Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

-1
votes
1answer
22 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
-1
votes
4answers
44 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
1
vote
0answers
7 views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
0
votes
1answer
44 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
0
votes
0answers
12 views

Digital Signature on a Passive RFID tag with small-ish memory constraints

I'm pretty new to the crypto and security worlds and I'm looking for some guidance. Briefly, my project involves Widgets (physical items that need to be authenticated) and Gadgets (physical machines ...
0
votes
2answers
91 views

How secure is the hashing/salting/stretching process as described in this diagram?

Question I was just brainstorming about the hashing, stretching, salting part of the user password in the authentication process and I want it to be as secure as possible (no matter how paranoid that ...
1
vote
1answer
20 views

does openssh support authentication using public key fingerprints?

Cisco have two ways of enabling public key authentication: using the public key and using the public key hash. ip ssh pubkey-chain username <user> key-string <public key> OR ...
0
votes
0answers
12 views

Mutual authentication between devices [on hold]

I have clear understanding of mutual authentication and I'm now trying to implement it just for testing purposes. Here is my scenario: I have a Linux machine A which acts as a self-signed CA. Now ...
0
votes
0answers
17 views

Application specific password tools/papers?

We have our users/groups managed by an LDAP system. We would like to move away from logins to all internal systems using the main LDAP password but still want to centrally manage user accounts. We ...
0
votes
1answer
28 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
2
votes
3answers
89 views

What security does the new option for two factor authentication that Google offers enforce?

Google has announced a new option for two factor authentication - a popup message. How does this improve security?
4
votes
2answers
61 views

Is CHAP authentication still secure?

Assuming the use of the default hashing algorithm MD5, is CHAP authentication still secure? I appreciate that MD5 is considered broken in terms of collision resistance, but I also understand that in ...
0
votes
0answers
16 views

Mifare cards authentication

I have few questions about Mifare authentication: 1) Can you confirm me that the authentication between the reader and the tag is as follow: the reader send the correct key to the tag for the sector ...
1
vote
0answers
17 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
3
votes
1answer
47 views

PIN Entry via HTML rendered Keypad

I have a web application that replaces a non-web predecessor. A low level set of users accessed basic functionality with touch panels in the non-web previous version of the product with the touch ...
1
vote
2answers
65 views

Periodic password change needed when using 2-step verification?

I know that it's considered good online security hygiene to change one's login passwords every 6 months or so. Is that needed on sites with 2-step verification? Isn't the 2nd step what will keep my ...
4
votes
2answers
97 views

Time Based Authentication Verification Token

I'm building a long-lived session system which requires that users verify their authentication before performing "dangerous" operations, such as changing critical settings, deleting their account, etc....
0
votes
0answers
31 views

Out source Authentication Service with PIN [closed]

I'm working on a mobile application project that requires PIN authentication. The majority of external services we have reviewed are your typical Email / Password authentication. The only PIN ...
0
votes
1answer
43 views

How to configure SSH public key per user?

I have an OpenSSH server running and different users can log into it with different privileges. I know you can enable public key authentication and place all the allowed public keys in the ...
-1
votes
5answers
160 views

Is it possible to bypass two step authentication process?

Is it possible for a hacker to bypass two step authentication process if the hacker has no physical access to my phone?
2
votes
2answers
80 views

For 2FA, is one method better (more secure) than another?

There are a variety of options available for 2FA - LastPass, for example, offers all of the following options: LastPass Authenticator Duo Security Authentication Google Authenticator Yubikey ...
4
votes
1answer
64 views

How can I be sure if a webview in a desktop app shows the real web page?

