Authentication is commonly understood as the act of asserting a user's or entity's identity, although in the wider sense it can refer to asserting the truthfulness of any kind of claim. Authentication, like encryption, is a major component in implementing computer security.

learn more… | top users | synonyms (1)

10
votes
4answers
574 views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
8
votes
8answers
385 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
8
votes
2answers
452 views

Should I support facebook login or openid login?

What are the pros and cons of each? Does it make any sense supporting both? Which is easier for users/to implement?
8
votes
2answers
126 views

What do I lose if I use OpenID instead of the custom login system I built

I'm trying to make the decision whether to use OpenID or stay with a well-built custom login system. I think the appeal of OpenID is clear, in that the user doesn't have to create yet another account ...
7
votes
3answers
198 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
7
votes
4answers
186 views

Single Sign on across Websites

I have three different websites that I run on three distinct top level domains. I would like to be able to have users log into any one of them and then be automatically logged into all three. As an ...
7
votes
4answers
719 views

Is it generally a good idea to allow the reuse of old usernames from deleted accounts?

On a Social Networking site, is it generally a good idea to allow the reuse of old usernames from deleted accounts, or is it better to prohibit their reuse forever? How do the big boys do it ...
7
votes
2answers
3k views

How to use cookies in a secure manner to authenticate users?

In most cases I like using cookies to remember returning users to my websites. In my early/foolish days, I would store a UserID (auto-increment integer) in a cookie and if the user returned I would ...
7
votes
1answer
709 views

Permissions for serving up temporary files

I have a system (web based application) which pulls file attachments from a 3rd party system via SOAP. These are in turn on our system created as files in a directory. When a user of the system ...
6
votes
5answers
162 views

Allowing users to post without logging in

On Stackoverflow/Stackexchange, users are allowed to add posts without requiring login, just wondering what should be considered before allowing this kind behavior on a site? Couple of things spring ...
6
votes
3answers
385 views

Using two salts for user authentication?

When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
6
votes
3answers
487 views

When should you consider being an OpenID provider?

I know that OpenID would benefit more from a larger number of sites adopting it, than it would from more people being providers. But even still, I am curious as to when it would be good for a site to ...
6
votes
5answers
112 views

How to include content from remote server while keeping that content secure

I am hosting collection of videos, for which I retain the copyright, on a file server that I'd like to share with family and friends. When a user visits my file server via a web browser they are ...
5
votes
2answers
2k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
5
votes
2answers
421 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have ...
5
votes
2answers
179 views

Managing accounts on a private website for a real-life community

I'm looking at setting-up a walled-in (i.e. mostly private, with a small public-facing login page) website for a real-life community of people, and I was wondering if anyone has any experience with ...
5
votes
1answer
1k views

Are there any other login products similar to LoginRadius?

I'm thinking of using LoginRadius social site login/registration solution to integrate with traditional login/registration system. Has anyone ever used it and have any opinion about its performance ...
5
votes
1answer
872 views

How do I setup authentication on a specific folder using .htaccess?

I have a folder that I want to host files privately on my webserver. How do I go about making it password protected using .htaccess? Note: Nothing monolithic, I want something that is simple/easy so ...
4
votes
5answers
585 views

Do user names used for login need to be unique?

Assuming a non-commercial site where users login with a user name and pw, do I need to enforce unicity of usernames? Note: The db will use a separate unique index to identify the users. The site is ...
4
votes
2answers
190 views

Why do user registration process not end with the user logged in?

Often I see websites when at the end of the registration process the user is not logged in. What is the rational for that? It seems redundant to ask a user to reenter their credentials just after ...
4
votes
1answer
492 views

Does htpasswd authentication prevent Google from crawling my site?

I have a site that I want to continue testing before I make public, so I don't want Google to start crawling the site as there will be a large amount of garbage content during testing. I currently ...
4
votes
3answers
472 views

How useful is Facebook Connect Login?

I'm starting to see some Websites offer the option to login via Facebook. I'm curious how useful it is a feature. For example, when someone logs in, does her friend knows on Facebook that she logged ...
4
votes
2answers
408 views

Should I track the login page?

I've recently started using Google Analytics on a B2B ecommerce site with authentication. Users must login and are redirected to the login page if they try to access an internal page without first ...
4
votes
2answers
564 views

CDN for authenticated sites

We have a site that requires users to sign into. Typical stuff. Today, all the content (dynamic and static) is behind the login process, and you cannot access any of the pages or files via a URL ...
4
votes
2answers
410 views

Facebook connect vs. OpenID

I just started working on a new project that has a general login feature. One suggestion in a meeting was to look into Facebook Connect or OpenID as an alternative. I'm curious if there's one that has ...
4
votes
2answers
383 views

Combining a content management system with ASP.NET

I am going to be creating a site that seems like it requires a blend of a content management system (CMS) and some custom web development (which is done in ASP.NET MVC). I have plenty of web ...
4
votes
1answer
734 views

Password protect an alias virtual directory

I have a main domain being hosted through CPanel. I also have a sub-domain that I would like to appear as a path under the main domain instead of as a sub-domain. So I have: http://example.com/ ...
4
votes
2answers
231 views

How do I edit/modify a file on a webserver using php file in the same location? [closed]

I have an XML file on my server. In the same directory I have a PHP file which modifies the content of the XML and saves it. In this, the save part doesn't work. In my knowledge the code is alright ...
3
votes
5answers
92 views

How to you prevent someone from getting a “new free trial period” by just creating a new login?

