Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
118 views

Is it secure to refesh a JSON Web Token (JWT) auth token using the user credentials?

As I understand the answers to this question JWT: Is refresh an expired token is a good strategy?, one should use a refresh token to refresh an expiring auth token. Since my web app should be ...
0
votes
1answer
12 views

Can 802.1X, EAP and RADIUS work together?

So this is an academic question I came up with while researching the topic. Can 802.1X, EAP and RADIUS work together to provide a secure authentication? If yes, how? Thanks!
-1
votes
2answers
59 views

Keeping passphrase away from telepahic interception

Assuming that someone is able to intercept telepathically thoughts and words in my mind, what mechanism will allow me to authenticate securely? A solution that does not yield to physical search or ...
11
votes
3answers
1k views

Would a (password + combination of images) be stronger for user's login regarding keyloggers?

The scenario: We have a login system for a web application that requires a plaintext password and 3 images (from a collection of images that the users select during registration, the images are ...
4
votes
2answers
142 views

How much data should I store on a user's computer about their login info?

I'm currently saving a user's "login" information (not their raw password, of course!). Every device/browser gets its own secure ID from the server, all well and good. However, should I verify more ...
0
votes
1answer
23 views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
0
votes
1answer
32 views

Windows Firewall: Restricted RDP to 1 IP, but still see login attempts from other IPs

I restricted the Firewall rules for RDP incoming restricting the Scope to 1 Remote IP address (Local IP Address section is empty). This was done for both Public & Private/Domain Rules. I did not ...
3
votes
4answers
2k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or “...
1
vote
1answer
47 views

what does `client_id` mean in password credentials grant of OAuth 2.0?

Public clients can't hide their requests. So password credentials grant doesn't need clientSecret. What I'm curious is, is there need client_id? because hacker or client user can know or trace the ...
0
votes
1answer
225 views

Is the following PayPal Vulnerability a design/implementation flaw?

I am trying to understand the logic behind following vulnerability, I believe this a design flaw not only an implementation. To me the problem with the two-factor authentication service at PayPal is ...
2
votes
1answer
274 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
0
votes
2answers
40 views

session credentials on the client

I am developing an IE11 based application running on a web server inside our corporate network The application makes calls to a 3rd party API which requires client certificates and username/password ...
2
votes
1answer
41 views

How to check whether NTLM v2 or v1 is used for authentication?

Which tool should I use to check which NTLM authentication is used? Consider the fact that I am a user of the web application and not the owner. Are there any security concerns if a site uses NTLM ...
0
votes
1answer
49 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
28
votes
5answers
5k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
1
vote
1answer
21 views

Instant signin links for users from trusted third party sites

I'm owning web app "A" and want to work with a third party service "X". User "Alice" has accounts on both platforms. App A knows the user ID of alice on X, but X doesn't care about Alice being on A or ...
0
votes
0answers
12 views

How to enumerate smartcard logon attempts in Windows?

I need to provide my users with feedback when they log on at their workstations. This feedback needs to include: Date/time and workstation id of last successful login Number of unsuccessful login ...
2
votes
1answer
1k views

Password-less authentication in web apps - How safe it is?

I read a long time ago this article about how could work a Password-less Authentication System, which sounded to me like a great idea. I even built it in a small fun little application for fun. To ...
81
votes
9answers
14k views

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
0
votes
0answers
24 views

Authentication in WPA from a user's perspective

I have read several articles that discuss the differences between WEP and WPA but I haven't seen an answer to my question, which is : How is the authentication used in WPA different from that used ...
1
vote
2answers
70 views

Should JWT token be stored in a cookie, header or body

What is the most secure way to store transfer and store a JWT token, or any authentication token in general? Someone told me it's secure to send the authentication token as a cookie, but I don't ...
0
votes
1answer
55 views

Does HTTPS protect from session riding?

In a typical session riding scenario, the attacker tricks the victim into sending an HTTP request to a web site they are already logged in to. For example, tricking victim to click on a link to ...
8
votes
2answers
185 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
1
vote
1answer
56 views

Is Auth0 Passwordless Authentication secure?

I see this advertised Medium post about building a React application with passwordless authentication through Auth0. from the link, here is the explanation of how it works: Passwordless ...
12
votes
5answers
2k views

What is the best way to transmit password hash over unreliable TLS?

I have TLS connection between my server and client. I have no certificate, so the connection is susceptible to the Man-in-the-middle attack. I fear that attacker could intercept the password hash ...
51
votes
4answers
25k views

What is the use of a client nonce?

After reading Part I of Ross Anderson's book, Security Engineering, and clarifying some topics on Wikipedia, I came across the idea of Client Nonce (cnonce). Ross never mentions it in his book and I'm ...
50
votes
3answers
27k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
2
votes
2answers
109 views

My Yahoo accounts keep making random accounts for me on other websites. Why?

