Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
5
votes
2answers
769 views

System for Mutual authenticaion and confidentiality

I am looking for a protocol where there needs to be mutual authentication between client and server. For example server should connect to a particular client only. That is client should authenticate ...
4
votes
1answer
400 views

How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?

I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
7
votes
1answer
589 views

OpenPGP Encryption / Decryption Process Using GnuPG

I want to know if my method of encryption can ensure the security of my data if my database was hacked as well as the authenticity of the data I am decrypting. I am using GnuPG's implementation of the ...
9
votes
2answers
3k views

How do I log everything a certain program is doing?

i have a program which is pretty simple. Its just a simple login form. Is there any possibility to log what this program is doing (maybe which file he is accessing and which website he is visiting (...
2
votes
1answer
116 views

Is there a drawback for local log in compared to server log in?

For developing a mobile app, there is a choice of storing usernames and password data in the device itself, or in a server (user will be authenticated to a server). Other than possibly the user have ...
6
votes
2answers
2k views

What flaws lie behind HttpContext.Current object i .NET?

I'm into extend a authenticating service and like to ask about the security perspective of HttpContext.Current. Let say you have a authentication serve websites / wcf and such (where http is ...
10
votes
3answers
626 views

Is there any conceivable reason to prevent a password change in an authentication system?

I connect to the VPN of another company with a company-specific username and password (they aren't giving everyone the same password to every company to access it or anything ridiculous like that.) ...
62
votes
4answers
19k views

Is posting from HTTP to HTTPS a bad practice?

Working on the assumption that SSL serves both to encrypt data and to provide assurance as to the identity and legitimacy of the website, should the practice of providing a logon form on a page ...
21
votes
3answers
523 views

Isn't openid with http an issue?

Many openid enabled sites default to http identifiers, even if the openid provider supports https (such as myopenid.com). Does this pose a threat beside the identity being exposed? The second step of ...
3
votes
1answer
159 views

What are the implications of omitting the username in Secure Remote Password's verifier?

I consider implementing a Secure Remote Password (SRP-6a) verifier that omits the username from the x key hash. The intention is to allow authentication with multiple alternate user identifiers such ...
3
votes
0answers
739 views

When to move from Container managed security to alternatives like Apache Shiro, Spring Security? [closed]

I am trying to secure my application which is built using JSF2.0. I am confused about when do people choose to go with security alternatives like Shiro, Spring Security or owasp's esapi leaving ...
22
votes
5answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
5
votes
2answers
2k views

How do Azure ACS 2.0 security features compare to ADFS 2.0?

I'm configuring my relying party (a website) to use either ADFS or Azure ACS 2.0. ADFS 2.0 has some interesting features such as Token Replay prevention (in the SQL version) and may have other SAML ...
1
vote
1answer
676 views

What risk can untrusted WS-Federation metadata pose?

I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk. Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the risk,...
6
votes
2answers
784 views

How can I authenticate a client connection in a secure way?

Let's say I have a server listening on port 1234. I have some client software that needs to be able to connect to this port. But I want to prevent malicious users from bypassing the client software ...
5
votes
3answers
3k views

storing the third party credentials in the database/some secure place

This question is about storing the third party credentials in the database/some secure place so that it can not be accessed by only authorized user. Our system connect to the third party system using ...
6
votes
3answers
224 views

Requiring Authentication to Exit

I've often wondered why facilities do not require authentication as a default on exit. Beyond the oblivious reasons: Fire safety policies would require a panic mechanism to override the access ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
4
votes
3answers
252 views

What alternatives do email services provide when an account is hacked?

I am concerned about how does email services like Yahoo, Gmail, Hotmail etc provide security to their costumers and prevent their account from being compromised. For example, I have seen that if ...
6
votes
4answers
878 views

Secure Web Password Fields + http to https redirect

I'm a software developer but I'm marking my niche in secure development. It turns out that while using WebScarab, I discovered that a popular user group site doesn't appear to properly take care of ...
14
votes
9answers
1k views

Anybody have additional information on the EMC RSA SecurID compromise?

The Security Advisory Press Release here doesn't have much information, the email that alerted me to this didn't help much more, and unfortunately I heard about the two Thursday evening conference ...
7
votes
8answers
2k views

Is the following authentication scheme secure?

I was trying to design an authentication system that would make it much harder to guess a password via brute force, and reduce the risk to a user if the hashed password was stolen through a snooping ...
1
vote
4answers
450 views

“Who the entity knows.” I've Googled for weeks and can't find results

A lecture slide mentioned methods of authentication, one of them being. Who the entity knows. But the lecturer said it was up to me to research it. I've Googled as hard as I can but to no avail :( I ...
7
votes
2answers
526 views

Why do some online banking sites (and others who desire secure login pages) sometimes add autocomplete=“off” on their login page input fields?

For example: http://www.natwest.com/x-user.ashx?redirect=trusteer.interstitial.url&condition=trusteer.enabled2%3Dtrue <input name="...." type="text" maxlength="10" id="...
2
votes
1answer
2k views

How does a BlackBerry handheld connect to BES?

