Authentication - establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

learn more… | top users | synonyms (1)

1
vote
1answer
86 views

How is github 2FA personal access token more secure than passphrase?

I recently enabled 2-factor authentication (2FA) on my github account. Once you enable 2FA, you can no longer connect to the repo using your normal passphrase using command line tools. You have to ...
0
votes
1answer
58 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
0
votes
1answer
63 views

Authentication scheme security: unique link and birth date

Recently I had to make an appointment at a hospital. I got an email with a link with a token in the form of a GUID. This brought me to a page where I had to enter my birth date to see the details. ...
0
votes
0answers
115 views

Secure Handshake and register for Auth

The registration The Start - pre-authentication Let's assume there are Alice and Bob. They know each others public keys and each of them generates a random string - Bob's Bobkey and Alice's Alicekey....
5
votes
1answer
101 views

Why does Android care about differentiating multiple fingerprints?

I was reading through the Android Compatibility Definition document after a friend pointed me there while we were discussing fingerprint scanners and other biometric authentications. I noticed this ...
1
vote
0answers
41 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
0
votes
0answers
43 views

Token-based SSO for multiple domains for backend API requests

I’m in the process of setting up SSO for a service I’m creating. After looking at solutions, I’ve found nothing to fit exactly what we need. I’m looking to make sure from a security standpoint what we ...
1
vote
1answer
92 views

How can I protect named pipes in windows?

I have some misunderstanding regarding how to secure the communication of named pipes in windows For example, I have a windows service that talks with other processes via pipes, how can I make sure ...
2
votes
0answers
38 views

Algorithm to generate (and verify) string of 4 quad alpha numeric code

I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
1
vote
1answer
34 views

Multi-User-Server Public-Key-Based Authentication

So, lets say we have Alice, John, Peter and Bob. Alice, John and Bob all know Peter's public key and trust Peter. Alice wants to connect to Bob's server, so she presents her public key, which was ...
0
votes
1answer
45 views

Multi-User-Server Token-Based Authentication

I have heard of token-based authentication, but the problem is that most of it requires trusting the server. What I need is something else. Alice, with my game, wants to connect to Bob's server, ...
2
votes
1answer
60 views

Can I use Authenticator instead of phone number for Gmail 2FA? [closed]

I want to enable Two-Factor Authentication for my gmail accunt, but when setting this up it asks for my phone number. I don't have a phone (that I want to connect to Gmail), is there another way to ...
3
votes
1answer
60 views

JWT authentication and authorization schema

I was going through Oauth2 docs and thought it was kind of permissive security wise, so i tried to implement JWT tokens with a special scheme like in the picture for a mobile app communicating with a ...
3
votes
1answer
47 views

Purpose of having a identifier on a password reset communication

A particular service I use, when asked for a password reset, showed me an identifier on the website - something like 4562708546, apparently random or sequential. They then sent me a new password over ...
7
votes
5answers
2k views

Why are generated access tokens for APIs much longer than passwords?

I'll take Twitter as an example. On one hand, when registering on Twitter, the password must contain at least 6 characters. On the other hand, access token to the API have about 50 characters: (...
19
votes
5answers
4k views

How to tell if a webapp transmits my password in cleartext?

I am trying to see if a webapp transmit password in some form of cleartext. The problem is that the web app is NOT using https! This is why I wondering is my passwords is sent in clear text. I've ...
2
votes
4answers
267 views

What's the idea of two factor authentication? A hacker can use password with mobile

2-factor authentication means to enter MOBILE app (using username and password) and there you get code to enter your account from PC browser, right? But if hacker has my password, then he can enter ...
4
votes
1answer
78 views

Security vulnerability of voice authentication in phone services

Having been asked if I want to opt for voice authentication when using a phone service, I was wondering about the security vulnerabilities of an authentication method which is relatively new to me. ...
62
votes
3answers
9k views

Does correcting misspelled usernames create a security risk?

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? I recently tried logging into facebook and misspelled my email. They prompted me with ...
0
votes
1answer
153 views

Is this a good scheme for storing encrypted user credentials?

We are building a service that manages multiple user accounts. For that reason, we need to store the credentials to a user's accounts using a symmetrical algorithm so they can be retrieved for the ...
3
votes
1answer
172 views

Would this RESTful login system be secure?

So I have been thinking about a way to make a secure restful API for application logins. This is what my teacher and I have come up with: The Client (swift program) initializes the connection with ...
0
votes
0answers
141 views

How to do role-based authorization with OAuth2 / OpenID Connect?

I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
3
votes
1answer
100 views

Is setting logon cookies in JavaScript insecure?

