The tag has no wiki summary.

learn more… | top users | synonyms

61
votes
9answers
23k views

Is browser fingerprinting a viable technique for identifying anonymous users?

Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? What if you incorporate biometric data like mouse gestures or typing patterns? The other day I ran into the ...
19
votes
4answers
2k views

How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?

For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
13
votes
2answers
7k views

How should an API use http basic authentication

When an API requires that a client authenticates to it, i've seen two different scenarios used and I am wondering which case I should use for my situation. Example 1. An API is offered by a company ...
10
votes
4answers
673 views

Am I Over-Engineering If I Consider User's Intentional Wrongdoing?

Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code? To clarify, I'm exposing a simple JSON ...
10
votes
5answers
7k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
8
votes
7answers
1k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
8
votes
3answers
3k views

Web Authentication using PKI Certs

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
8
votes
2answers
594 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
6
votes
3answers
324 views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
6
votes
2answers
2k views

Best way to hide API key in source code

I need some ideas on how to protect a private API key in an application, specifically in a c# .NET application. Firstly, I understand that it is theoretically impossible to hide anything in the ...
6
votes
2answers
3k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
6
votes
2answers
3k views

Designing authentication for REST API

I'm working up an API for a REST service that I'm going to both be producing and consuming. I've spent the past few days trying to figure out how to handle authentication nicely, and think I've ...
5
votes
1answer
4k views

Authenticate native mobile app using a REST API

I'm starting a new project soon, which is targeting mobile application for all major mobile platforms (iOS, Android, Windows). It will be a client-server architecture. The app is both informational ...
5
votes
1answer
721 views

Java solution for mutual authentication with smart card

I need to develop a Java solution for mutual authentication between Tomcat 6 (server) and SmartCard "IDGo 300" (client). In order to do this I thought of the following scheme: 1.Tomcat (server) send ...
5
votes
2answers
3k views

What is the correct way to implement Auth/ACL in MVC?

I am looking into making a correctly laid out MVC Auth/ACL system. I think I want the authentication of a user (and the session handling) to be separate from the ACL system. (I don't know why but this ...
5
votes
1answer
120 views

Is there a proven concept to website reverse certificate authentication?

We're looking at exposing some of our internal application data externally via a website. The actual details of the website aren't that interesting, it'll be built using ASP.NET/IIS etc, that might be ...
5
votes
1answer
792 views

Authentication for users on a Single Page App?

I have developed a single page app prototype that is using Backbone on the front end and going to consume from a thin RESTful API on the server for it's data. Coming from heavy server side ...
5
votes
1answer
685 views

API Auth vs User Auth

I have read many posts and articles on this topic but still cant connect the dots. I want to make a Rails app that is strictly a JSON API maybe using Sinatra or the rails-api gem. I also want to make ...
4
votes
3answers
1k views

Did I understand the website “autologin” feature right?

I'm developing an authentication library (*) for a website and I realized that maybe I'm not completely understanding what an "autologin" feature is, and how to develop it. While gathering infos and ...
4
votes
4answers
9k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
4
votes
2answers
180 views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...
4
votes
2answers
430 views

Standard -server to server- and -browser to server- authentication method

I have server with some resources; until now all these resources were requested through a browser by a human user, and the authentication was made with an username/password method, that generates a ...
4
votes
1answer
125 views

Can someone explain the behind-the-scenes process of connecting an app account to a Facebook account?

I am developing an app that will use the Twitter and Facebook login APIs exclusively. Suppose a new user downloads the apps and is presented with the option to log in through Facebook or Twitter. The ...
4
votes
3answers
237 views

Kerberos web authentication

I'v developed an internal singe-page web-app (unix, apache & postgresql) protected by a simple login page. Currently, the users have their own login role with a password. This is starting to get ...
4
votes
5answers
452 views

How to implement a no-login authentication system

I am looking to build a very loose authentication system that can track a user and link submitted data/comments to a specific user. The submissions are essentially anonymous, but a user may want to ...
4
votes
1answer
487 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
4
votes
2answers
591 views

Two factor authentication using time base key generator on smartphones

I recently enabled two factor authentication for my Google account. One of the ways of getting the second factor (the key that I have) is to install an Android app on my phone that displays a key for ...
3
votes
2answers
4k views

Custom use of Authorization header in a REST API

I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using ...
3
votes
2answers
353 views

What's the benefit of Azure ACS if ASP.NET 4.5 includes OAuth and OpenID providers?

Azure ACS offers OAuth and OpenID providers, and now that ASP.NET 4.5 offers the same thing, without the added cost, is there any reason for a .NET developer to consider ACS? (Disclaimer, I don't ...
3
votes
1answer
89 views

Is “friendly fire” session replay a valid concern?