When installing Postman (on Mac), you can log on using your Google account. For this, the logon view from Google is shown in a window (A kind of Webview I assume). How can I be sure this is the real ...
0
votes
1answer
29 views

Securing application-application communication from devs and admin

Scenario: I have an application A which holds sensitive data. I have an application B which needs to process the data. A will provide a web-interface. B will make calls to get required data from A. ...
1
vote
1answer
79 views

TLSv1: Reason for client not sending client certificate

Our BizTalk installation consists of two load balanced nodes B1 (10.137.10.1) and B2 (10.137.10.2) which process and route incoming SOAP messages. The processing is nothing more than: sending the ...
0
votes
0answers
34 views

Best practice regarding secure administration on lots of embedded Linux devices [duplicate]

Lets say I've a lot of embedded Linux devices, like 100. How do I access and administer these devices securely? Is it best practice create a key pair and put the put the public key on all the devices?...
3
votes
3answers
94 views

How does Single Sign On limit phishing risk

I was reading this article about SSO benefits and this sentence intrigues me : Can reduce phishing – Phishing, a fraudulent process where victims are tricked into giving away sensitive user ...
3
votes
2answers
73 views

Useless 2FA in case of inside attacker

Suppose a server-side signing scenario, where user keys are generated in a HSM and exported to a database, encrypted with a symmetric key derived from a user password and HSM's master key. To sign, ...
2
votes
0answers
17 views

Secure userserver authentication with authserver

So, lets say we have Bob, Alice and Peter. Peter is trusted by Bob and Peter has an authserver. Bob hosts a userserver and Alice wants to connect to Bob over an insecure channel. But Bob needs to know ...
-1
votes
0answers
75 views

What is a WAM style session token?

Does anybody know what a WAM session token is? This appears to be something related to ping-identity; but I am just wondering whether this is a standard or not. If you know about this, please do also ...
1
vote
1answer
40 views

Secure multiserver authentication

I was reading answers in How to split login and game logic when writing servers?. Read that first. Now, I want to know whenever this method will work and how can it be broken. I think there might be ...
3
votes
2answers
120 views

Is it secure: unsecured Wi-Fi + social network authentication to access the web?

Recently I visited my dental office and noticed a Wi-Fi configuration I haven't seen before. First, there is unsecured (no password) Wi-Fi, but I cannot surf the web yet. I am redirected to a webpage ...
5
votes
2answers
874 views

Why is whatsapp using 6 digit codes for verification?

My question is kind a simple. Why does whatsapp use 6 digit codes to verify the device? They could also use 5 or 7+ digits and or alphanumeric characters. Are there any reasons they chose exactly 6?
0
votes
3answers
51 views

How does a Safenet eToken Pass(hardware token) generates OTP and based on which algorithm? How does authentication takes place against it?

I use hard token to login to a VPN but I don't get the concept behind it.The password is combination of a self generated PIN + OTP generated on eToekn Pass. How do authentication takes place at back ...
3
votes
1answer
39 views

Smartcard authentication SSH remote client

I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation: My desktop computer with smartcard has a ssh session to ...
-2
votes
3answers
72 views

What safeguards are taken when a login system only requires a PIN and no username? [closed]

The gym I go to gives its customers access to the building by giving them a 6 digit PIN code which they must type in on a keypad when they want to enter/exit the gym. Does the person who was added ...
1
vote
1answer
56 views

Why mobile phone app sessoins are never timed out?

This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login. These mobile apps call web ...
-3
votes
0answers
72 views

Alternate SSH authenticate

I was doing a little bit of research on how SSH actually authenticates a user and different things. And I came across a document which nicely explains how SSH authentication works which is something ...
-1
votes
1answer
27 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
7
votes
2answers
126 views

Why not make the second factor the only factor? [duplicate]

Most websites use a single-factor based authentication mechanism, the password. Some popular websites, however, also implement an (often optional) two-factor mechanism to log in; usually requiring the ...
0
votes
1answer
30 views

How to connect to Windows RDP and delegate authentication to a (reverse) proxy?

Looking for the following setup: Client connects to Windows RDP server through proxy server. The client is in public network hence can't send username/password for logon. The proxy server in between ...
0
votes
0answers
25 views

bundling session information in a binary

We are in the process of developing a desktop app. When a user is logged into the website we create a dynamic binary(.exe) and add session information to that binary which is valid for one time login. ...