Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
1 answer
28 views

Can my local MySQL server be accessed without permission

I have hosted a MySQL database server on a vps to connect to a flask web app on the same vps. It only has users with host as local ip address. Can it be accessed by anyone else remotely, except me? If ...
0 votes
2 answers
43 views

How to reuse PIN codes in the most secure way?

I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes. What could be a strategy for ...
0 votes
0 answers
26 views

Security concerns to proxy a SAML flow via regular HTTP basic authentication

I have an iDP, a server and a browser-based client application executing the SAML flow to get the assertion sent to the server. Communication between client and server and iDP is HTTPS. All that is ...
0 votes
0 answers
25 views

A Hybrid Authentication method. (JWT, MFA, Cookies, Sessions) [closed]

I am currently creating an app to help with retail management. As you may be able to imagine, user authentication is of great importance as the app will store all kinds of sensitive information such ...
1 vote
1 answer
71 views

Why is it a bad idea to accept passwords one character at a time for an authentication mechanism?

For the purpose of my studies, I am trying to answer the below scenario, in my opinion it is not a good idea, because it would leave the system open to brute-force attacks. A novel password scheme is ...
1 vote
1 answer
49 views

AEAD: Authenticating a digest of my data instead the data itself

Relevant question for Python: Stack Exchange: https://stackoverflow.com/questions/75739308/aead-authentication-with-huge-input-that-doesnt-fit-into-ram Top Answers: https://topanswers.xyz/python?q=...
1 vote
0 answers
19 views

Is SRP/PAKE equivalent to an asymmetric crypto challenge?

As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
  • 171
0 votes
3 answers
78 views

Avoid checking passwords for dos attacks

A server gets requests with a username and password. Checking the password can be expensive, so a hacker can do a DoS attack by sending lots of requests with random passwords. No attempt to break in, ...
  • 2,107
0 votes
0 answers
25 views

store strings in db with asymmetric encryption for a python app keeping the data secure

I'm designing an app that receives sensitive data input from a user and that data needs to be saved securely in a database. As far as I understand it needs asymmetric encryption but since this app has ...
  • 1
0 votes
1 answer
24 views

How does Android/Firefox authenticate the Android Pocket app, for example?

I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. ...
0 votes
0 answers
80 views

Cross-domain login authentication

I am currently working as system integrator for a banking company, that asked me to provide an authentication integration on a third party website on which the company would like to redirect users, ...
0 votes
0 answers
90 views

best way to keep user logged in with cookie and jwt?

I'm making an SPA with Laravel REST API and trying to keep it stateless. Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality. On successful login the client ...
  • 11
10 votes
2 answers
1k views

Show if email exists and if password was incorrect on our login screen? [duplicate]

We're developing a new login screen for our system, we have a couple of million users and we're thinking about what to disclose to the user. We currently: Let the user know that the email or password ...
  • 201
0 votes
2 answers
31 views

How does a validity check on a stylus-made signature compare to a validity check for a pen-made signature

In the old days, when signatures were used to sign cheques, there were people specialized in how to determine whether a signature came from a particular person or from a different person (forger). ...
0 votes
0 answers
62 views

bearer JWT client authentication and access token issued by authorization server

authorization server issues an access token with issuer details which are exposed in well-known api of that server. this server uses client authentication JWT token with clients configured , these JWT ...
0 votes
1 answer
97 views

Implementing secure two factor authentication with Google Authenticator?

I would like to add two factor authentication to a login screen. My understanding of the process is the following: Generate a QR Code Scan this Code with Google Authenticator app Use a library to ...
1 vote
0 answers
36 views

Login with self-signed PGP/GPG cert. without security key

Is there a way I can use a PGP certificate to login on my computer, but without a smartcard? I have multiple self made certificates for document encryption and also a state issued one for legal ...
  • 13
0 votes
0 answers
14 views

Details about pre-master secret [duplicate]

I was experimenting with WireShark and TLS decryption of the traffic. Every guide I've found states that I need to capture the pre-master secret generated by the client and then configure WireShark to ...
0 votes
1 answer
54 views

Google Security Cookies; Prevents cookie leak to malicious XHRs

Below is an excerpt from https://policies.google.com/technologies/cookies#security The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a browsing session are made by the user, and not ...
0 votes
2 answers
60 views

How would you enforce user to only connect on a given network?

How would you enforce user PC to only connect to a given network? Answers need to be OS agnostic. One weak solution could be to set client-side firewall rules to only allow communications with ...
  • 213
0 votes
0 answers
22 views

OAuth2 - implicit flow sign-out

I'm using a service that implements OAuth2 Because of some network issues, I need to use OAuth implicit flow in a component I'm developing (I know, it's terrible - we are working on the way to ...
  • 101
0 votes
0 answers
18 views

Is PIN method considered less secure when authenticating user before revealing passwords in Microsoft Edge's password manager?

When you are setting up authentication methods in Windows 11 (System settings → Account protection → Windows Hello → Manage sign-in options) you can learn that both PIN and fingerprint are recommended ...
  • 3,619
1 vote
1 answer
72 views

Should I display the 2FA secret only once or it can be always available?

A logged-in user enables 2FA for his account and a QR code with the secret is displayed. Is it correct to display the same QR code again when the user visits the 2FA settings page after some time? Or ...
0 votes
1 answer
41 views

Does this implementation of 2FA expose valid credentials?

