Abstract: A mobile device renders a page that receives input points on a signature provided in conjunction with a mobile payment transaction. The page applies a smoothing algorithm to smooth the input points and create a signature file that more truly represents the actual input signature. The signature file and/or the input points are provided to a payment facilitator for use in completing the mobile payment transaction, performing fraud detection, and potentially for other purposes. Mechanisms are also disclosed for authenticating a buyer device in conjunction with a mobile payment transaction.

Abstract: Disclosed are various embodiments for an authentication manager. In one embodiment, the authentication manager performs an identity verification on a network site. The authentication manager determines that a particular portable data store is present in the client computing device, and then reads a security credential from the particular portable data store. The authentication manager automatically sends data encoding the security credential to the network site.

Abstract: Automated provisioning of hosts on a network with reasonable levels of security is described in this application. A certificate management service (CMS) on a host, one or more trusted agents, and a public key infrastructure are utilized in a secure framework to establish host identity. Once host identity is established, signed encryption certificates may be exchanged and secure communication may take place.

Abstract: A password application system receives a credential for a first privilege of a plurality of privileges whereby the first privilege corresponds to a first set of credential requirements and the plurality of privileges have a second privilege that corresponds to a different set of credential requirements. The system determines whether the credential for the first privilege satisfies the first set of credential requirements. If the credential satisfies this set of credential requirements, the system enables the credential to be used for access in accordance with the first privilege.

Abstract: Financial transactions, such as buying and selling, may be facilitated by merchant-based shadow account numbers. A master account may contain several associated shadow accounts. Each shadow account may in turn be associated with a specific merchant or group of merchants. Merchants and users may store and use the shadow account numbers rather than the master account numbers. Stolen or otherwise compromised shadow account numbers are useless with other non-associated merchants. Furthermore, the shadow numbers may be easily invalidated while leaving the master account untouched.

Abstract: Disclosed are various embodiments for automated detection of multi-user computing devices such as kiosks, public terminals, and so on. Network resource requests are obtained from a client computing device. It is determined whether the client computing device is a multi-user system based at least in part on whether the network resource requests embody characteristics associated with multi-user systems. The resulting classification is stored and may be used to customize generation of requested network resources.

Abstract: This disclosure is directed to, in part, providing a third party with access to at least some information in a user's account maintained by a host. The agent may assist a user in selecting an item, purchasing the item, customizing the item, and/or performing other actions. The agent may interact with the user during the assistance. In various embodiments, the user may provide the agent with a token that allows the agent to gain at least temporary access to at least a portion of the user's account. In some instances, the agent may purchase the item for the user using information in the user's account, such as payment information, shipping address information, and/or other information. The agent may place an item, such as a special order item in a virtual shopping cart or other location, which may be stored with the user's account.

Abstract: Disclosed are various embodiments for a behavior-based identity system that recognizes and/or authenticates users based at least in part on determining stored behavioral events. For example, stored behavioral events may have been observed previously at a client or have been predefined by an authenticated user. Multiple behavioral events expressed by the client relative to a network site are recorded. The behavioral events may correspond to data that a user has elected to share, and the user may opt-in or opt-out of the behavior-based identity system. A comparison is performed between the multiple observed behavioral events and the stored behavioral events associated with a user identity. An inverse identity confidence score as to whether the user identity does not belong to a user at the client is generated based at least in part on the comparison.

Abstract: Computing devices are disclosed that include functionality for providing a trustworthy indication of software integrity. The computing devices include a hardware trust evaluation device capable of determining the trustworthiness of computer programs executing on the device. At least one trust indicator is also connected to the hardware trust evaluation device for providing an external indication of the trustworthiness of a computer program. If the hardware trust evaluation device determines that a program is trustworthy, the trust evaluation device causes the trust indicator to provide a positive indication of the trustworthiness of the computer program to a user of the computing device. If the hardware trust evaluation device determines that a program is not trustworthy, the trust evaluation device causes the trust indicator to provide a negative indication of the trustworthiness of the computer program.

Abstract: Disclosed are various embodiments for assessing risk associated with a software application on a user computing device in an enterprise networked environment. An application rating is generated for the software application based at least in part on application characteristics. A risk analysis for the installation of the application is generated based at least in part on the application rating, the user computing device, and user information.

Abstract: Disclosed are various embodiments for facilitating the anonymization of unique entity information. A service may send anonymized responses to requests for data from multiple requestors, the data being associated with entity identifiers. The anonymized responses may comprise the data requested in association with anonymous entity identifiers as opposed to the entity identifiers.

Abstract: Automated provisioning of hosts on a network with reasonable levels of security is described in this application. A certificate management service (CMS) on a host, one or more trusted agents, and a public key infrastructure are utilized in a secure framework to establish host identity. Once host identity is established, signed encryption certificates may be exchanged and secure communication may take place.

Abstract: Automated provisioning of hosts on a network with reasonable levels of security is described in this application. A certificate management service (CMS) on a host, one or more trusted agents, and a public key infrastructure are utilized in a secure framework to establish host identity. Once host identity is established, signed encryption certificates may be exchanged and secure communication may take place.

Abstract: Disclosed are various embodiments for managing security credentials. In one embodiment, a request for a security credential is obtained from a client and is stored in association with a user account. Knowledge-based questions are provided to the client in response to the request. At least one of the knowledge-based questions is dynamically generated based at least in part on data associated with the user account. Answers to the knowledge-based questions are obtained from the client. The security credential is provided to the client based at least in part on the answers.

Abstract: Disclosed are various embodiments of techniques that may be used to improve the reliability of network authentication. A communication session is established between a server computing device and a client computing device. The communication session is established via a network using a credential for a network site. A verifier for the credential is generated, which may be used to confirm the authenticity of the credential. The verifier is provided to the client computing device via the network.

Abstract: Disclosed are various embodiments of techniques that may be used to improve the reliability of network authentication. A communication session is established between a server computing device and a client computing device. The communication session is established via a network using a credential for a network site. A verifier for the credential is generated, which may be used to confirm the authenticity of the credential. The verifier is provided to the client computing device via the network.

Abstract: The states or configurations of peer hosts within a host class may be analyzed and enforced by comparing records of the respective systems' states or configurations to one another and taking steps to address any inconsistencies between the records. In such a manner, the respective systems within the host class may identify, analyze and/or correct any changes in states or configurations of any of the systems, which may have been caused by a malfunction or security breach. The configurations may include one or more of a set of data, a version of a software application, a level of permission, a particular operational setting or any other element of operation. The hosts may be defined as peers based on a common location or a common function of each of the systems, or on any other basis, and the records may include any relevant data relating to the states or configurations of each of the systems.

Abstract: Automated provisioning of hosts on a network with reasonable levels of security is described in this application. A certificate management service (CMS) on a host, one or more trusted agents, and a public key infrastructure are utilized in a secure framework to establish host identity. Once host identity is established, signed encryption certificates may be exchanged and secure communication may take place.

Abstract: Disclosed are various embodiments for automated detection of multi-user computing devices such as kiosks, public terminals, and so on. Network resource requests are obtained from a client computing device. It is determined whether the client computing device is a multi-user system based at least in part on whether the network resource requests embody characteristics associated with multi-user systems. The resulting classification is stored and may be used to customize generation of requested network resources.

Abstract: Disclosed are various embodiments for an authentication manager. In one embodiment, the authentication manager performs an identity verification on a network site. The authentication manager determines that a particular portable data store is present in the client computing device, and then reads a security credential from the particular portable data store. The authentication manager automatically sends data encoding the security credential to the network site.