New answers tagged

2

A system which locks out an account, even temporarily, in response to invalid password attempts will make it very easy to conduct a denial-of-service attack against someone. Using a two-part authentication makes it possible to have very strict lockout policies on the second part while still remaining resistant to denial-of-service attacks. If someone found ...


1

You can not reliably detect devices, and nor do you need to. Just use the timestamp to routinely delete sessions that are more than X hours old. Note it's perfectly fine to have redundant data in a working table such as this, which was your original concern. You will need to do that anyway since sessions should always be terminated server side as well as ...


8

I find it hard to see what security benefits this could provide. In multifactor authentication the point is to use different factors - i.e. "something you know", "something you have", "something you are". Just repeating the same factor twice seems a bit pointless. But let me speculate some about what the purpose could be. 1. Stop keyloggers Only dumb ...


3

The point of multi-factor authentication is to require information from multiple sources so that if a user is compromised in one way (say they write their password down somewhere and it's found), then there is still a layer of security preventing account access. Usually, the three types of authentication information are something you know - like a ...


5

If you want strong authentication without the cost of sending SMS you can use TOTP with the Google authenticator app. Indeed, the pin solution doesn't seem to add a lot of additional security. I also don't fully understand the mechanism. They enter 3 digits from a 6 digit pin. How did they obtain the 6 digit pin and how are the tree digits selected? Also 10^...


1

TPM operations which need the EK: Take the ownership Clear the TPM Change the SRK Change the Owner(obviously) Allow SRK read using SRK auth (tpm_restrictsrk -a) Basically, these are all administration operations. The root key for the AIK is the EK. The goal of the EK is to prove everything we send comes from a valid TPM. So yes, you can use your EK to ...


1

It's not just technical security you have to consider. No online voting system is a secret ballot; there is no way to eliminate social pressure to vote a particular way. A dominant member of the household can bully other family members into signing, or simply use their email addresses to do it himself.


0

Here's a few things you need to consider: Biometrics can be stolen fairly easily. We don't have yet figured out any biometrics on which can be verified by one party and one party only. You leave fingerprints everywhere you go, HD cameras may be developed in the future that could gather enough resolution for retina scan. Biometrics are immutable. Once ...


0

SAML and OAuth 2 are protocols for authentication/authorization. JSON Web Tokens (JWT) is a specification for a token that can be used in many applications or protocols - it also happens that the OpenID Connect (OIDC) protocols uses the JWT standard. SAML also defines its own token: SAML Assertion; as does OAuth 2: Access Token. Tokens are used by ...


0

The general Amazon API model involves the following steps Build your API request with all the elements (within a program structure like an array) Order and format the request elements Calculate the HMAC of the formatted request Send the full request to Amazon, with the HMAC Amazon then takes the request, generates its own HMAC, and if it matches, it ...


0

Its just odd you stated you've looked at it recently. The question is: are you a fellow bughunter or are you looking for the work (vulnerability) another bug hunter found? If its the latter (looking for known vulns), then Ali gave you the legit answer as no new publicly release SSPI vulns were found. If the former (hi fellow bughunter), then the question ...


1

Even though the connection between user agent and servers are secure, the user agent may not be fully protected. Since authorization code flow ensures the user agent is not privy to the tokens, security is improved by reducing exposure of tokens to between servers only.


2

While the answer would be 'no', in this case it doesn't matter. All it is, is in 'indicator'. It doesn't need to be trusted to be 'looked at'. If someone were to do internet-voting, then this system would be a very, very bad idea to use.


2

This seems a bit like using the password for both purposes. Technically this works, as long as people are using strong enough passwords all people passwords will be unique (as a good biometric will do), and therefore you can imagine a system where identification too can be accomplished using only a password. However this would open a big flaw since an ...


1

They can verify the name and post code against the electoral roll. When they say 80,000 fraudulent names removed, I expect those are the ones that don't match (I don't know this for sure). However, this is flawed because much of the electoral roll is public.


14

I don't know if this is how things are done in Britain, but this is how things are done in the Netherlands whenever a petition is submitted to the government: A random sample of the signatures is taken; These signatures are verified (I think they call people to ask if they've signed); the resulting ratio of valid:invalid signatures is then applied to the ...


2

Not sure about whether it can be used as a standalone authentication system but it can be used as a part of multi-factor authentication system. Reference: More info: Identification Identification is nothing more than claiming you are somebody. You identify yourself when you speak to someone on the phone that you don’t know, and they ask you who they’re ...


