Search Results

In your process, people will get a distinct error code depending on whether the account exists or not. This is often considered somewhat inopportune. It is preferable if it is not possible, for outsid …

Generic answer: if password-based authentication can be performed offline, then the app necessarily contains all that is needed to decide whether a given password is the correct one or not. … If users accept a 1-second wait for authentication on their smartphone, then the smartphone CPU must necessarily be able to verify a password within one second. …

Using the GUID as unique identifier for the user instead of the email address has benefits against low-power attackers. The URL-with-GUID has been sent through email, so it cannot be considered as rea …

If you really need to use AES, then you may use CBC-MAC. Be wary, though, of the conditions: CBC-MAC is secure only if: all messages have the same length, or (alternatively) you always compute the M …

I assume that the user ID are attributed randomly and uniformly among the 232 possible 32-bit values. In that case, the best an attacker can do is to try potential user IDs (32-bit values) in any orde …

In fact is it not inherently dangerous to stay logged in as root; what is dangerous is leaving the room with a root shell open, because any casual attacker could then do quite some damage (he could do …

In this case, since you worry about authentication only, things would go that way: Client and server make some normal SSL and run an authentication protocol within that SSL. …

Authentication: you have some guarantee as to the identity of the source of a given message. … Basic authentication is when you are the verifier; non-repudiation is when the whole World is the verifier. Thus, successful non-repudiation implies authentication (and thus integrity). …

The main problem with a key file is that it is a file. As such, it is stored somewhere, on some physical medium. It will be copied with backups. The file will still be there on discard hard disks. Use …

A static authentication protocol means that the device which does the authentication does not compute anything. If embeds some secret value but can, at best, show it. … A dynamic authentication protocol is the opposite: the device computes things. …

The "authentication token" works by how the server remembers it. A generic token is a random string; the server keeps in its database a mapping from emitted tokens to authenticated user names. …

To some extent, you can offload state on the clients. You encode the access rights of a user into a blob to which you add a MAC computed with a server secret key. The blob-with-MAC is then sent to the …

Source code life cycle and key management may conflict. For instance, you may (should) use a versioning tool such as Subversion to store the successive modifications you perform on the source code; if …

A PIN is just a password -- a password which is restricted to digits and constrained in size, but a password nonetheless. PIN make sense in contexts where digits are natural, namely ATM systems and ot …

Apart from @DavidWachtfogel's answer, which gives good information on the difficulty of deterministically turning a face into a sequence of bits, I would like to point out that your face cannot be a " …