Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
0 answers
5 views

Is it secure to use session ID as authentication token received from an HTTP header?

I am writing a mobile application for an already existing web app. In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with ...
TommyGun's user avatar
0 votes
0 answers
25 views

Will these actions better secure my web app

I'm trying to figure out what else I should (not) do to reduce the possibility of my web app getting hacked. And like most development efforts, while it would be great to have a security expert on the ...
David Thielen's user avatar
0 votes
0 answers
42 views

Should I redirect user to login screen after validating email and first password?

I'm working on authentication on the backend of an application and I want to know which of the following methods is the best. After the user registers in the application an email is sent to the ...
DarkSide77's user avatar
0 votes
2 answers
53 views

Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?

A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
Luka Demetrashvili's user avatar
1 vote
1 answer
46 views

Are JWT's needed when implementing passwordless magic link authentication?

I'm working on a web application where a user gains access by clicking on a magic link sent to them by an internal co-worker. Upon clicking this link, the user is automatically authenticated and a ...
Luka Demetrashvili's user avatar
0 votes
1 answer
90 views

Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?

I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
Luka Demetrashvili's user avatar
0 votes
0 answers
14 views

Double-factor auth to unlock iPhone in general and, especially, Passwords app in particular? [migrated]

Is it possible to make iPhone require both FaceID and passcode when unlocking the device? Especially Passwords app is guilty of relying solely on FaceID to pull up a password for a website or an app. ...
InfiniteLoop's user avatar
0 votes
1 answer
72 views

What happens at a low level when authenticating server certificates?

Regarding the TLS 1.3 Handshake Protocol: When the Server sends it's certificate, exactly how does the Client validate this? I know at a high level the Client is verifying the data the Server sent ...
rare77's user avatar
  • 145
1 vote
1 answer
31 views

What's the relation between Mathematica's authentication keys called MathID, activation key, and password?

I'm curious about how desktop softwares' installation authentication/validation process work in general, and hopefully apply it to softwares I make. But to start with a specific example, consider ...
qazwsx's user avatar
  • 123
0 votes
2 answers
137 views

Is WIFI that is 'open' but requires a password to access the internet safe?

It is common knowledge that connecting to open public WIFI networks can pose a security risk (e.g. to man-in-the-middle attacks). However, I have come across 'open' WIFI networks that require no ...
user246795's user avatar
0 votes
1 answer
67 views

token leak by copying cookie

Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
Jacson - ANLS's user avatar
0 votes
1 answer
54 views

Isn't there a critical built-in vulnerability in OAuth's Implicit flow?

I've read some blogs and did some labs regarding OAuth's implicit flow, but it seems to me everyone just turn a blind eye to a very critical point in the flow. Assuming that site A uses the implicit ...
Trigosin Darom's user avatar
0 votes
1 answer
48 views

Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?

It's considered a best practice in security for login form to provide a vague error message your username or password is wrong rather than the more precise: username does not exists wrong password ...
allan.simon's user avatar
0 votes
0 answers
78 views

If only 'two' insecure MFA options are available (email and sms) which is 'most secure'? [duplicate]

Although I disagree with the term MFA entirely if it refers to 'login code send to email', it's a one-time password at best, and likely badly implemented with its associated risks. I do see quite some ...
Bob Ortiz's user avatar
  • 6,661
1 vote
0 answers
59 views

Why is there no prevention of malicious polkit authentication agents?

A polkit authentication agent provides the user interface for administrators to input their password. It runs in user space. (https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html) An ...
Felix Ernst's user avatar
0 votes
1 answer
85 views

Authentication that immune to cookie hijacking [duplicate]

There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability. ...
Ghost Rider's user avatar
0 votes
0 answers
71 views

Are banks significantly reducing security by migrating everyone to mobile banking?