I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be ...
0 votes
0 answers
41 views

Mifare Desfire EV2 data signing

I bought some mifare desfire ev2 cards because i needed a card that can be recognizable to everyone but that can't be cloned. So my idea was to store a private key into the card in a secure way and a ...
0 votes
2 answers
30 views

Security/Liability Concerns with Sign-In-Provider Account Merging

Assume my solution offers 5 identity providers that users can choose from Apple Facebook Github Google Microsoft These providers all take user identity very seriously. Is there any legitimate ...
2 votes
1 answer
98 views

Oauth: redirect uri validation [duplicate]

As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/ we should validate the redirect url at 3 points: at time of app registration when the auth flow ...
0 votes
0 answers
148 views

Is using the CSN of a mifare desfire EV2 safe?

From what I know, Mifare Classic cards are easy to copy/clone using a device such as a flipperzero, and it has to do with authentication using the CSN (card serial number) However, let's say that a ...
  • 1
1 vote
0 answers
32 views

Storing auth token in html

Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
  • 11
1 vote
1 answer
322 views

Is it safe to send an API key in an HTTPS request? [duplicate]

Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ? We need to send data to a 3rd party from ...
2 votes
2 answers
508 views

Oauth: native UI for internal / first party apps

We have an oauth implementation, which was chosen because of the following reasons: session sharing across different applications easy to reason about the security considerations as oauth is well ...
0 votes
1 answer
41 views

How WhatsApp knows that account is logged in on 1 device

Recently I was switching devices and my WhatsApp got logged out from 1st device when I logged in to 2nd device. And I got this question on my mind How WhatsApp knows that account is logged in on 1 ...
  • 1
0 votes
0 answers
45 views

Providing encryption and password for an IOT device over gRPC

I've been breaking my head over how to do this, as it doesn't seem to fit any example I could find online. My IOT device servers will run on the client network and may be accessed over it or over the ...
  • 101
0 votes
0 answers
19 views

Need of Transaction SIGnature (TSIG) record

Can't we simply send the shared secret key along with AXFR query? A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?
  • 11
3 votes
3 answers
116 views

Can a security system detect there are multiple copies of a single-issued fob?

My building gave me a single fob. I made 3 copies of it for my family and they all opened the building entrance but not my actual apartment door, until one day the building told me they had noticed I ...
2 votes
1 answer
78 views

When signing with server public key, how do I prove server key is trustworthy?

I have a server-side app in a Docker container that communicates with my desktop client app. I am struggling with how to ensure that the response from the server is trustworthy. I am fairly new to ...
0 votes
1 answer
46 views

Automatic Certificate Signing Request (CSR) Validation

I was wondering if there are papers or well-known algorithms to automate the validation of a Certificate Signing Request (CSR). Suppose I have a group of trusted services where I expose a "CA ...
1 vote
1 answer
122 views

Authentication using JWT signature, without header and payload

I am evaluating JWT as authentication mechanism for an API. The idea is to use JWT as API key. One thing I want to implement is revoking API keys. Since revoking involves a state change in my backend, ...
  • 113
0 votes
2 answers
142 views

How does a single mobile banking app implement a two factor authentication? [duplicate]

Recently I had more or less the same discussion with the helpdesk of several banks; a bank has a new mobile app that allows logging in without sending an SMS and without asking a confirmation code by ...
1 vote
0 answers
52 views

How to achieve an authentication method FIPS 140-3?

I've been studying the FIPS 140-3 but I still have questions about how to determine if an authentication protocol is FIPS compliant or not: 1- Is RADIUS over EAP-TLS FIPS 140 compliant? I know that ...
  • 11
3 votes
1 answer
101 views

How to design a desktop application that has access to a database via LAN?

As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
  • 31
2 votes
1 answer
79 views

Determine if the client certificate comes from a smarcard in mTLS [closed]

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
  • 31
0 votes
0 answers
31 views

How to implement challenge-response authentication using PKCS11

I have been searching for a way to use challenge-response over PKCS11, is that possible? I have found that it is possible for Windows Minidriver, but all the PKCS11 challenge-response protocols are ...
2 votes
2 answers
400 views

Mutual TLS replacement

When last time I was thinking about mTLS, I came to a conclusion that this is too hard to implement but at the same time it provides high security. The reason why it's hard to implement is that it's ...
2 votes
0 answers
12 views

What datums are required for an Oauth 1.0 replay attack?

I am working with some software where the vendor creates log files on exception. The files include a number of Oauth fields, and the vendor claims this is not a security risk. The Oauth fields ...
1 vote
1 answer
43 views

How can I share web-platform credentials across multiple desktop apps on Windows?

I have two desktop apps, each authenticate against our server using OIDC in order to call our web api. Currently the users need to login independently in each application. I noticed when using ...
1 vote
1 answer
190 views

How to interpret a Google "Someone is trying to sign in to your account from another device" message?

I received this message on my Pixel 4a phone yesterday evening: I pressed "No, it's not me" and then saw this message: I was at home with cat and five year old son. I was cooking and son ...
  • 1,609
0 votes
1 answer
143 views

OAuth2: Is PKCE required if the callback is located in the backend?

This is the architecture I want to follow Source: https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization I'm using a backend to ...
  • 103
0 votes
0 answers
41 views

Auto-login to account with PII using a random URL

I have a booking system where passengers need to add information that is quite sensitive (passport details etc). When they book, I generate a (difficult to crack) reference number, which they use to ...
  • 101
1 vote
2 answers
114 views

How can Alice ping and authenticate Bob without any of them sharing their public keyes beforehand

Both hosts have just their public and private key pair (but they do not have the other party’s public key). Bob should be authenticated Assume that the two hosts share clocks that are synced, i.e ...
user avatar

1
2 3 4 5
89