| Javascript Feeds RSS Feed Security Dashboard | SearchSecurity.com |
|
Biometrics
|
|
Passwords
|
|
PKI
|
|
Dos and Don'ts of Client Authentication on the Web Client authentication has been a continuous source of problems on the Web. Although many well-studied techniques exist for authentication, Web sites continue to use extremely weak authentication schemes, especially in non-enterprise environments such as store fronts. These weaknesses often result from careless use of authenticators within Web cookies. Of the twenty-seven sites we investigated, we weakened the client authentication on two systems, gained unauthorized access on eight, and extracted the secret key used to mint authenticators from one.
By Kevin Fu, Emil Sit, Kendra Smith, Nick Feamster, 02/26/2005
|
|
Evaluating Strong Authentication Systems The purpose of this document is to provide the information required for you to evaluate the WiKID Authentication System on its financial, technical and operational merits.
Nick Owen,
02/25/2005
|
|
A System to Enhance Security in Kerberos Authentication System This paper aims to outline a general introduction to kerberos systems, gives a brief account of cryptography & steganography, elucidates the proposed algorithm, and illustrates how performance of kerberos systems can be enhanced using the proposed algorithm. This paper discusses only Kerberos version 4, the most popular, but also briefly explains the differences between version 4 and version 5, the latest.
R. Uma Rani,
02/11/2005
|
|
Federated Identity Management Federated Identity management makes it possible for an authenticated identity to be recognized and take part in personalized services across multiple domains. It avoids pitfalls of centralized storage of personal information, while allowing users to link identity information between different accounts. Users control linking of account management (to an extent) and personalization of services. Federated identity requires two key components: trust and standards [2]. Trust model of Federated Identity management is based on Circle of Trust.
Ajoy Kumar,
12/20/2004
|
|
Authentication An overview of various types of authentication ranging from simple username/password and CHAP to smart cards and biometrics.
By Johan Hiemstra, 09/21/2004
|
|
Understanding EAP-MD5 Authentication with RADIUS This document has been compiled as an effort to understand the process of Authentication involved when using RADIUS with EAP-MD5. The document will look into the details of the EAP-MD5 authentication process when used with RADIUS. We shall see how RADIUS protocol can be extended to support third-party authentication process. We shall also discuss the advantages and disadvantages of the protocol and look at the alternatives that are available to address the shortcomings of the protocol
By Sudipto Chakraborty, 08/24/2004
|
|
Managing Identity in the Digital World: Ultimately the solution you implement should best serve your environment. Though the examples used in this paper deal primarily with the username and password methodology for access control, a number of other options exist. SecureID cards, certificates, biometrics and other tokens are all other forms of identification used today. These considerations need to be applied when choosing your solution. You should select one that best integrates with all of the identity solutions you plan to use
By Stephen Hendrie, 08/24/2004
|
|
Windows 2000 Kerberos Interoperability While other papers discuss Kerberos in general or the Windows 2000 implementation, this work explores compatibility issues between traditional Unix implementations and Microsoft s implementation. First discussed will be Microsofts support of the official Kerberos V5 standard RFC 1510. Next discussed will be how to configure a Windows 2000 network to work with a UNIX Kerberos implementation in a variety of common scenarios, and finally this work discusses extensions to the Kerberos standard that Microsoft has documented in a number of Internet Drafts. Overall Microsoft s Kerberos implementation is proving itself to be interoperable in all common scenarios.
By Christopher Nebergall, 04/26/2004
|
|
Generating X.509 Certificates in Linux The easiest way to create X.509 certificates on Linux is the openssl command and the auxiliary tools. When the OpenSSL package has been installed usually an auxillary command CA and/or CA.pl, has been installed, too. We will use this command to create the certificates.
04/23/2004
|
|
Linux Kernel 2.5/2.6 using OpenBSD's isakmpd If you are using a RPM based distribution or Debian the installation may be done using the appropiate package tools. The author of this document has compiled an RPM package of the isakmpd for the Linux kernel 2.6.0-test2 (http://www.spenneberg.org/VPN/Kernel-2_6_IPsec). Please be aware, that this package may not work on other versions, because the ABI in the kernel has been changed several times. The debian project includes a package which may be installed using apt-get install isakmpd.
By Unknown, 04/23/2004
|
|
Page: 1 2345 |