I've been reading a lot about sessions and security, trying to learn as much as possible before writing too much code. I've read about limiting session replay by including a timestamp within the ...
3
votes
1answer
129 views

How safe is it to cache a user ticket in SESSION

I'm working on a client library to interface with my company's api, and we generate a user ticket when the user logs in using the api. Obviously I don't want to send the user ticket to the client ...
3
votes
2answers
266 views

Using Paypal (or similar) to log into my site?

I have a web site and I want to offer a few levels of service - one free, one for a one-off payment, and one for a subscription. My first inclination is to use Paypal for the payment options. I ...
3
votes
2answers
362 views

Implementing Lazy Registration

I'm interested in setting up Lazy Registration on my website. Ideally, I'd like people to be able to fill out a record that might include their name, email, address, etc. and then record it to a user ...
3
votes
1answer
109 views

Is my websocket session idea practical?

In a situation where all communication (including logging in) between a client (web browser) and server is done over a persistent TLS encrypted websocket, would there be anything inadvisable about ...
3
votes
1answer
279 views

Multiple SSH keys for different organizations

I can see that GitHub allows you to have multiple mail account and associate every organization you are part of with a different address. Can this be done also for SSH keys? What I would like to do ...
3
votes
2answers
932 views

What .NET objects should I use to create a cookie based session in MVC?

I'm writing a custom password reset application that uses a validation technique that doesn't fit cleanly with ASP.NET Membership Provider's challenge questions. Namely I need to invoke a workflow ...
2
votes
3answers
107 views

Authentication for 'participants' vs 'users'

I'm building a site that lets users schedule interviews/conferences with third parties and I'm wondering what's the best way to provide security around the participant experience while providing the ...
2
votes
1answer
161 views

Should I manage authentication on my own if the alternative is very low in usability and I am already managing roles?

As a small in-house dev department, we only have experience with developing applications for our intranet. We use the existing Active Directory for user account management. It contains the accounts of ...
2
votes
1answer
299 views

Approach to Authenticate Clients to TCP Server

I'm writing a Server/Client application where clients will connect to the server. What I want to do, is make sure that the client connecting to the server is actually using my protocol and I can ...
2
votes
1answer
54 views

Security Pattern to store SSH Keys

I am writing a simple flask application to submit scientific tasks to remote HPC resources. My application in background talks to remote machines via SSH (because it is widely available on various HPC ...
2
votes
1answer
392 views

Implementing User Authentication on an N-Tier Web Application

I appreciate all help and feedback. Parts bolded are critical parts if this is too verbose. Perhaps it will help to mention I am a green developer. I have found some useful info from related ...
2
votes
4answers
805 views

Authenticating users for a website

I'm working on a website and I want to validate that an individual is an employee at one of a large number of companies (probably using their company's email address, which I don't know before hand). ...
2
votes
1answer
614 views

In what situations will Windows-based authentication for my ASP.NET MVC web application fail to allow users from accessing the web application?

My requirements are: To build an ASP.NET MVC web application to use Windows-based authentication, since all the users which will be accessing the application are our internal employees, and they ...
2
votes
2answers
1k views

Sharing authentication methods across API and web app

I'm wanting to share an authentication implementation across a web application, and web API. The web application will be ASP.NET (mostly MVC 4), the API will be mostly ASP.NET WEB API, though I ...
2
votes
1answer
959 views

How to host a site in another site - with little or no coding

SUMMARY: All of these happens on Site A User visits site A User enter username and password User click on Login Button User authenticated on Site B behind the scene User is shown a page on Site A ...
2
votes
1answer
1k views

HTTP PHP Authentication and Android

I am working on a website for which I hope to have an application for as well. Because of this, I am creating PHP API's which will go into my Database and serve specific data based on the ...
2
votes
1answer
527 views

Security in a private web service

I am developing a web site and a web service for a small on-line game. Technically, I'll be using Express (node.js) and MongoDB+Redis for the databases. This the structure I came up with: One ...
2
votes
0answers
168 views

Facebook authentication with an Authoritative Server for a Flash Game

I'm working on a multiplatform game in Flash. This game utilizes Photon Server for authoritative physics and user statistics tracking. I'm looking to leverage Facebook authentication as an alternative ...
2
votes
1answer
303 views

How do you get the usernames/passwords onto a STUN or TURN server for long-term credential authentication?

The STUN and TURN specifications allow for client authentication using usernames and passwords, and call this authentication via long-term credentials. In fact, TURN requires that clients authenticate ...
2
votes
1answer
419 views

Client side authentication through signatures instead of passwords

I want to save some user-generated data with some signature of the user that generated it (let's say that the user has to fill some forms with some data and I want him to sign the written data). The ...