2022 Developer Survey is open! Take survey.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
5 votes
3 answers
384 views

Choosing an authenticated encryption cipher mode without associated data

In the application I'm writing there is need for a huge amount of private data transfer on the order of eighty gigabytes, but there is no public data. I'm looking especially to gain bandwidth/...
user avatar
  • 1,752
13 votes
1 answer
4k views

What is the purpose of AEAD?

I think I need to correct some misunderstandings I have about AEAD. What is associated data used for in authenticated encryption?
user avatar
  • 1,752
19 votes
6 answers
3k views

Is this login security enough?

I'm coming up with my next login system for admins of an e-commerce website, which will have this: login form is SSL secured password is converted to SHA-256 before being transmitted (bcrypt is too ...
user avatar
  • 341
9 votes
3 answers
1k views

Which authentication at the end of the Secure Remote Password protocol?

For the the client and server to prove to each other that they have the same premaster shared key, the original author suggests this: M = H(A | B | K) --> <-- H(A | M | K) The ...
user avatar
  • 1,752
7 votes
2 answers
1k views

How does external authentication work?

For example, I can log in to stackexchange websites by logging in to external websites such as OpenID, Yahoo, etc. How does this work? How do the websites (SE and Yahoo!, for example) communicate? How ...
user avatar
  • 395
19 votes
2 answers
10k views

Secure communication between applications using SSL Certificates

I am looking for a way how to secure communication between our applications. There is a "server" application listening on some TCP port and "client" application which is communicating with the "server"...
user avatar
  • 1,840
9 votes
1 answer
637 views

Optimal variable sizes in the Secure Remote Password protocol

I am implementing the Secure Remote Password protocol: U = <username> --> <-- s = <salt from passwd file> a = random() A = g^a %...
user avatar
  • 1,752
7 votes
2 answers
1k views

Implementing Secure Remote Password: Constructing the verifier

The SRP protocol as described in RFC 2945 generates the password verifier: x = SHA(<salt> | SHA(<username> | ":" | <raw password>))` v = g^x % N I have three questions: ...
user avatar
  • 1,752
18 votes
2 answers
6k views

Encryption strategies for multi users access in production systems

I am pretty unknown to encryption strategies in production environments. So my concern is to find a solution how to strongly encrypt data, but make it available to multiple users with different keys. ...
user avatar
  • 419
24 votes
2 answers
9k views

Why is it always `HASH( salt + password )` that we recommend?

Browsing over this site, many forums, online articles, there's always one specific way we're suggesting to store a password hash: function (salt, pass) { return ( StrongHash(salt + pass) ); } But ...
user avatar
  • 5,134
7 votes
3 answers
2k views

Using Secure Remote Password without sending the username in the clear

To initiate a key exchange using the SRP protocol the client sends the username so the server can look up the salt and password verifier. Is there a simple way to change this so that an evesdropper ...
user avatar
  • 1,752
6 votes
1 answer
585 views

Using Secure Remote Password without embedding the modulus

The SRP protocol as described by the author assumes that the large safe prime modulus and generator are embedded into the client and server rather than being transmitted as part of the protocol. ...
user avatar
  • 1,752
12 votes
2 answers
8k views

Obtain credentials by spoofing WPA/WPA2 Enterprise network?

I have a large scale wireless network secured using WPA/WPA2 Enterprise authentication. Recently, I was made aware of the possibility that someone may use a dd-wrt router and a computer to spoof the ...
user avatar
  • 450
14 votes
2 answers
8k views

Hiding user account names from unauthenticated RDP sessions

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The ...
user avatar
  • 27k
0 votes
1 answer
172 views

WLAN Router authentification [duplicate]

Possible Duplicate: How can I ensure that I connect to the right wireless Access Point? Is it true, that WLAN routers aren't authenticated by clients? The only "authentication" is SSID and field ...
user avatar
  • 9
4 votes
4 answers
2k views

Ensuring a web-service only processes requests from specific computers

I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the ...
user avatar
  • 143
14 votes
5 answers
3k views

Is there a digital "safety deposit box" equivalent?

Digital safety deposit boxes: do they exist? if yes, are (any|they) trustworthy? There are many bricks and mortar financial institutions where one can rent a locked box in a locked room and be ...
user avatar
9 votes
2 answers
1k views

Any advantage to securing WiFi with a PSK, other than to keep out unauthorized

As I understand WiFi with a PSK, such as WPA(2)-PSK or WEP, anyone on the same network can decrypt anyone elses packets because everybody has the same key. In which case, if you are not going to ...
user avatar
  • 3,476
10 votes
6 answers
6k views

Is denying login after incorrect attempts ineffective?

Generally denying login attempts after X amounts of incorrect attempts for Y amount of tries is a very basic way to prevent bruteforce attempts or malicious login attempts. Yet, surely doing this is ...
user avatar
  • 3,476
9 votes
2 answers
758 views

How do you Secure VOIP in a large organization

As part of a large organization looking to implement VoIP, to get on the bandwagon of savings and converged network focus, I'm being asked to look at the security concerns to develop a policy to help ...
user avatar
  • 2,787
8 votes
2 answers
574 views

Is the argument really over on SSO?

I got shot down on ServerFault recently for suggesting that SSO can be less secure than having different credentials for each service. What are the arguments against SSO?
user avatar
8 votes
5 answers
596 views

Oldest security feature still in active use

Beyond commonsense and physical access controls, is the system password the oldest still in active use security feature? By physical access, I mean for example leaving the system within a secure space....
user avatar
  • 5,042
10 votes
4 answers
873 views

Does OpenID, SAML pose a threat to Tor's anonymity? How can I protect from a compromised .exit node?

