Tag Info

Hot answers tagged

34

I react exactly the same as you- I first ask them to authenticate themselves to me, after all, they called me. If they can't or won't I tell them that I will call my bank manager/utility rep/whatever and that if this is an official message I should be able to receive it after authenticating the usual way. Don't give in to them- they need motivation to ...


20

Identity is a malleable concept with an irksome tendency to morph whenever you look at it too closely. What I understand from your description is that you want to be able to track back some actions (i.e. "applying for a job") from a random network user back to the actual individual, in such a way that, should the job application be fake in some way, you have ...


20

I generally ask that they give me a call back number so that I can validate their identity. If they give you the number, tell them you will call them back momentarily at that number and validate that it is a number for the company they claim to be. If they get irate, ask to speak to a supervisor, if they still won't play ball, hang up on them and call the ...


16

Displaying a hash of nick and password to identify users is known as Tripcode. There are different variants of this, sometimes the website operator adds a secret key, sometimes an expensive hash like PBKDF2 or bcrypt is used, sometimes the password is replaced by public key.


9

In short, somebody misplaced an OR where an AND should be. Indeed a big mishap on the part of the developer. Your assumptions about its security are correct.


8

Firstly, you are the customer. Getting irate at customers is bad business practice, so real banks train their operators not to act that way (the only companies who can afford to shout at customers are companies who are in the fear management business, i.e. the Mafia, non-democratic governments, and televangelists). Secondly, banks train their customers to ...


7

In the context of communications through a network, an identity is equivalent to the knowledge of a specific piece of data: summarily said, from the outside, what you can know of a given entity from the outside consists exclusively in what bytes that entity emits, i.e. what it can compute. Since everybody can buy the same kind of PC, differences in computing ...


7

There is no way to prevent multiple registrations. I have two suggestions to offer Make multiple registrations undesirable, for example by charging a fee. Outsource the identity problem to someone else, for example my using Facebook or Google login instead of rolling your own.


6

No - given that most users come in from large ISPs, their IPs are not fixed for all time - the names they give to you certainly aren't fixed Security is not a black and white issue - though it seems too many don't seem to understand that - it's an issue of making the cost of defeating it not worth the reward In the general scenario you're describing, ...


6

You can piggyback off someone else's identity verification. For example, to piggyback off banks verification procedures, you can ask the user for a Credit Card number that has their name and billing address, then credit a small randomly chosen amount to that credit card in the local currency, and ask them to tell you how much was credited as proof that they ...


6

Yeah, what you describe looks like a bug. Regardless of the alleged security value of "security questions", or lack thereof, there is no way that "John" can be considered as a valid response to "Where do you live". It is even more than a bug: it is a vulnerability (an even bigger than merely using "security questions" in the first place). Indeed, in your ...


5

Security questions are bad, security questions which ask for your name and place where you live are even worse. The fact that you can use either answer for one question isn't a bug, it's poor coding. Passwords resets by using security questions are bad if they aren't used in combination with something else. For instance, if they ask you questions, but stuff ...


5

Actually an interesting question for that type of site. I was reviewing a similar application where there was the option to submit resumes online - including references. A profile had to be created to register for the site - but as all this required was an email address, the controls around it were very limited. The point was made that malicious person 'A' ...


4

WRT to smart card being used as an authentication factor for computer access, the private key on the smart card can be protected by a PIN/password. So the smart card auth can also provide the additional factor of "what you know" in addition to "what you have." For most users, the risks are acceptable when compared to the cost of managing ...


4

This really depends on the system. Simple key fobs don't do identification -- your identity is simply "someone who is authorized to open the door". More sophisticated systems will have your identity programmed into the card or fob, so that both identity and authentication are established during the unlocking process.


3

The recognition software is just comparing hashes/fingerprints... see: http://en.wikipedia.org/wiki/Acoustic_fingerprint & http://en.wikipedia.org/wiki/Hash_function also might be of interest: http://stackoverflow.com/questions/2068286/music-recognition-and-signal-processing and yes, you can get fake out many of those platforms (for whatever your ...


3

You can verify users against their phone number. Telephone is one of the most commonly used authentication device for identity verification. TeleSign offers a range of phone-based identification and authentication products. Why don’t you browse through their website to get familiar with some of their products? They even have demos on their website that you ...


3

You could prevent multi-registration by increasing your identity proofing (See OMB M-04-04). Of course by doing so, registration is now much more difficult for your legitimate customers. So while you could prevent multi-registration, you probably don't want to. (Please note, I'm not seriously suggesting that you upgrade your identity proofing. Increased ...


3

Identification is a way to describe the principal, e.g. username, email, First + Last name, etc. The principal is the user. Authentication is a way to prove that the principal is who they say they are. So for instance when I log into a system I identify myself with my username (Hi, I'm SteveS), and I authenticate myself by providing a password only I know ...


3

Using simple key to open your room door is a case when authorization happens before and instead of identification and authentication, though it should be the other way around. I would say that in this case the term "identification" does not apply. A smart card however can provide an analogue of your name and password to the system, both "authentication" and ...


2

Accurately fingerprinting a vulnerability scanner by inspecting the HTTP header fields can be inaccurate and inefficient. Pretty much any decent http client will allow you to change/modify/add HTTP headers, so you never know if the user running it has changed those headers. For example, a common open source vulnerability scanner skipfish has flags to mimic ...


2

My answer is short, but this is how I always read the two. Identifying is saying "I'm Joe Schmoe!" Authenticating is proving it with something (password, birth certificate, DNA results). In IT, we need each persone to have seperate IDs so we can properly identify them and assign them rights (I'm Joe Schmoe! Me too! Me three! but we don't all need the same ...


2

nmap+V and amap are old patches and forks of nmap that was used before nmap added version scanning into the core build. Both tools are mostly obsolete now. Even the AMAP website agrees. nmap -sV -V -ip address- The -V flag increases the verbosity of nmap's output, giving you the exact header information that nmap uses to determine what service/version is ...


2

There's also a Nessus Plugin for that. You can find more details here. By the way, this technique is called OS Fingerprinting. You can find more details about it on this Wikipedia Page of course and in this SANS paper.


2

Since you have postal addresses send them a letter via mail merge that contains a long random code. They enter the long random code and perhaps some other information they should know such as D.O.B. to validate they have physical possession of the letter and some knowledge of the student. This tells you they are: Someone with access to the mailing address ...


1

The simple rule to adopt is to never give out a password. As you say, they should be held in an encrypted form and besides, the bank has no need for the password to access your details. The closest they should come is asking for random letters from a 'memorable word or phrase' and that should not be the same as your password.


1

You are right, They don't need to know your password and can verify by Name, Address and DoB. No need to tell them your password and it will most likely be against company rules "Never tell your password to anyone" is always #1 when working with passwords. --EDIT-- I was unaware of other companies issuing a "Billing Password" or another password just for ...


1

Perhaps Remote OS Detection would be of interest to you. And, of course, you can test what you see there with nmap.


1

This post is old, but I thought id metion if you want to learn about IDS/IPS in a more practical environment. I would Download PfSense its pretty easy to set up, and the best way to do it is use things like yersenia and all of the tools in Kali Linux and see how it logs the traffic your giving it. Also Splunk is pretty decent, i have it set up on the DC in ...


1

First of all realize when talking about an IDS we are talking about a passive device. With a passive device they commonly log/alert and nothing else. On the other hand if this device was an IPS that is where the active "shunning" blocking or whatever else it was built to do happens. Much like anti-virus technologies there are two types of network sensing ...



Only top voted, non community-wiki answers of a minimum length are eligible