How does a Blackberry device connect to BlackBerry Enterprise Server (BES) for the first time? What are the security mechanisms used to protect against a rogue BlackBerry handheld trying to connect to ...
2
votes
1answer
1k views

NFS and encrypted File systems

Can a NFS mounted file system be used for encrypted /home, and can the encrypted Home Directories be mounted/decrypted for the user when they login?
16
votes
3answers
654 views

Does signing out of a website ensure no-one can cookie hack?

If I click the signout link of a website, does this mean it is not possible for someone to hijack my cookie and sign in with it? While I'm logged in, is it possible for someone who has access to my ...
8
votes
5answers
461 views

How to verify new accounts against a known persons database?

I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
0
votes
0answers
84 views

Pages restricted to certain IPs, safe? [duplicate]

Possible Duplicate: In what scenarios is relying on source IP address as a security control acceptable/unacceptable? If a website has a page which only renders for certain IPs, is there anything ...
6
votes
2answers
2k views

Is Access Control Through MAC ADDRESS a practical/secure solution

I run a small local gaming website with a custom admin panel I coded to let trusted members do administrative tasks through the software's API. Since their IP Address is dynamic, can I authenticate ...
5
votes
1answer
324 views

Using AD authentication in a publicly accessible webapp

I am sys admin working with a development team who is extending a publically accessible .net web app that currently uses forms authentication with usernames/passwords (hashed) stored in a sql database....
6
votes
2answers
2k views

Frameworks or any Solutions for authentications/security/ login management in Java Web Applications

I am looking for a framework/solution for authentication/ user-login management/ security in java web application that can make the naive developer's job easier/faster and make the application ...
16
votes
5answers
2k views

Does two factor authentication prevent social engineering attacks

After reading this article from symantec I got to think how much all these social engineering techniques rely on the authentication system of users, a password. Considering three different additional ...
4
votes
3answers
640 views

Locking down web-based admin areas with personal SSL certificates

I've been tasked to setup a secure platform, where I've been asked to assign personal SSL certificates to administrators, and have the server only allow persons into the administration areas that have ...
3
votes
2answers
1k views

OAuth User revoke token

I haven't read it myself but a colleague told me that the end-user can revoke his/her OAuth token. I searched but I couldn't find enough docs on: is this true / is the end-user the one to revoke the ...
7
votes
3answers
2k views

chosen plaintext attacks against MD5 and SHA1

According to http://tools.ietf.org/html/rfc2617#section-4.9, having the server chose a nonce but not having the client chose a nonce opens up Digest Access authentication to chosen plaintext attacks. ...
10
votes
2answers
4k views

How does openid implement Single sign on?

I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
1
vote
2answers
285 views

TCrypto - Comments about design decisions I made?

I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
2
votes
1answer
1k views

iOS/Android authentication and security

Here is what I am trying to do and can anyone provide some best practice advice for authentication and security? Each user will have their own private database on the cloud. He will have his local ...
10
votes
4answers
6k views

How to protect ftp account information in the source code of a program

I wrote a game which stores high score information on an ftp server. In the the source code I need to write out the ftp link with the account name and password in it. For example: url = new URL("ftp:...
8
votes
3answers
1k views

zero knowledge proof and its protocol

In Zero-Knowledge Proof where we take the analogy of Peggy (Prover) and Victor (Verifier): In this story, Peggy has uncovered the secret word used to open a magic door in a cave. The cave is shaped ...
7
votes
1answer
3k views

Deploying a campus WiFi network that authenticates against an AD LDAP

We are looking to deploy about 15-20 Cisco 1131ag access points on campus. I have been reading up on different authentication methods, but I don’t know what will be the best long term solution that ...
9
votes
2answers
1k views

Is a rand from glibc's rand secure for a login key?

Same question as Is a rand from /dev/urandom secure for a login key, but with glibc's rand function instead of /dev/urandom. And what would be a sufficiently secure seed generator?
5
votes
3answers
325 views

Choosing an authenticated encryption cipher mode without associated data

In the application I'm writing there is need for a huge amount of private data transfer on the order of eighty gigabytes, but there is no public data. I'm looking especially to gain bandwidth/...
7
votes
2answers
1k views

How does external authentication work?

For example, I can log in to stackexchange websites by logging in to external websites such as OpenID, Yahoo, etc. How does this work? How do the websites (SE and Yahoo!, for example) communicate? How ...
9
votes
3answers
593 views

Are there any smartcard/hardware-tokens for certificate-based authentication which are easily destroyed?

It's all very well to use multi-factor authentication, but supposing you want to 'destroy a factor' so that in an situation where you are likely to be coerced to provide your passphrase, you can ...
0
votes
1answer
130 views

WLAN Router authentification [duplicate]

Possible Duplicate: How can I ensure that I connect to the right wireless Access Point? Is it true, that WLAN routers aren't authenticated by clients? The only "authentication" is SSID and field ...
4
votes
4answers
1k views

Ensuring a web-service only processes requests from specific computers

I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the ...
9
votes
2answers
704 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
8
votes
2answers
524 views

Is the argument really over on SSO?

I got shot down on ServerFault recently for suggesting that SSO can be less secure than having different credentials for each service. What are the arguments against SSO?