3

You cannot match postcode to IP location, I use Plusnet in the UK and it shows up as being in Dundee (several hundred miles away) from me when I check my location according to location. So it cannot be using that to check. Similarly, you don't need millions of email addresses, just 1 with many aliases - assuming the email address is actually checked. I ...


0

You can't make it failproof, but you can increase the amount of parameters to take into account so the maximal percentage of cheat becomes statistically insignifiant. Still, I live in France, have been to Wales once for a week or so in my whole life, and just signed the petition as a londoner that lives at 1 Jamaica St. My web browser has no permission to ...


16

General comments Can you be 100% sure that every signature is from a real person? No. Can you take some precautions to make it harder to cheat? Yes. Here are some things that the British government could do (no idea if they actually do it): Require a successful CAPTCHA after X attempts from the same IP. Rate limit by IP. Sure, five persons in the same ...


69

The petitions site is purely a mechanism to see whether there may be high enough numbers to support something, and if so, that something will be discussed in Parliament. There are some checks and balances (for example 80,000 fake votes were identified and removed) but there is no need for a strong level of trust here, as nothing is decided by any of these ...


3

For the governement tool : I see one interesting point : there is a map showing the distribution accross the votes : http://petitionmap.unboxedconsulting.com/?petition=131215. We can see here that the votes have been made accross all the country, and the distribution seems to follow ppopulation density (more votes on London,...). An elaborate bot could ...


1

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other website's cookies. This is fundamentally incorrect. I think you misunderstand the attack vector. A CSRF attack (also called "session riding") will typically ...


0

The salt has to be stored someplace that's easily accessible given a user ID. That means a database table. The hacker who can get the hashed passwords can get the salts in the same way, often using SQL injection. As others have already written, the salt stops precomputation attacks. There is an approach called a keyed hash in which the hash is generated ...


0

Others have clarified the purpose of Salt, which is to require a separate brute-force process per-user to crack, which would take much longer than a single brute-force process finding matches for every user at once. Salt is not needed to be secret, just unique. A good way to improve on this is to include Pepper, which is secret. Pepper is just some random ...


2

The purpose of salting is, that one cannot build a rainbow table to get several passwords at once. Without salting: An attacker could search the internet for precalculated rainbow-tables and find the passwords with no effort. With a constant salt: The attacker has to build one rainbow-table for this specific salt, and can then get all the passwords with ...


0

You answered your question, just did not saw it. why all people say on SO or Internet anyway that putting the salt in the database is good practice or safe The answer is: if I hack to a database (...) I will take the salt of the first record for example and make a dictionary of all hashes of all english words ( rainbow table ) and then I ...


2

To answer your questions: Should all web applications implement such a security feature? This is just another good security feature to help the user so if the application can afford (resources not financially) to have this implanted in their system there is no reason not to. Is it desirable that companies store our historical passwords? Since ...


0

The eToken Pass has two modes to operate. Eventbased and Timebased. The basic for these are RFC4226 and RFC6238. BUT Safenet changed the event based tokens this way, that they do not use SHA1 anymore but SHA256, which is - strictly speaking - not HOTP compliant. The event based OTP values does not expire. You can press the button now and use the OTP value ...


5

Hashing client side Secondly assuming that the connection is compromised because of an MiTM attack. The process of how the leaked hash of the password is created is still unknown because the salt and iterations (based on the pincode) are unknown. In case of a MitM attack (made possible by say incorrect use of TLS) hashing client side will not help you. ...


0

The local hashing will not help against passive MitM if the authentication process is simply sending the hash to the server. The attacker can capture the hash during registration/password change and just send a request with the hash instead of using your web application which computes the hash based on password and pin code. Server side hashing keeps ...


1

No. The authorized_keys file contains strictly only the public key, as described in the manual page for sshd: AUTHORIZED_KEYS FILE FORMAT Each line of the file contains one key (empty lines and lines starting with a ‘#’ are ignored as comments). [...] Protocol 2 public key consist of: options, keytype, base64-encoded key, comment. Accepting the ...


0

MD5 is broken with regards to creating collisions. That means that it is possible to construct a message M1 in such a way that you can also generate a message M2 so that H(M1) = H(M2). For this the messages M1 and M2 must be pre-constructed in a certain way. So in case of CHAP M1 would be the nonce | password combination. The vulnerabilities of interest to ...


1

If they are practically unclonable, how is a PUF-based device authenticated? Consider the example of a smart-card chip, assuming that it has a puf-based circuit. If reliable enough then this chip will produce a unique key for a given challenge. Even if an adversary attempts to replicate the same circuit with the same response the output key will be ...


