Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

432 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0
votes
0answers
106 views

How to combine a preshared key and a shared secret

What is the best way to combine a shared secret generated using elliptic curve diffie-hellman, and a pre-shared key file. I want a way to make sure that both correct keys are being used not just the ...
0
votes
0answers
141 views

To implement EAP-TLS for BYOD devices on a campus wireless network, should you use only machine authentication?

Like why would you need user authentication? If someone has an iPhone and is a member of the campus, he would only need a machine certificate for his iPhone so that only it can connect to the network ...
0
votes
0answers
125 views

Automatic login after registration

After a user has registered a new account I want the new user of my site to be logged in automatically, i.e. an automatic login after registration. The registration is a JavaScript application. When ...
0
votes
0answers
79 views

Possible Session Key Security Weakness

I found a website that generates its session keys by hashing the userid (more or less public data) and the password together with MD5. Sessionkey = md5sum(userid+password) I am fairly new to this ...
0
votes
0answers
204 views

Generally speaking, how does the Facebook JavaScript SDK provide authentication?

I'm looking for a high level overview of how the Facebook JavaScript SDK authenticates users, and the techniques involved. All JavaScript apps use this standard code to import the Facebook Single ...
0
votes
0answers
32 views

Providing identity verification via confirmed contact info to unconfirmed address w/o leaking information?

I emailed a known e-mail address for my local telecommunications/internet company about a complaint with their service. It appears the person I emailed forwarded this to somebody else in their office ...
0
votes
0answers
126 views

Benefits/negatives of password-less authentication

I am facing the following dilemma: I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products. Currently, the ...
0
votes
0answers
38 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
0
votes
0answers
446 views

Is authentication/authorisation necessary between a web server and an isolated application server?

If I have a system that consists of an application server which responds to requests made only from the web server. a web server that responds to client requests over the internet. Is it necessary ...
0
votes
0answers
902 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...
0
votes
0answers
507 views

is Form Authentication more secure than using the session authentication?

Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication. For Example if somebody hacked my ...
0
votes
0answers
149 views

Social game authentication exploit

We're running a popular social game and we have a security problem that is growing more and more popular these days. We have the following product requirements: There should be no registration to ...
0
votes
0answers
535 views

Brute-forcing a RSA private key password vs. LUKS volume

I need to store various private keys for my clients. Given these options, what would be the least prone to brute force attacks: Encrypt the private keys using a separate RSA key (each user get its ...
0
votes
0answers
524 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
0
votes
0answers
144 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
0
votes
1answer
56 views

Is Cross-Domain IP tracking a security feature?

We're using a cloud based web security (proxy) service which basically takes our web requests, scans them and NATs these requests to their public IP addresses. NAT is being done on a per-session basis,...
0
votes
1answer
286 views

Is this authentication scheme using JWT secure?

I was wondering if you could review this authentication scheme for web application. === Login Page === Credentials Verification => Server issues JWT => Stored in a Cookie JWT contains: exp: ...
0
votes
1answer
69 views

Securing application-application communication from devs and admin

Scenario: I have an application A which holds sensitive data. I have an application B which needs to process the data. A will provide a web-interface. B will make calls to get required data from A. ...
0
votes
1answer
540 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
0
votes
2answers
89 views

Can you use Google's authenticator app when Google “makes sure that you’re really you”?

I've heard that you can configure your Google account to use its (more secure) authenticator app rather than sending you a text message - in my most recent case, this was when Google sent me a text ...
0
votes
2answers
443 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
-1
votes
1answer
48 views

Confusion related to broken authentication vulnerability

I was able to login by using the cookie of my previous session but when I try to change the setting I was logged out. Will this be eligible for authentication bypass vulnerability?
-1
votes
1answer
424 views

Auto-Fill Windows Security Credentials

I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing) If I don't do that I will have no internet connection on my laptop ...
-1
votes
1answer
1k views

Is my AD password sent in plain text then encrypted?

how does an application authenticate with AD credentials? Are the credentials sent in plain text? or are they encrypted before it checks with AD to validate the user?
-1
votes
1answer
202 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
-1
votes
1answer
245 views

How PPP with CHAP for Cisco works

I'm learning to configure a simple PPP link with CHAP authentication for two Cisco routers. I'm trying to make sense of how router makes sense of the configuration in this example, as the logic of ...
-1
votes
1answer
59 views

Is there any authentication scheme relying only on the “secret” question?

I know it's standard for websites to use usernames and passwords to authenticate users. From what I've read, question based authentication is usually used to either reset a password, or employ two-...
-1
votes
1answer
352 views

Secure login procedure

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the ...
-1
votes
1answer
2k views

How does SSL client authentication work?

I read the RFC document, it mentioned that there are some kinds of client certificate type. So I don't understand what does this type mean. For a instance, one type named rsa_fixed_ecdh, it said, the ...
-1
votes
1answer
185 views

Prevent someone to login to my website from teamviewer

I have my own suspicions that there are blocked users of my website that use Teamviewer to login to my site from their friends' pc. Is there any way to identify if the one who visit a website is using ...
-2
votes
1answer
190 views

Public key encryption for initial challenge-repsonse

I understand public key encryption, public key authentication, how digital signatures work and challenge-response authentication, but what confuses me is when they are all combined, and the question ...
-3
votes
1answer
337 views

How to authenticate a user account from a website over the phone?

A support team is answering calls and providing well support. It would be conceivable for someone to impersonate or ask for something which should be authenticated first. Which are the best methods ...

1
5 6 7 8
9