I have two Yahoo email accounts. Both will randomly recieve new emails about a new account that was made under my name and my email address, however, I'm not setting up these accounts. I have had ...
0
votes
1answer
48 views

Numerous login attempts detected from an internal machine to the active directory domain controller

We have recently identified numerous login attempts from an internal machine to the active directory domain controller. The attempts are directed at the domain administrator account. As an initial ...
12
votes
1answer
1k views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
0
votes
2answers
83 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
0
votes
3answers
318 views

Is it secure to return a JWT to an already-logged-in user?

I'm using JWT to handle an SSO scheme where two systems (let's call them A and B) both require authentication, but the user datastore is in one system only (let's say A). Everything I've seen about ...
1
vote
1answer
110 views

Can Passpoint X.509 certificates be used to MITM SSL connections on Passpoint networks?

Passpoint/Hotspot 2.0 public networks like LinkNYC require users to install X.509 certificates, for EAP authentication. Can these certificates be used by the provider to execute man-in-the middle ...
1
vote
1answer
2k views

PHP unserialize() object injection

So I came across with this authentication bypass security notice and the fix for it was just simply changing all serialization to json encoding. I am just wondering how is this really exploitable? ...
82
votes
9answers
16k views

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it. What if I encrypt data and every password decrypts it, but ...
61
votes
6answers
60k views

How do I secure my REST API?

In detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
2
votes
3answers
146 views

Could a spoken (TTS) SMS-based 2FA be intercepted?

In mid-June, Lastpass made news again, and I've since been mowing around the idea of two-factor authentication. After familiarizing myself with SMS and Google Authenticator, I thought the SMS was a ...
1
vote
1answer
175 views

securities concerns about calling REST API from multiple servers

There is a master web application that needs to call REST APIs from servers of other applications. I can think of two ways to achieve it: a). call APIs on the front-end of the master application(...
7
votes
2answers
335 views

Microservice to Microservice Auth

We're planning a new architecture which will utlize a backend of many different microservices that will need to talk with each other as well as field requests from systems not part of the service. In ...
64
votes
10answers
25k views

Can I scratch off the magnetic strip off a debit card to only allow chip and PIN?

I have been robbed in the past by thieves using my HSBC Debit Card (issued by UAE branch) to purchase mobile phones and accessories by signing for the purchases. While the card has chip & PIN ...
8
votes
4answers
1k views

Is Twitter digits login (sms auth code) insecure?

Twitter released(some time ago) a new kit named Digits which allows the client to login with a phone number and an authorization code (received through sms). I find it great for the user experience ...
1
vote
1answer
1k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
0
votes
2answers
91 views

Challenge authentication without roundtrip

Is it possible to have a secure challenge/response authentication protocol, authenticated immediately? Too slow: a client request -> server challenge -> client response -> server response Fast ...
2
votes
1answer
152 views

3rd Party Authentication protocol

I have a hardware device (H), phone (P) and web server (S). I would like P to be able to send commands to H, but only if it is authorized to do so. Permissions are stored on server. Technically I ...
3
votes
0answers
36 views

Simple Authentication Method to Secure REST API

I've been desperately trying to find a simple method of securing my API but still haven't found one that works. Unlike a lot RESTful APIs my API doesn't need user logins, tokens that expire, or other ...
2
votes
1answer
384 views

Is there any security risk, if the database with key handles for U2F devices are leaked?

Is there any risk, if a database of U2F device key handles are leaked? Enrolling a key works by: Send Enroll request with "AppID" to U2F device. U2F device answers with "Key Handle, Public Key". ...
0
votes
0answers
22 views

Does the CASB protect cloud applications and its data end-to-end? [closed]

CASB definition from Gartner site is here. From its definition, one can see the CASB covers most of enterprise security requirements which are mandatory on any deployments (cloud or on-premise). ...
-1
votes
2answers
41 views

Block requests containing URL of other websites

GET / HTTP/1.1" 200 166113 "-" "Mozilla/5.0 (compatible; dsada/2.0; +http://www.asd.com/search/asddd.html) I found this request repeated continuously in my logs. How can I prevent this (requests ...
0
votes
1answer
47 views

Securing application-application communication from devs and admin

Scenario: I have an application A which holds sensitive data. I have an application B which needs to process the data. A will provide a web-interface. B will make calls to get required data from A. ...
1
vote
3answers
46 views

Mutual Authentication - client authentication to the server via IP / FQDN?

I'm trying to get a better understanding of the Server / Client Mutual Authentication process in a TLS1.2 mutual authenticated session. My understanding is that the client is able to fully ...