Tag Info

Hot answers tagged

33

I react exactly the same as you- I first ask them to authenticate themselves to me, after all, they called me. If they can't or won't I tell them that I will call my bank manager/utility rep/whatever and that if this is an official message I should be able to receive it after authenticating the usual way. Don't give in to them- they need motivation to ...


20

Identity is a malleable concept with an irksome tendency to morph whenever you look at it too closely. What I understand from your description is that you want to be able to track back some actions (i.e. "applying for a job") from a random network user back to the actual individual, in such a way that, should the job application be fake in some way, you have ...


19

I generally ask that they give me a call back number so that I can validate their identity. If they give you the number, tell them you will call them back momentarily at that number and validate that it is a number for the company they claim to be. If they get irate, ask to speak to a supervisor, if they still won't play ball, hang up on them and call the ...


8

Firstly, you are the customer. Getting irate at customers is bad business practice, so real banks train their operators not to act that way (the only companies who can afford to shout at customers are companies who are in the fear management business, i.e. the Mafia, non-democratic governments, and televangelists). Secondly, banks train their customers to ...


7

In the context of communications through a network, an identity is equivalent to the knowledge of a specific piece of data: summarily said, from the outside, what you can know of a given entity from the outside consists exclusively in what bytes that entity emits, i.e. what it can compute. Since everybody can buy the same kind of PC, differences in computing ...


6

There is no way to prevent multiple registrations. I have two suggestions to offer Make multiple registrations undesirable, for example by charging a fee. Outsource the identity problem to someone else, for example my using Facebook or Google login instead of rolling your own.


6

No - given that most users come in from large ISPs, their IPs are not fixed for all time - the names they give to you certainly aren't fixed Security is not a black and white issue - though it seems too many don't seem to understand that - it's an issue of making the cost of defeating it not worth the reward In the general scenario you're describing, ...


6

You can piggyback off someone else's identity verification. For example, to piggyback off banks verification procedures, you can ask the user for a Credit Card number that has their name and billing address, then credit a small randomly chosen amount to that credit card in the local currency, and ask them to tell you how much was credited as proof that they ...


6

Yeah, what you describe looks like a bug. Regardless of the alleged security value of "security questions", or lack thereof, there is no way that "John" can be considered as a valid response to "Where do you live". It is even more than a bug: it is a vulnerability (an even bigger than merely using "security questions" in the first place). Indeed, in your ...


5

Security questions are bad, security questions which ask for your name and place where you live are even worse. The fact that you can use either answer for one question isn't a bug, it's poor coding. Passwords resets by using security questions are bad if they aren't used in combination with something else. For instance, if they ask you questions, but stuff ...


5

Actually an interesting question for that type of site. I was reviewing a similar application where there was the option to submit resumes online - including references. A profile had to be created to register for the site - but as all this required was an email address, the controls around it were very limited. The point was made that malicious person 'A' ...


4

WRT to smart card being used as an authentication factor for computer access, the private key on the smart card can be protected by a PIN/password. So the smart card auth can also provide the additional factor of "what you know" in addition to "what you have." For most users, the risks are acceptable when compared to the cost of managing ...


3

Identification is a way to describe the principal, e.g. username, email, First + Last name, etc. The principal is the user. Authentication is a way to prove that the principal is who they say they are. So for instance when I log into a system I identify myself with my username (Hi, I'm SteveS), and I authenticate myself by providing a password only I know ...


3

The recognition software is just comparing hashes/fingerprints... see: http://en.wikipedia.org/wiki/Acoustic_fingerprint & http://en.wikipedia.org/wiki/Hash_function also might be of interest: http://stackoverflow.com/questions/2068286/music-recognition-and-signal-processing and yes, you can get fake out many of those platforms (for whatever your ...


3

You can verify users against their phone number. Telephone is one of the most commonly used authentication device for identity verification. TeleSign offers a range of phone-based identification and authentication products. Why don’t you browse through their website to get familiar with some of their products? They even have demos on their website that you ...


3

You could prevent multi-registration by increasing your identity proofing (See OMB M-04-04). Of course by doing so, registration is now much more difficult for your legitimate customers. So while you could prevent multi-registration, you probably don't want to. (Please note, I'm not seriously suggesting that you upgrade your identity proofing. Increased ...


2

nmap+V and amap are old patches and forks of nmap that was used before nmap added version scanning into the core build. Both tools are mostly obsolete now. Even the AMAP website agrees. nmap -sV -V -ip address- The -V flag increases the verbosity of nmap's output, giving you the exact header information that nmap uses to determine what service/version is ...


2

My answer is short, but this is how I always read the two. Identifying is saying "I'm Joe Schmoe!" Authenticating is proving it with something (password, birth certificate, DNA results). In IT, we need each persone to have seperate IDs so we can properly identify them and assign them rights (I'm Joe Schmoe! Me too! Me three! but we don't all need the same ...


2

Accurately fingerprinting a vulnerability scanner by inspecting the HTTP header fields can be inaccurate and inefficient. Pretty much any decent http client will allow you to change/modify/add HTTP headers, so you never know if the user running it has changed those headers. For example, a common open source vulnerability scanner skipfish has flags to mimic ...


2

There's also a Nessus Plugin for that. You can find more details here. By the way, this technique is called OS Fingerprinting. You can find more details about it on this Wikipedia Page of course and in this SANS paper.


1

If you have confidence in the security of Gmail's servers, and since the communication between your machine and Gmail uses SSL, this leads to an unescapable conclusion: the vulnerability is on your side. Ill-intentioned people could took some control of your machine, or learned your password, or both. If they could run their nefarious code on your computer, ...


1

First of all realize when talking about an IDS we are talking about a passive device. With a passive device they commonly log/alert and nothing else. On the other hand if this device was an IPS that is where the active "shunning" blocking or whatever else it was built to do happens. Much like anti-virus technologies there are two types of network sensing ...


1

A practical and secure approach is to use SSL with client certificates, which is probably similar to your existing approach. One way of doing this is that every server has a private key and a self-signed certificate, and also the certificate of every server it needs to talk to. So when an application server connects to a data server, both ends present their ...


1

Why match IP to username? Why not simply match MAC address to their ID? Then it doesn't matter what the IP address is. The only issue is whether they will/can spoof their MAC address, although, if you are in a wired environment, you can set MAC filters on the switches since you know the MAC addresses, and alerts on MAC table flooding. All this is ...


1

Using a simple explanation Identification: is how you identify someone, i.e., how you would call that person or company. Could be the name, the account number in a bank, the username in some specific system. Authentication: is how you confirm that a person, who is doing something in your system, is really who he says. He can prove that by giving something ...



Only top voted, non community-wiki answers of a minimum length are eligible