I have noticed a disturbing trend across banks (in the EU). Previously, many banks used 2FA by combining a login/password for an online banking website with a mobile authenticator app. However, many ...
TooTea's user avatar
  • 841
2 votes
1 answer
124 views

Is TOTP "more secure" and harder to crack than HOTP and why?

In addition to my question: How many known time/result combinations does it take to guess a HOTP/TOTP secret?. I've read often that TOTP is more secure than HOTP. One example: TOTP provides higher ...
Bob Ortiz's user avatar
  • 6,661
0 votes
0 answers
55 views

Prevent Session Hijacking with copying all metadata from a browser

For example, I'm signed in to my Gmail account. If I copy all data from all the places that Chrome uses (localstorage, all the cookies, all temp folders and so on) to another PC. How does Google ...
Ghost Rider's user avatar
11 votes
3 answers
6k views

Why do some websites require logging in twice? Not two steps, but two full username/password entries

There are a couple of web applications that I use that seem to require two successive logins. Not two steps, but two full logins. The behavior is such that I login in, get kicked out, then have to ...
Roy Hinkley's user avatar
0 votes
1 answer
55 views

Showing a license/id to a shopping website, worth it? [duplicate]

I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
skept1ca1's user avatar
10 votes
5 answers
4k views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
glades's user avatar
  • 219
0 votes
2 answers
88 views

OAuth2 authorization server dictating the resource server to the client

I am looking for any specifications, prior art, and known security considerations for a specific OAuth2 use case where: an authorization code grant is being performed. the client does not know the ...
Devin Ivy's user avatar
0 votes
1 answer
45 views

Authentication via User Interaction (Game play, using ML)

Something you know (password), something you are (biometrics), something you have (key card/security key) are the typical authentication factors. Several years ago I've seen a paper in which the users ...
Martin Thoma's user avatar
  • 3,916
0 votes
1 answer
174 views

Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?

Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
DevelJoe's user avatar
  • 131
0 votes
0 answers
78 views

Progressive profiling with auth0: Security when communicating with auth0 actions

I currently try to implement progressive profiling with auth0 according to: https://auth0.com/blog/using-redirect-with-actions-to-gather-user-info-and-increase-conversions/ to gather first name and ...
Christian's user avatar
  • 101
0 votes
0 answers
81 views

IP Address 47.128.16.39 has been going through our site for more than 4 days

This IP address has been going through everything - every image, every page. How can we know who this is and whether they are doing any harm? Is this abuse? Should we report this? If yes, to whom ...
emgee's user avatar
  • 1
0 votes
0 answers
33 views

Do `Signature` headers have real benefits? [duplicate]

I'm working with an HTTPS API that requires me to include a Signature header, the signature is calculated as codeBase64(hmacWithSha384(key, body)). I'm wondering if it provides any real-life benefits ...
hangyas's user avatar
0 votes
0 answers
97 views

Optimal way to securely store password on client with server invalidation but not knowledge

A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario. ...
InterLinked's user avatar
0 votes
0 answers
52 views

Difference between PassKeys and using touch-id to login in Apps

PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance. I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to ...
Procrastinator's user avatar
0 votes
0 answers
48 views

ow do I move password securely between api and web?

I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
nikki's user avatar
  • 1
0 votes
0 answers
114 views

Refresh-token rotation without additional frontend requests

I'm implementing a refresh-token rotation mechanism. For the sake of simplicity in implementing the frontend I would like to remove the need for requesting a new access token when an old one expires. ...
Ilija Vuk's user avatar
  • 101
1 vote
3 answers
384 views

is mTLS authentication alone considered secure for authentication

We have recently engaged an external party to undertake a pen test on a recently implemented API. The API is considered internal although it itself is on AWS and is consumed from on-prem resources, ...
ChrisBint's user avatar
  • 113
0 votes
1 answer
318 views

Identifying a session hijacking attack [closed]

I understand session hijacking has been a widespread attack vector in the past months. If an attacker steals a user’s session cookies, they can bypass 2FA and login/password. If this is the case, how ...
Mark O's user avatar
  • 3
0 votes
1 answer
53 views

Simplest federated authentication protocol: is this the right way to do it?