I am considering several options for the Trial version of our web app. The one I favor the most is the classic trial period. Of course, it's a LOT easier for someone to hack this system. They can ...
3
votes
2answers
154 views

How to maintain unique user per paid account in a website with given set of Email ID and password?

For a website, there is a free and a paid membership option. Once the user pays some amount he gets a membership for a month for additional products that are not in the free account on the website. ...
3
votes
3answers
213 views

Which social sign-in (Google, twitter, fb, etc) is most often used (if I could only choose one, which would statistically retain the most users)?

I am working with a startup which is about to do its launch in maybe 2-3 weeks. In order to see the primary features of the site, the user has to register or sign in if they have already registered. ...
3
votes
2answers
1k views

How to implement OpenID authentication for my site?

I want to offer OpenID authentication for my users (please note that I do not necessary want to become an OpenID provider; I just need to authenticate my user for my website). How to implement OpenID ...
3
votes
3answers
947 views

How do you get Drupal to go to a page other than the User Profile on login?

ISSUE: Please help, I've tried a few things to get Drupal to STOP going to the User Prolfile page on login, even installed a module called LoginToboggan; which has nice features, just doesn't stop ...
3
votes
2answers
2k views

OpenID, Gmail, Facebook, Yahoo login for Wordpress

Is there somethink like this for free for wordpress?
3
votes
1answer
1k views

Does Orchard have Active Directory authentication?

I've been looking over the Orchard CMS and it seems like a capable CMS and mature enough to do what we need here. However, one thing I haven't been able to find info on is AD authentication. We plan ...
3
votes
4answers
9k views

How to login as another user in phpmyadmin

I installed phpmyadmin in Win7, and if I type http://localhost/phpmyadmin/index.php in the browser, it will log in phpmyadmin as root user by default. I created a new user but still there's no login ...
3
votes
1answer
89 views

How do I get a “Sign in with Facebook” button in Denmark?

I live in Denmark. In connection with a project I would like to add a "Sign in with Facebook" button to a website. In order to do that I apparently have to register as a Facebook developer on ...
3
votes
1answer
231 views

How to allow Google to index protected content?

I'm working on my site and as it require users to log in it will be hard to Google to index the sites, because to see 90% of the content you have to be online. So I've made a script which looks for ...
3
votes
1answer
156 views

How does Lastpass recognize actual login?

We are currently working on simple school project using Codeigniter where we need login page. It would be very useful if Lastpass could recognise and save logins. We have several accounts with ...
3
votes
2answers
117 views

What are recommended password reset mecanisms?

All, I'm developing a small, non-commercial web app. I'm trying to decide how to help a user who might have lost their password. I need a mechanism that is, in order of priority: 1) User friendly; ...
3
votes
1answer
128 views

getting the user back where they came from with mod_form_auth

Using the mod_form_auth module in Apache HTTPD 2.4.3, I am looking for a way to have the user redirected to their original desired target after completing a login. That is, if I have a <Location ...
3
votes
2answers
118 views

Use Outlook password for website verification

I am currently building an internal employee dashboard for our global company (it is hosted on an external website for logistical reasons) I'd like (need) to password protect the page as we will be ...
3
votes
1answer
446 views

Using Public Key Authentication for websites

I know GitHub uses it for code development (not user authentication for the website though). I saw this article on the idea: ...
3
votes
4answers
517 views

Personalized content (authenticated with a cookie) and impact on SEO

We have a big website with a lot of content, that is doing pretty well in terms of SEO. Google likes the site, visitors like it as well. Our problem is that there is a lot of content that would only ...
3
votes
2answers
663 views

You don't have permission to access /index.php on this server

I made a 'login with OpenID' page and I had a error when OpenID provider return to my page: You don't have permission to access /index.php on this server. Additionally, a 404 Not Found ...
3
votes
2answers
190 views

Authentication system brainstorm [closed]

We got multiple small websites (microsites) and one main high traffic one with big users base. Right now the requirement is to build authentication system which should allow users to loign with the ...
3
votes
0answers
44 views

How to determine the sequence of ordering certificates by browser?

I did a Mutual Certificate Authentication implementation with OpenSSL and Apache Web Server on CentOS platform. To simple explanation see this diagram: ---------- | ...
2
votes
2answers
47 views

HTTP code 403, access denied & Options -Indexes

at "webmasters.stackexchange.com" I already found a similar topic: Stop directory listing using .htaccess and redirect to good error page Options -Indexes ErrorDocument 403 /path/to/403.html ...
2
votes
2answers
131 views

Will using HTTPS hurt my site's SEO or other statistics?

I've set up a WordPress blog. Since I have to log into it from many different locations/machines, I've also got an SSL certificate, and set up Apache to redirect HTTP to HTTPS. It all works, but I'm ...
2
votes
1answer
145 views

how to handle login between different domains?

I've a website with 2 domains (.nl and .com) and a translated version of the content is displayed depending on the domain. My issue is that when a client login under a .nl domain, and he moves to the ...