Skip to main content

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
440 votes
9 answers
317k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
Morten's user avatar
  • 4,553
26 votes
8 answers
4k views

How to protect against brute forcing

How do you properly implement defenses against brute forcing? Is it best to store how many times someone tried to log in and block them after X attempts? And how would "someone" be identified? With ...
Andreas Arnold's user avatar
25 votes
6 answers
38k views

How to set up a single sign-on for multiple domains?

I've set up a single-sign-on for two of our sites that live on the same domain: a.domain.com and b.domain.com I did it through cookies, but they are domain-dependant. And - as it is written in the ...
samy's user avatar
  • 575
13 votes
5 answers
7k views

How can I securely authenticate the client application sending me data?

We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
Jean-Philippe Pellet's user avatar
30 votes
7 answers
4k views

How to secure a WiFi network?

What do I have to do to secure a WiFi network? Is there any best practices? I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
Jonas's user avatar
  • 5,203
26 votes
2 answers
34k views

How does basic HTTP Auth work?

How does basic HTTP Auth work?
Moshe's user avatar
  • 1,861
2 votes
2 answers
7k views

Is it possible to change the admin user/password remotely on a router without logging in? [closed]

Is it possible to change the admin user/password remotely on a router without logging in? If yes, how so?
Moshe's user avatar
  • 1,861
18 votes
3 answers
2k views

Multi factor authentication on Ubuntu workstations, where to start?

Is it possible to have Ubuntu users log in with multi-factor authentication? I was thinking of a combination of pass(word|code) and smartcard (with screen locks when for example smart-card is removed) ...
Peter Smit's user avatar
  • 2,759
3 votes
2 answers
340 views

How does LiveID work? Is there any documentation on the LiveID provisioning site msm.live.com?

I'm trying to learn details on how LiveID works, when compared to other federation technologies. To be honest, I'm a bit overwhelmed by all the options at https://msm.live.com/ and want to understand ...
makerofthings7's user avatar
8 votes
2 answers
8k views

What is the exact difference between SAMLp and WS-Trust?

They seem to be similar on the surface, but I'm not sure how deep the differences are. Can someone explain to me the difference between SAMLp and WS-Trust? ADFSv2 gives me a choice between these ...
makerofthings7's user avatar
7 votes
2 answers
502 views

How is the password prompt going to protect me from ruining my computer?

On Unix based systems, I'm often prompted to enter my password before installing or running a program. Why does this protect me? If I'm running a kiosk, I understand that a password might prevent ...
Moshe's user avatar
  • 1,861
7 votes
2 answers
1k views

How effective is the Mac Open Firmware password protection?

I have used Mac's Open Firmware password protection before and I've always wondered how effective it actually is at protecting my stuff. [assuming a good password] Would does the firmware password ...
Mike Grace's user avatar
10 votes
1 answer
563 views

What shell binary should I use for the root account on a Linux system?

Is there a security advantage to using a different shell for the root account, either a hardened shell program, or simply a shell binary stored in a non-standard location?
david-ocallaghan's user avatar
11 votes
1 answer
1k views

How to properly generate and use (m)TANs?

If you have an application that uses transaction authentication numbers (TAN) or mobile TANs, how do you generate them correctly? What are the pitfalls? And should you only allow the next number on ...
Andreas Arnold's user avatar
12 votes
3 answers
2k views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the key/password/...
Phoenician-Eagle's user avatar
24 votes
4 answers
2k views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...
rem's user avatar
  • 2,127
22 votes
1 answer
3k views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
Jonas's user avatar
  • 5,203
66 votes
6 answers
35k views

How to Securely Implement a "Remember Me" Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
colithium's user avatar
  • 873
24 votes
5 answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
James T's user avatar
  • 1,883

1
87 88 89 90
91