Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Authenticity of VR SecureGo Plus banking app [migrated]

I've followed the instructions here in a first attempt to test the authenticity of two sideloaded APKs of the VR SecureGo Plus banking app using keytool and jarsigner under Windows. The APK sources ...
user avatar
0 votes
1 answer
47 views

Strange Root CA certificate in Windows Trusted Root CA Store

While reviewing Root CA certificates in Windows Trusted Root CA Store I came across a stange Root CA certificate with Issuer Desktop-XXXXXXX and Subject Desktop-XXXXXXX, enhanced key usage for server ...
user avatar
  • 1
0 votes
0 answers
31 views

Is there a need for mutual Authentication in the following use case? if so why?

I came across this use case where mobile devices operating in a pull architecture (connecting to an AWS cloud service endpoint) based on some device triggers will request to be unlocked via a TLS ...
user avatar
1 vote
1 answer
55 views

Why does channel binding prevent MITM attacks?

I have read RFC 5056, RFC 5929, and RFC 5802. They say channel binding can prevent MITM attacks in an insecure environment where the client does not or cannot verify the authenticity of the server. If ...
user avatar
0 votes
0 answers
30 views

Why not prompt for password and TOTP simultaneously? [duplicate]

In most common web applications that support multi-factor authentication the user is first prompted for their username and password, and only after a successful first authentication the user is ...
user avatar
0 votes
1 answer
465 views

What will happen if I accept this "Change your search setting to: smartwebfinder.com"?

When I want to install Ultrasurf extension it gives me this message: So I do not understand what this "Change your search setting to: smartwebfinder.com" wants to do. When I go to this ...
user avatar
  • 1
0 votes
1 answer
39 views

Is SMS a secure authentication method? [duplicate]

I’ve seen many HN comments bashing on SMS being insecure. But WhatsApp and signal both use it as their primary authentication method so it can’t be that bad? Why is it bad? What attacks are it ...
user avatar
0 votes
0 answers
43 views

Why is OIDC more secure than oauth2?

If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
user avatar
0 votes
1 answer
23 views

How to bypass XMLRPC lockout policy?

I'm trying to pentest a Wordpress box that has the XMLRPC endpoint enabled, but it seems to have additional security measures in place that institute IP-based lockout for 24 hours after one failed ...
user avatar
3 votes
1 answer
106 views

Is FIDO2 authentication vulnerable to a social engineering replay attack?

I'm starting to learn about the FIDO2 standard, and I'm wondering if this scenario is possible... Victim visits a credential harvesting page and enters their credentials Credential harvesting backend ...
user avatar
  • 835
0 votes
0 answers
34 views

Authenticating with unencrypted POST credentials - is it safe? [duplicate]

If a webpage is served over https and to authenticate it receives both login and password as unencrypted POST parameters (free text) is it considered unsafe?
user avatar
  • 121
4 votes
1 answer
666 views

SSH Man in the middle attacks - how to detect if the victim is allowed to login on a remote server and which method is used

There are some man in the middle tools for ssh, which can be used to intercept ssh sessions: SSH-MITM project OpenSSH fork with implemented mitm capabilities The OpenSSH fork has some problems with ...
user avatar
0 votes
2 answers
34 views

Altering requests after authenticating

In a web mvc application I have the user login and then he is navigated to a View which presents some data fetched from the database based on a unique Id of the user. He can continue to other views to ...
user avatar
  • 2,101
1 vote
1 answer
103 views

Is OTP an acceptable alternative to a password in single-factor authentication?

I recently discovered that when I have two-step verification disabled on my Amazon account, Amazon will allow me to sign in to my account using only my phone number and an OTP code sent via SMS. I am ...
user avatar
  • 113
1 vote
1 answer
71 views

How message authentication code (MAC) works?

Let's suppose I'm uploading some website to website example.com, and I'm signing every single file with MAC which is shared by users of my website to verify that me (the admin) uploaded that file. It'...
user avatar
  • 9
0 votes
1 answer
54 views

Does Google Authenticator share device information to website?

I wonder about Google Authenticator privacy. I wonder if the app shares any information to the website owner about devices that we use to add a new key. I mean information like IP address and device ...
user avatar
  • 1
0 votes
0 answers
21 views

Modelling authorization on the basis of authentication method

At work we are starting to consider a replacement for an old system. The new system will use the Spring framework. The security model is pretty simple: it is open to the general public. Each one of ...
user avatar
  • 103
0 votes
1 answer
41 views

Can the services inside the VPC be authentication less?

We have a micro-services architecture, where many microservers need to talk to each other for data. These services are inside a VPC. I need to understand if the HTTP APIs of these microservices need ...
user avatar
0 votes
0 answers
13 views

Is a TOTP with RFC 6238 and a password in a manager 2FA? [duplicate]

For example Microsoft Outlook web based email service can be configured to require both a username/password combination and a time-based one-time password (TOTP) generated by the algorithm described ...
user avatar
  • 111
1 vote
1 answer
78 views

What are the security best practices to implement offline login of android apps?

My client has an android application requirement. The users of the application are workers who might have to work at places where internet connectivity is unavailable. So an offline login feature is ...
user avatar
0 votes
0 answers
18 views

Storing strings in a Database that are only visible to their owner who stored them when they were logged in

In my application, logged-in users create some strings, and those strings are stored in the Postgres database. But, because they are in plaintext, their values are visible to me, as I have access to ...
user avatar
0 votes
1 answer
79 views

Would storing the users IP address in a session token be more secure?