This is a thought experiment on the interaction between Tor, OpenID and one (or more) compromised nodes in the secure path. I'm focused on how to use technology in a way that adds value to a secure ...
user avatar
1 vote
2 answers
869 views

Can you pick up any device specific information by monitoring bluetooth signals? [closed]

Could I use some sort of permanent device ID broadcasted by the bluetooth radio in my phone to do something like unlock my door? I don't want to have to ever pair the device, or take it out of my ...
user avatar
  • 129
7 votes
3 answers
6k views

Is the OpenPGP private key inherently password-protected?

I know I am required to enter a password every time I use my OpenPGP key. Is this done via software implementation or is it a property inherent to the protocol, and therefore the key? Essentially, ...
user avatar
  • 27k
1 vote
1 answer
1k views

How do security questions work? [duplicate]

Possible Duplicate: Do security questions subvert passwords? Is it true that on some websites (e.g.: free webmail) there are "security questions" - if the user forgets about his password he could ...
user avatar
  • 6,109
18 votes
3 answers
9k views

Should security question answers be case-sensitive?

Question In the case of security questions being used to reset an account password, what is considered best practice for handling case-sensitivity on the security question answers? Scenario An ...
user avatar
3 votes
1 answer
2k views

Open source centralized authentication for heterogeneous network

I'd like to centralize all authentication on my network using something like an LDAP server. Clients consist of Windows and Linux servers. I'm looking to manage authentication for virtualized ...
user avatar
3 votes
0 answers
268 views

Theory behind RSA SecureID/Lockheed attack

Unless I missed something I don't think RSA/EMC came out and said publicly what was stolen earlier this year when they were compromised. So I know the answers to this question will be conjecture. That ...
user avatar
  • 175
3 votes
0 answers
247 views

Files for download and their hash numbers

I'm far from being an expert in the IT security and I have this maybe naive question. Many downloadable files are deployed on websites together with the corresponding hash numbers to ensure their ...
user avatar
  • 191
4 votes
2 answers
999 views

Attack vectors in POSTing variables from one php script to the next?

I have an application which is structured in the following way for its signup page. After this signup, the user is directly granted access into the system - there is no email verification (as intended)...
user avatar
30 votes
10 answers
6k views

How can I ensure that I connect to the right wireless Access Point?

Under Windows/Linux, client side. How can I ensure that I'm not connecting to a rogue AP?
user avatar
  • 6,109
53 votes
10 answers
6k views

Isn't OAuth, OpenID, Facebook Connect, and others crazy from a security standpoint?

I work with APIs all the time and I work with web developers who insist that OAuth, OpenID, etc are far superior than a home-brew method. Every site seems to be using these as well now for ease of use ...
user avatar
53 votes
7 answers
5k views

Do security questions subvert passwords?

Do security questions subvert hard to crack passwords? For example, if a site requires passwords with a certain scheme (length + required character sets) and has a security question, why would someone ...
user avatar
19 votes
4 answers
10k views

How to implement non-password authentication in a web site

In an answer to this question about pw reset, D.W. says: Lastly, consider non-password authentication. Passwords have many problems as an authentication mechanism, and you might consider other ...
user avatar
  • 293
16 votes
4 answers
460 views

Are malicious relying parties able to abuse OpenID logins?

if I logon with OpenID into a website (crafted by attackers/hackers) I want to know how much damage can they do to me? Are they able to steal my contact info, name, etc (assuming I'm using Gmail ...
user avatar
  • 3,253
203 votes
4 answers
62k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice? Should I ...
user avatar
  • 5,134
27 votes
9 answers
4k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
user avatar
  • 5,134
21 votes
7 answers
2k views

Appropriate password requirements for a login (OpenID) service/provider/delegate/thing

This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case ...
user avatar
7 votes
2 answers
6k views

Verify SAML Response is from a Trusted Source

I'm in the process of making changes to my site so that we can be a SAML 2.0 Service Provider. We will be doing IdP initiated SAML with Out-of-Band account federation. My question is this: Given a ...
user avatar
76 votes
6 answers
18k views

Is using a public-key for logging in to SSH any better than saving a password?

Using a public/private key pair is fairly convenient for logging in to frequented hosts, but if I'm using a key pair with no password, is that any safer (or less safe) than a password? The security ...
user avatar
  • 3,372
32 votes
4 answers
4k views

How is "something you have" typically defined for "two-factor" authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
user avatar
  • 20.5k
9 votes
4 answers
3k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
user avatar
  • 975
105 votes
7 answers
144k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
user avatar
  • 1,247
6 votes
2 answers
4k views

TLS at layer 4 BUT 802.1X EAP-TLS at layer 2?

In the CISSP books, SSL/TLS has been through the arguments and fell rest onto the transport layer 2 instead of the session. OK - Fine. Port security 802.1X and EAP is a data link layer 2 ...
user avatar
  • 511
8 votes
2 answers
723 views

Is there a way to negotiate a secret between 2 parties with no prior knowledge?

Is there a way for 2 parties to negotiate a shared secret (for example, a session key) without having a pre-shared knowledge? SSL does this by using asymmetric encryption. Is there any other way to ...
user avatar
  • 198
6 votes
8 answers
1k views

Biometric authentication in the real world

can anyone give a realistic estimation, based on real-world experience, of how much biometric authentication techniques are being used in the IT field?
user avatar
30 votes
5 answers
5k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
user avatar
  • 1,662
24 votes
4 answers
7k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
user avatar
48 votes
2 answers
25k views

HMAC - Why not HMAC for password storage?

Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. Let's say ...
user avatar
  • 5,799