and modify memory at will - no amount of cryptography will help you as the attacker will get your confidential data straight out of memory. The only issue I see is that you can't prove it's indeed ...


0

To your questions: [...] I don't have ability for user to login with social network accounts and other Oauth2 servers in the network [...]. You will need your own OAuth authorisation server, that will manage your resource server. The OAuth server from Google, Facebook, Twitter, etc., will not help because, as far as I know, can only grant ...


0

I've seen loads of single factor authentication methods, all the usual ones, digital badges, physical tokens, bio metrics etc. As for a Q and A type challenge/repose thing, I have only ever seen them when recovering forgotten passwords. When you think about it they are not much difference from username/password. Both have a public part, the ...


0

I have just established an IPSEC site-to-site VPN that required some ExtendedKeyUsage and I did some research on it. The ExtendedKeyUsage for Internet Key Exchange were deprecated by RFC4945 The CA SHOULD NOT include the ExtendedKeyUsage (EKU) extension in certificates for use with IKE. Note that there were three IPsec- related object identifiers ...


1

According to these slides, during the handshake both the operator and the SIM card uses A8, RAND, and Ki to generate a session key (Kc). After the operator compares RAND_1 and RAND_2, it uses Kc to encrypt a message. The mobile then tries to decrypt the encrypted message with Kc; if this decryption is successful, then the mobile had, in effect, ...


0

The biggest problem I see is that it doesn't help against offline attacks, or it hurts them. You had better be salting and hashing the password, or else you're dramatically weakening the password security. And if you're doing that, then this has to be done by an external call, and all that remains is security by obscurity.


3

Sometimes we forget what counts: The system is protecting things, you and your coworkers are a people. When kidnapped, just cooperate and try to keep harm to persons as low as possible; it's just not worth it. With this corrected attitude, it doesn't matter what security system you pick, because it will only work with the thieves, not with the robbers.


3

The user name and password are encrypted; this is confirmed in the OpenVPN documentation: OpenVPN 2.0 and later include a feature that allows the OpenVPN server to securely obtain a username and password from a connecting client, and to use that information as a basis for authenticating the client.


2

Diffie-Hellman and MIM attack: When variants of Diffie-Hellman algorithms like DHE, ECDHE etc. are used in SSL handshake for key exchange then can it become prone to man in middle (MIM) attack. Suppose, SSL handshake has started and now it is time of key exchange, so client computes its public key part of DH and sends it, now bad guy sitting in the ...


1

But how RSA is used to prove the server identity or authentication because it is done with digital signature, right? Yes. The key exchange parameters are signed with the server's long term key. (Such a key used to be mostly RSA, but ECDSA is becoming quite common now.) Further reading See the Key Exchange section in Thomas Pornin's answer here: How ...


0

Not sure of your question, is it how these values are encrypted? It is described in RFC-2548 section 2.4.2. The reason I think this is that in your question you state: I have an example of freeradius and the session key is converted from 16 bytes long to 32 bytes long before the construction of the string stated in RFC 2548. so you are wondering ...


1

The problem you are trying to solve is that the client needs to be identified by the server (to know which user this is) but the server needs also be reliably identified by the client to detect phishing. I agree that simply using HTTPS for identification of the server is not enough, since an attacker might simply own a similar looking domain (e.g. paipal.com ...


1

Security measures strengthen in inverse proportion to convenience... so I probably wouldn't do this... and I don't know a single site that does this... but... you did ask. How about a workflow like this: User accesses web site and enters user name Site looks up user's phone number and sends one time code or a random word as SMS. Site displays one time ...


1

I know of one that let's users upload a picture of their own choosing when the account is set up. (They can change it later.) The picture is shown on the password screen, after the user ID is entered. Wrong or no picture == fake web site. You would want to use a back-end program to make the pics a standard size and to strip out meta data before storing ...


2

You should use a password, without any doubt. A 4-digit PIN is easily crackable via brute-force; for this reason it is only used in conjunction with other mechanisms that deny access after a limited number of tries, e.g. SIM cards and bank cards. Any other use is doomed to failure, as the hacking of Google Wallet showed a few years ago. Longer PINs are ...


1

From the blog post itself they state that unlike Google Authenticator, the Authy system actually generates new, separate keys for each device. As such I don't see any reason that they would need to store them so an attacker compromising their database should not be able to access them. An attacker who compromised one of your devices would have access to a ...


1

From the docker documentation on container linking, it's possible to see that the standard setup for links is to create an internal network on the docker host which is used by the containers to talk to each other. This network isn't exposed off-host by default so from that perspective it should be secure from network based attackers (i.e. no ports or ...



Top 50 recent answers are included