In a web app, would storing a users IP address in a session be more secure then storing it without it? I think that if I store a JWT in their cookies that includes their IP address for session ...
user avatar
0 votes
1 answer
40 views

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
user avatar
2 votes
2 answers
98 views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
user avatar
  • 205
17 votes
4 answers
3k views

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
user avatar
  • 181
0 votes
0 answers
37 views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
user avatar
  • 1
-1 votes
1 answer
84 views

Using certificates for authentication in a web site

Today i faced a web site related to government that showed me all of my certificates in a combobox for authentication on that web site. What were those certificates? How can i show them in a asp.net ...
user avatar
1 vote
0 answers
16 views

SIM hardware protection of master and long lived keys

4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki. A case was reported here in which NSA ...
user avatar
0 votes
0 answers
74 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
user avatar
0 votes
0 answers
20 views

How does the SAML based SSO differ for Internal (employees) and External users (external resources)?

We are trying to set up(I am not part of the setting up process) an SSO based login for an ITSM application. Our organisation has some users working for us although they use their own organisation ...
user avatar
  • 101
0 votes
1 answer
30 views

Can third-party authentication yield a static user-specific encryption key?

I'm writing a REST server + frontend with two goals that seem to conflict: Signing in yields a static, user-specific key (K1) to decrypt a document (D) stored encrypted on the server. The key should ...
user avatar
0 votes
1 answer
46 views

Creating secure website-based login for a desktop app

This question relates to this post I made on StackOverflow recently, which I'll recap here briefly. I have a desktop app that I would like to authenticate through a website, using the process outlined ...
user avatar
  • 103
0 votes
1 answer
43 views

AWS Service-To-Service authentication via Identity document

In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
user avatar
  • 1
0 votes
0 answers
14 views

Is my perception of improved security by restricting access to an MS365 tenant/associated apps on per-device basis misguided? Why?

Receiving guidance from a contractor that restricting unknown devices (regardless of MFA, location, etc.) to an Azure tenant does not improve security in any meaningful way, and just creates a ...
user avatar
0 votes
1 answer
59 views

What security concerns can arise from using HTTP Basic-Authentication? [duplicate]

During an engagement, i have been asked by a client to explain (with the use of one or more examples) why they must update their website authentication mechanism, as they are currently using HTTP ...
user avatar
0 votes
0 answers
99 views

What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?

I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
user avatar
1 vote
1 answer
133 views

Is it possible to crack a 2FA/MFA secret key provided you know enough of the previous generated codes?

I have two accounts that won't show me the 2FA/MFA "Secret Key" used to generate the multifactor codes. Because of this, I am forced to use specific MFA apps rather than my preferred one. If ...
user avatar
  • 13
2 votes
2 answers
54 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
user avatar
  • 2,914
-1 votes
1 answer
56 views

Can using 2FA compromise me in any way if the website owner goes rogue?

Context This question concerns a website that has no commercial or business background, it is a purely personal project. This website is ran by 2 strangers from the internet, who lend access to ...
user avatar
  • 101
1 vote
3 answers
138 views

What account do you enter when using ' or '1'='1?

So I'm writing a paper on sql injection for my db class and one thing I don't understand is this. I assumed that one of the reasons a lot of sites don't allow duplicate usernames is that they use ...
user avatar
  • 13
0 votes
2 answers
150 views

Is this really two-factor-authentication?

In the country I live in, most authentication for online banking or authorities (such as tax) is based on an app. It has two operation modes: Enter personal number on website (the personal number is ...
user avatar
  • 163
-1 votes
2 answers
63 views

How to check the authenticity of an outlook email attachment (.msg)?

let's say that someone sends me a business email on Microsoft outlook 365. I save the email as an attachment (email.msg) How a third person can make sure that the email attachment is not edited (...
user avatar
  • 99
0 votes
0 answers
52 views

Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection

In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
user avatar
  • 101
0 votes
1 answer
59 views

Voice input as security measures for system authentication

Can voice input as password could be a useful security measure aa a alternative for strong password (Keyboard characters complex), biometric (face, thumb, signature etc)? The voice inputted as a ...
user avatar
0 votes
0 answers
11 views

Best way to handle token authentication workflow on mobile apps

I'm working on a mobile application and I need to create a token-authentication workflow. So far I've pointed out main token: Token by reference, that are store in database, like (https://www.django-...
user avatar
1 vote
1 answer
67 views

how does fingerprint authentication work without trusting the client device?

There are lots of resources discussing the security of fingerprints but I haven't been able to find the answer to a very basic question. In the simplest possible password authentication scenario, the ...
user avatar
  • 253
-1 votes
1 answer
235 views

How to generate SSH keys inside yubikey?

How do I generate SSH keys inside my yubikey, on Ubuntu? There seems to be nowhere to look for this info.
user avatar
0 votes
0 answers
21 views

What is the 'domain name' in PKCE Auth flow for mobile apps?

I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation To apply for an application key, I need to enter my application'...
user avatar
0 votes
0 answers
44 views

Mitigating CSRF and XSS with JWT authentication: can someone tell me where my logic is wrong

I'm currently working on a personal project including a RESTful API and also trying to understand how to make it as secure as possible. I have read a bit about JWT, the possible vulnerabilities as ...
user avatar
0 votes
0 answers
43 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
user avatar
  • 101

1
2 3 4 5
87