0

I do not completely understand the question, but it seems that you want to know a good solution to implementing this. To implement this, I would suggest fetching a unique devide ID (Can be IMEI, but can also be some OS-dependent ID), and then concatenate this with the PIN. Then you use PBKDF2 to derive a key out of this. You then select a number of ...


1

As @fishy says, Google's first goal is to increase adoption. Anecdotally, it seems like a majority of people do not require a second factor of authentication for any of their accounts. SMS-based tokens can sometimes introduce too much of a delay, lead to charges for incoming messages and hence is thought to reduce usability of the system. TOTP requires the ...


1

Like the previous two-factor auth scheme, this assumes that you are in possession of your cell phone. Unlike the previous scheme, it doesn't require you to enter any numbers (6 digit security key) into to login. (Keep in mind that since the system hasn't been completely rolled out yet, there could be lots of other information about the security of the ...


1

It is not you logging in on this phone, it is (presumably) you logging in on another device. You get prompted to authorize the login on the other device. That's why the prompt also mentions the device. So now you get a simple yes or no pop-up, rather than a confirmation email, text or setting up a separate security key. In itself it's not more secure, but ...


1

Short answer is that it is undefined. If you want a library that supports both, ensure it explicitly states it supports both OAuth 2 and OIDC. If you were to draw a Venn diagram, OAuth 2 and OIDC intersect each other but OAuth 2 also defines some flows that OIDC does not extend, and OIDC adds a flow that is not in OAuth 2. OAuth 2 flows: Authorization ...


0

The most recent stable version of Chrome (Version 51.0.2704.84) now support extended protection and the SSO experience is similar to IE


2

It depends what you mean by "secure" :) CHAP: Client authentication request send its user name to the server Server responds with a nonce Client calculates hash(nonce|password) and send to the server Server verifies the password Cons: All data is transmitted in clear text i.e. it possible for an attacker to eavesdrop and brute-force the hash offline ...


2

There is no huge security weaknesses with them. Actually, a lot of websites (banks notably) are already using web rendered keypads as part of their customer's website authentication mechanism. While there is still pros and cons, this offers the developers more flexibility than using standard OS input. In particular, the numbers can be presented in random ...


1

No. I would say, that the 2FA device in question, will protect your account more than the password. The idea behind the 2FA device, is to prevent someone remote to you, to access your account. Eg, hacking it from the other side of the globe. (NOTE: Does NOT apply to certain event based tokens with 6/8 digits - see later) However, changing password is a ...


3

Indeed, two factor authentication (2FA) will prevent anyone from accessing an account without having both authentication factors. That being said, the typical implementation of 2FA online is a password paired with a short code, either on a keyfob or sent via SMS. The standard RSA SecurID keyfobs that have been around for a couple decades now and Google's 2 ...


0

Kerberos is an effective protocol that can be used to do this. Details can be found here: https://en.wikipedia.org/wiki/Kerberos_(protocol) . It does require a little setup though. It is a time-sensitive authentication and authorization method. Basically, you get a Ticket-Granting-Ticket from the authentication server, and that gets presented to the Ticket-...


2

I would suggest making t a reduced-precision timestamp instead, where you set the precision to be half of the wish precision. The reason for this, is to both avoid having to send more data than neccessary to the client, which increases security, but also, to be able to filter the data on the server side more effecively, to avoid attacks that rise out of ...


3

SSH actually requires you to configure different keys for different users. Each user account on the destination machine has its own ~/.ssh/authorized_keys (doesn't necessarily have to have, it might not exist). Let's assume you have server and client. server has users set up as follows: /home/srv_user01 /.ssh/authorized_keys ...


1

What you are describing is very similar to PoP/RFC7800 (Proof-of-Possession Key Semantics for JSON Web Tokens). (It's also somewhat similar to what AC/DC (Authorization Cross Domain Code) is trying to do.) With PoP, the proposed steps 1 & 2 are the same: BOB (called Recipient) issues a nonce with the 401 response, Browser (called Presenter) generates a ...


0

Yes. I speak from experience. Our company account has been hacked while we had 2FA in place. Service provider: Amazon AWS The technique: social engineering. The hacker convinced the AWS servicedesk to disable 2FA. The other answers here all talk about hacking your phone, or the website. This "hack" is another route and very effective. If the hacker ...


0

In case of codes sent with SMS or email, in addition to an already mentioned maliciuos app being planted on a device: recently a social engineering hack has been revealed where an attacker sends a message convincing the victim to forward (or input on attacker site) the legitimate authentication message (login attempt from the attacker) that will follow you ...



Top 50 recent answers are included