Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with authentication
Search options answers only
not deleted
user 665
the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
3
votes
Sharing passwords and credentials between founders and employees
Then you should look into the concrete services which require authentication. …
- 27.3k
5
votes
Voting System, is there a hole here?
This is too long for a comment, but I was asked for details.
The German constitutional ruled:
The usage of voting devices [...], is in compliance with the constitutional requirements only, if th …
- 27.3k
3
votes
How do i use a guessable ID for authentication
If your software runs on a computer, on which the user can execute untrusted software (e. g. a standard PC, a rooted smartphone), he will be able to manipulate your software.
You may use anti-debuggi …
- 27.3k
2
votes
Is this login authentication safe?
If I understand you correctly, the login packet will be exactly the same for the same user within the validity time of bl_hash. So a passive attacker can record and replay it. To prevent this kind of …
- 27.3k
15
votes
Accepted
Password hashes should run md5 thousands of time: really?
Cryptographic hash (like md5) with salt are bad.
It is not sufficient anymore. The traditional cryptographic hash functions are designed for documents and therefore they are optimized for speed.
…
- 27.3k
11
votes
Is denying login after incorrect attempts ineffective?
The idea is to not even accept the correct password during lock down.
But before implementing a lock down system, it makes sense to look at the attack cases:
a specific user is targeted
If the atta …
- 27.3k
4
votes
Accepted
Isn't OpenID over HTTP (not HTTPS) fatally flawed when delegates are used?
Specification: http://openid.net/specs/openid-authentication-2_0.html#anchor45 …
- 27.3k
1
vote
OpenSSO and Basic Auth together
Yes, you can combine several authentication methods using the Satisfy {any|all} directive. … To apply BasicAuth only on some URLs, matching a pattern:
SetEnvIf Request_URI ^/webservice/* do_basic_auth
<IfDefine do_basic_auth>
AuthName "Authentication"
AuthType Basic
AuthUserFile / …
- 27.3k
9
votes
Accepted
How can I avoid sending passwords in plain text when logging into a website?
https is designed to prevent this kind of attack: The communication between you and the server is encrypted. The server will provide a certificate to ensure that it is the correct one and not a man in …
- 27.3k
30
votes
Accepted
Is it a bad idea for an information holder to e-mail a user their password?
They are either storing it in plain text (likely) or they are using a reversible encryption. So in case of a compromise the password is at risk.
Yes, and it is even worse: Some email providers such a …
- 27.3k
4
votes
What's a good way to trigger a hidden 'distress signal' in instant messaging?
I just have to think about a children story and some news article.
In one story a sister was kidnapped and forced to phone her brother to lure him into trap. She used his nickname which she never did …
- 27.3k
8
votes
Secure Web Password Fields + http to https redirect
Yes, this is a security issue because an attacker may be able to change the HTML code. He can change the action attribute of the form to point to his own server. Or less obvious and better: Add some j …
- 27.3k
2
votes
Accepted
Using Tokens to Keep Users Logged In
A good thing to do when proposing a security concept, is to create a list of scenarios, that it needs to protect against. Without that framework, it is hard to comment.
Let's compare it with session …
- 27.3k
23
votes
Accepted
What is the benefit of the scope in OAuth2?
State Parameter
The scope parameter is not used to secure the authentication request against CSRF attacks (see below). But there is another parameter called "state", which matches your description. …
- 27.3k
158
votes
How does changing your password every 90 days increase security?
Before answering whether it does help or it does not help, it makes sense to look at specific scenarios. (That's often a good idea when dealing with security measurements.)
In what situations does a …
- 27.3k