Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
2answers
67 views

smart card authentication process

Smart cards (for instance, public transit cards) are widely used in some countries for authentication purposes at universities and workplaces, so that an authorized person can use a printer or access ...
0
votes
0answers
17 views

Reuse Firebase Token for other authentication purporses

I'm building an app where the users should have restricted access to certain api-services. I use gRPC as API. Right now I'm asking the user's mobile number, send him an SMS with a code which he has to ...
1
vote
2answers
79 views

Is it useful to have a wp-admin page for a non-wordpress website?

I have a non-wordpress website running on a not-so-powerful server. Bots often try to find admin pages (such as wp-login/wp-admin), which increases the bandwidth that is used. Here, in a comment, ...
2
votes
0answers
33 views

Authentication and authorization of a subrequest

A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
34
votes
6answers
6k views

Do fake wp-login pages help prevent webapp attacks?

Many bots attack websites by trying to find an admin login page (such as wp-login.php) and trying to login. Would an effective way to stop these attacks be to create a fake (non-login) page for the ...
1
vote
0answers
37 views

In memory JWT for API auth with HTTP-only cookie for sessions?

I've spent a while reading about this, and I know it's a common topic, but I was hoping to get some feedback on my authentication approach. I have an SPA. It needs to authenticate to 1) my ...
1
vote
1answer
42 views

NTLM Modern usage

I understand that Kerberos is the recent authentication protocol used in windows environment and that NTLM is still supported for interoperability only. I want to know in non domain environments,if i ...
0
votes
1answer
96 views

How does winrar know I typed the right key?

As far as I know WinRar uses the password you type and derives the key from it. But how exactly does it check if the key I typed is correct? What I think is that it compares your guess with the right ...
0
votes
1answer
44 views

How can we assure Non-repudiation without a personal certificate (eg. using ID authentication)

I need a help to understand some specific points about non-repudiation, nonetheless I implemented some authentication methods: Digital Signature Authentication; CHAP (Challenge Authentication ...
0
votes
1answer
40 views

How to approach Web App? [closed]

I'm doing testing on the app, if we take only login url as a starting point. How to expand my horizons? I want to make my surface wider, really kinda stuck on this one.
-2
votes
0answers
28 views

Does all of MFA need to be on a single authentication node?

All the Multi Factor Authentication (MFA) mechanisms I have seen were installed on the same "authentication node". What I mean by that is that a single service (say, an authentication web page, or a ...
0
votes
1answer
54 views

Using Refresh Token inside of Access Token without HTTPS

I previously read that Access Token must be sent with every request to the API but Refresh Token must be sent ONLY when the Access Token expires. I'm trying to use a similar model to the conventional ...
0
votes
0answers
34 views

How can i bypass SSL/TLS pinning in my app?

I am debugging my Windows app which has SSL/TLS pinning, and i want to bypass/remove it so i can debug the endpoints. How could I get the CLIENT_HANDSHAKE that the app uses? I can definitely patch ...
0
votes
1answer
49 views

Is it safe to use third party OIDC ID Token as our APIs bearer token?

Practically, we are outsourcing the authentication of our users to a third party application, that's, needless to say, external to our system. I am not sure if this is actually advisable, but from our ...
0
votes
1answer
81 views

How can I create a secure auto-login? (java)

I am writing a server-client program. When a new user installs the program and opens it for the first time, he has to enter a password. The password in combination with an email address is needed to ...
2
votes
1answer
63 views

Is using the JWT token to perform queries, as opposed to a raw value in its payload, considered a good practice?

For my SPA app, I'm using Firebase as the authentication provider. I'm also using this token to authenticate with my back-end server. The Firebase documentation reads: "Warning: Do not accept ...
0
votes
2answers
55 views

Saving authorization token in browser

I have a REST API which returns an auth token when the user is logged in successfully. This token needs to be sent in different routes for authorisation. This is working fine is my android app. But I ...
4
votes
1answer
188 views

Is it safe to create a session from an auth token?

My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
0
votes
2answers
89 views

Simple and Universal way to password-protect existing webservices that are exposed to internet

There are many tools, devices and programs that by default run a http server and expose a user interface on port 80. Even my coffee machine has a web ui that it provides on port 80. Now, it's easy to ...
0
votes
0answers
30 views

Doesn't installing a TOTP client on your primary PC undermine the whole point of 2FA? [duplicate]

Authy is a popular cross-platform TOTP application that supports syncing keys across devices. I have been a little confused by the idea of having a desktop client... This way if someone accesses my ...
0
votes
0answers
53 views

How to ensure your own native app is talking to your own API [duplicate]

I'm developing an API and different apps to access to it, each with different scopes, including a native mobile app, and I'm wondering what would be a good strategy to authenticate my own native app ...
-1
votes
2answers
94 views

Recommending diceware upon user registration

The Diceware method of password generation is simple, secure and easy to use When registering an account on a website Why do websites not suggest to their users to use the diceware method? Why do ...
2
votes
1answer
269 views

Security of PIN that spells out words?

Description PayPal suggests that generating a PIN by spelling words (on a numeric pad, e.g., [ABC] = 2) is a good method for security and memorability, e.g., B-L-U-E-C-O-W = 2583269. My knowledge ...
0
votes
0answers
31 views

How Do Online Identiy Verification Companies Ensures Their APIs to Be Not Abused?

I am trying to implement a photo ID verification along with a live-selfie verification on my Android/iOS apps. I figured that I might be able to implement these features using Python machine learning ...
1
vote
1answer
52 views

How to ensure JWT security in authentication?