I've been struggling to find very simple, low level explanations of federated authentication protocols. Previously I've seen SAML and oauth, but they both seem to be very high level and far more ...
Jachdich's user avatar
  • 103
0 votes
1 answer
59 views

Is csrf protection required for extremely short lived cookies?

I have an app with token-based authentication (stateless). for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie. so I creates a cookie with my access token, ...
ינון רחמים's user avatar
0 votes
1 answer
114 views

Evading authenticated diffie hellman with MITM

I understand that in a non-authenticated Diffie-Hellman setup, a man-in-the-middle attack can occur. Now i'm curious about the feasibility of the following scenario: Let's assume a situation where www....
SempriGno's user avatar
0 votes
1 answer
82 views

WebAuthn does not guarantee public-key integrity other than trough attestation?

I've been reading about WebAuthn and try to write some code to exercise. One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
DannyNiu's user avatar
  • 370
0 votes
0 answers
52 views

What's the best approach to storing JWTs on the client

I'm developing a web application and I want to use token based authentication, but after implementing the feature on the server side I got stuck on trying to figure out what is the best approach to ...
iKingNinja's user avatar
0 votes
0 answers
58 views

Passkeys versus passwords for intranet websites

Do passkeys offer more security for intranet websites compared to passwords? I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
fitcfitcfatc's user avatar
-1 votes
1 answer
77 views

PATCH request on a login attempt

I have a problem deciding what is the most secure method to send a login request with a username and password strings, I understood that PATCH is less secure than PUT while both are less secure than ...
Jan Safronov's user avatar
1 vote
1 answer
327 views

Where are wifi passwords stored? [duplicate]

I'm looking for technical details on how Windows, Linux, and macOS all store the SSIDs and passwords for every wireless network you've ever connected to. I've tried searching for this, but my Google-...
Wes Sayeed's user avatar
0 votes
1 answer
320 views

Perfect DMZ: LDAP auth to AD

My goal is to integrate a public facing service with AD using LDAP. While I vouch for federated approach to user authentication, the business dictates LDAP. We run a DMZ subnet and I insist on not ...
Grigory Sergeev's user avatar
0 votes
1 answer
91 views

Is using the computer for MFA safe?

Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer. But what are ...
Vitor Figueredo Marques's user avatar
1 vote
0 answers
43 views

MS-CHAPv2 Auth protocol downgrade

I'm researching about PPP (Point to Point protocol) and it's security aspects. While exploring PPP Authentication I've noticed possibility for security downgrade attack. Generally authentication ...
Zduniusz's user avatar
0 votes
2 answers
231 views

Most secure way to pass data from client to server?

I'm writing an authentication system and would like some suggestions on improving its security. Currently, I use RSA to communicate data between the client and the server. Here's the process: The ...
Daniel Rayburn's user avatar
0 votes
0 answers
32 views

Make use of encrypted or anonymous data in database [duplicate]

As an answer to the following question, I read the idea of encrypting user data with 2 keys based on random generation and the user password: Store encrypted user data in database But could anyone ...
Sichrisy's user avatar
0 votes
0 answers
69 views

Bearer JWT session token value

I am working on a personal project, I am now working on the authentication. My back-end is written in Python (fast-API) and I am generating a JWT bearer token that I put on my cookies for my front end....
Pierre-Alexandre's user avatar
1 vote
0 answers
49 views

Best practice of x.509 client certificates accross multiple systems

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients Let's say I create certificate and user for admin: subject: CN=admin issuer: CN=MongoDB Issuing CA -> db.createUser({...
Wernfried Domscheit's user avatar
2 votes
1 answer
157 views

Should I return JWT tokens on a login route even if I am using cookies?

I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to ...
Jaanis's user avatar
  • 21

1
2 3 4 5
90