We’re rewarding the question askers & reputations are being recalculated! Read more.
Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 2568

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

28
votes
Enable two factor authentication. Consider the remembered password compromised to any user of the public computer. EDIT: My answer dealt with how to prevent your password from being keylogged … . With two-factor authentication your password is now the combination of a randomly generated one-time use code (obtained via cell phone or pre-obtained list) as well as the remembered password; hence a …
answered Feb 2 '13 by dr jimbob
4
votes
Requiring a flash drive in addition to a password could provide more security. Your method doesn't seem particularly sensible - flash drive with "salted hash" that is used for authentication. A … your idea, would be require a public key-private key authentication with the private key on the flash drive being encrypted with a strong passphrase. Also from user experience perspective, having to …
answered Dec 12 '11 by dr jimbob
9
votes
You are only as secure as your weakest link. If your remote servers allow both password and key-based authentication, you are less secure compared to only allowing one. Your extra vulnerabilities … for a key-based system over Password Authentication (PA) are: An attacker gains a copy of your passphrase-protected private key by say having physical access to an unencrypted disk on any system (e.g …
answered Dec 20 '11 by dr jimbob
1
vote
Your very rough calculations seem to be a gross overestimate, as the line has to be continuous. For simplicity let's first neglect curved lines. Then since it is one continuous line, let's imagine i …
answered Mar 22 '12 by dr jimbob
6
votes
) which has nothing to do with authentication. Most Debian systems use PAM for authentication. Your password is checked against a salted key-strengthened hash that is stored in /etc/shadow next to … =ignore] pam_unix.so obscure sha512 This enables pam_unix.so for password authentication, using sha512-crypt as the algorithm to check passwords against. (obscure forces passwords to pass a couple …
answered Jan 20 '13 by dr jimbob
1
vote
of message authentication codes: there are MAC constructions that have not been subject to analysis such as HMAC. Wagner and Schneier don't have any specific objections to them but the point is … provable security results are very attractive. HMAC is rapidly becoming the gold standard of message authentication, and it is an excellent choice for SSL. Barring major unexpected cryptanalytic …
answered May 7 '14 by dr jimbob
3
votes
127.0.0.1 for best results). Then even if the authentication protocol is vulnerable, you'll still be protected (assuming you actually use a CA signed certificate, or get your browser/other application to …
answered Apr 30 '14 by dr jimbob
3
votes
This is very unclear. Bullets 3-4-5 - who is generating the keypairs - what is being sent and encrypted to whom? I'm assuming the voter as he sends the "public key" to each party as encrypted data g …
answered May 4 '12 by dr jimbob
2
votes
the user to have to give full login through your android app. Maybe you require two-factor authentication (where the second factor is the phone), or require certificates, or are afraid of carrier-IQ …
answered Apr 3 '12 by dr jimbob
18
votes
My favorite secure implementation of this is done by a bank I use. If I type in my username correctly, it will say "Welcome Jimbob!" and then prompts me to answer security questions (if I have never …
answered Jul 30 '12 by dr jimbob
3
votes
A script can simulate keystrokes/mouse clicks on Windows. I believe the UAC prompt is protected by the OS making automating clicking it a more difficult task. (I'm not a windows user; but its straig …
answered Feb 14 '13 by dr jimbob
13
votes
Three possibilities: Microsoft was always truncating it and you just were not aware. Can you use the old system with a 16 character password and wrong characters at the end? They were storing the p …
answered Aug 21 '12 by dr jimbob
0
votes
successfully logged in from 1.2.3.4 before, require CAPTCHAs or 2-factor authentication (receive a code via SMS/phone call/email) before they can login from that IP. …
answered Mar 11 '15 by dr jimbob
4
votes
certificate. This allows you to login to your computer over HTTPS. Next you'll probably want to add apache authentication along with exceptions for the local LAN block (192.168.0.0/16 or whatever …
answered Feb 21 '12 by dr jimbob
0
votes
Once you give the users the device, they should be able to get the ssh password/key from the mobile app off their device if want. You can make it more difficult (and its not trivial), but a sophistic …
answered Mar 19 '12 by dr jimbob

15 30 50 per page