I'm facing a limitation in a backend system that can only set a single cookie via the Set-Cookie header which the front end uses to make an AJAX call to log the user in. The authentication system ...
0
votes
0answers
26 views

Clarification of RSA Key Exchange (TLS 1.2) and AES for On-Going Message Excahnge

I'm trying to understand the full flow of key exchanges for secure communications. As a potentially incorrect premise, I am under the impression that RSA is a good asymmetric technique for ...
0
votes
1answer
29 views

Local samba share without authentication

Locky and Co led me to make my local shares read only. Because there are only movies and series, it's not a big disadvantage of comfort. Now I created a share with read/write, only used for moving ...
2
votes
1answer
34 views

Understanding the security of a federated public key scheme using WebCrypto

I am proposing this scheme for federated authentication and WebCrypto. I am not sure if something like this (or better) exists, please do send me related material. Entities Alice's Browser, BROWSER ...
1
vote
2answers
179 views

Advantages with PIN code authentication where the digits are placed at random positions?

I noticed that a lot of high-risk websites, such as bank and payment platforms, do not use a passwords for authentication (as usual) but instead use a PIN code where the numbers are placed at random ...
0
votes
0answers
66 views

Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs

I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they ...
0
votes
1answer
32 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
1
vote
0answers
46 views

Vulnerabilities of using a token based authentication such as this

I'm developing a backend REST API for one of my mobile apps. I'm looking to create a token-based authentication system that would allow for a persistent login and I'm wondering if there are any ...
1
vote
1answer
57 views

Using TOTP instead of passwords for IoT device authentication

I am trying to come up with a way to authenticate an IoT device to a server. Since the device is "un-monitored", I cannot expect a user to enter a password on the device whenever the device starts or ...
0
votes
2answers
96 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...
2
votes
3answers
78 views

Mutual authentication of SFTP server

We can use public/private key pairs for client authentication when connecting to a SFTP server. Can we also have mutual authentication so the client also verifies a public key from the server? Both ...
2
votes
1answer
32 views

Single Page Application with REST API backend based on XML, queried by dynamic XPath

A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls. The SPA and API will both be served over an https/TLS ...
23
votes
4answers
3k views

What are the alternatives to door passcodes?

Passwords have been a problem since the dawn of computing. They tend to be either so complex that no one can remember them, or so obvious that anyone could guess them. ... Some users ...
3
votes
2answers
84 views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
1
vote
1answer
32 views

Is there a secure method of distributing keys to network-booted diskless nodes?

I have a bit of an 'initial trust' issue. We are using CoreOS to run Kubernetes, and secure both the etcd API and the Kubernetes API servers using client certificates. We are using iPXE to boot ...
1
vote
1answer
26 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
1
vote
0answers
26 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
0
votes
0answers
23 views

How to manage logged-in state across multiple subdomains with a JWT?

So I am using JWTs to manage logged-in state for users. We also have translated sites on subdomains, eg: www.example.com // english es.example.com // spanish de.example.com // german And so on. ...
0
votes
1answer
46 views

SRP, or hash hashes over HTTPS?

I'm designing a web API, which will use credentials from another system to authenticate. The API will require HTTPS, however I still want to avoid sending a basically plaintext password over the wire ...
1
vote
3answers
181 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
63
votes
9answers
11k views

I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
1
vote
3answers
49 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
0
votes
0answers
48 views

Does an account with a !! /etc/shadow entry have to still expire?

Currently where I work, our password policy is set at 84 days. This is set in our login.defs on all of our Linux machines. We have policies that are set around PCI DSS 3.1 and the like, this goes for ...
3
votes
3answers
116 views

Are login pages with no retry counts/lockouts a security risk?

I found a login page for a city/edu organisation that has no session times, no retry counter/lockout, and no delays if too many tries are made in a certain timeframe. I am able to exploit this to get ...
2
votes
1answer
137 views

Enter the password outside the password field

If I press Tab twice after enter my username, I will type my password somewhere outside the password field. Are there any chances for somebody to catch my password when I enter it outside the ...
1
vote
1answer
99 views

Should VPN passwords be stored in plaintext?

I know nothing about setting up a VPN, but it happens that I use a VPN add-on for Firefox, and that the VPN provider stores the user password in plaintext. Last week I installed a VPN add-on for ...
1
vote
0answers
35 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
0
votes
2answers
107 views

Is open source a good option for cryptography libraries? [closed]

I am trying to find good cryptography library to use with my project. I found open source options like openSSL and many more and also proprietory options like Intel Integrated Performance Primitives ...