I have implemented a backend as a REST API. To maintain the statelessness in REST, I intend to use JWT to verify that that a user has logged in or not. (A user is logged in if a valid token is present ...
1
vote
1answer
29 views

Where to store tokens for analysis team members

As part of their day-to-day work, each member of our analysis team must handle a variety of sensitive information. For example: username and passwords for our internal databases, and tokens for ...
1
vote
1answer
45 views

How to implement “Enter Password to Continue” for a page in a stateless application which uses JWTs?

In my application I want a page to be accessible to the user only after s/he has entered the password again to prevent someone else opening that page in case the user has left a logged-in device open. ...
1
vote
1answer
70 views

How to secure an email subscription endpoint?

I have a simple static webpage that lets users sign-up for a newsletter. Once they enter their email address, it gets sent to a public endpoint (AWS Lambda). This lambda function forwards the email ...
0
votes
2answers
63 views

Why hash on server instead of client? [duplicate]

Please hear me out. I used to scoff at people who asked this question because client-side hashing is "so obviously wrong." I have read similar questions on this site but haven't found a satisfactory ...
1
vote
1answer
61 views

Netflix logout does not revoke secure netflix ids

I am learning about microservice security and I wanted to see if Netflix really logs me out. While logged into Netflix, I opened https://www.netflix.com/YourAccount and in inspector viewed headers I ...
0
votes
0answers
40 views

When should refresh tokens be stored in a database?

I have a native Windows application programmed in .NET Core that needs to call a Web API. I intend to have the user enter credentials periodically, receiving a refresh token from my auth server for ...
0
votes
0answers
55 views

Authorization Code Grant Flow for web-app with backend on separate domain (same origin)

We have had a security consultant make a recommendantion of an approach that does not follow the IEFF best-practice document (https://tools.ietf.org/html/draft-ietf-oauth-browser-based-apps-04#section-...
0
votes
1answer
51 views

Authentication for server to server api

I want to design an api which an organization is going to use to connect with my server. For a client-server application, a simple jwt-based authentication is done by verifying user credential and ...
3
votes
2answers
123 views

Solution for password spraying on my app

We have a web application where the input fields for login are: username and password. In order to prevent brute force attacks, we have implemented a lockout function for 5 invalid tries of valid ...
0
votes
1answer
50 views

Combining User Context in Machine-2-Machine OAuth2 Client Credential Flow

I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow. One of the two application is an automation service without user context. The ...
1
vote
1answer
77 views

2-factor authentication can be misused?

I was trying to access my account on an e-commerce website but I couldn't get my password right. So, the website offered me the option to authenticate using my security code from Google Authenticator ...
0
votes
0answers
28 views

How can I use SALSA20 and POLY1305 in a Linux Terminal? [migrated]

I am new to this. I can use gpg pretty well in my terminal on Fedora and TAILS. I have that figured out. Now I want to use SALSA20 and POLY1305 in the terminal too, on my own files. I do not want ...
1
vote
1answer
87 views

What is the problem with developing secure protocol on top of communication protocol without binding

I read that developing a security layer on top of communication protocol without any binding between them could cause an issue like MITM attack. I am having a hard time seeing how that could be ...
0
votes
1answer
82 views

When I try to SSH into my computer through its public IP the server's host key fingerprint is different?

When I SSH into it through my local network, and when I actually go and check with ssh-keygen I get 1 rsa fingerprint. And when I try to SSH in though my public IP I get a different host fingerprint ...
0
votes
1answer
61 views

How do browsers detect authentication type?

To elaborate, HTTP basic auth is pretty straightforward - we can skip that. Auth with client certs is cumbersome and unpopular - skip that too. What I am really interested in is: With form-based auth,...
0
votes
1answer
38 views

Proving a software deployment's origin sourcecode [duplicate]

Is there a mechnism that can ensure a deployment (server that can give https responses) is built from the actual (public) sourcecode provided by another https URL? sourcecode from commit #10020 at ...
0
votes
0answers
40 views

Can backend verify mobile client using OpenID Connect?

Objective My goal is to implement a generic mobile client and backend authentication flow, just for practice. Imagine that I am building a note app that stores user notes on the backend. Instead of ...
0
votes
1answer
104 views

Yahoo! Mail logging in with 2FA code only

I came across a serious issue with Yahoo! Mail that I hope someone would help to fix or raise awareness for. I wanted to create an account on Yahoo! Mail. I entered my phone number to the Yahoo! ...
1
vote
3answers
129 views

Downsides of allowing multiple emails per user?

There's lots of information on using one email for multiple accounts, but how about the other way around? I'm building a service and considering allowing users to log in with any of their registered ...
0
votes
0answers
42 views

One-time-use methods alternatives?

Luckily, I’ve never faced an issue like this, but it came to my mind. Let’s consider tokens or QR access tickets. Do I have any option rather than banning the ID on the server? If I have a one-time-...
0
votes
2answers
73 views

Angular (2+) code visibility to users

I'm looking into Angular and read that typescript is compiled to javascript. Is everything viewable/visible to users that I write using typescript? With PHP I know you run code that's only visible to ...
0
votes
0answers
41 views

USB token for Java Desktop Application

I would like to integrate the use of a USB token in a JavaFX application that my customers use on a computer I send them. This JavaFX application interacts with a Java/Spring back end. (client-id/...
0
votes
3answers
82 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
0
votes
1answer
64 views

API Key via Basic Auth: Send it as a username or as a password?

In APIs that authenticates with a single API key (eg a long random string) via Basic Auth, I have seen that most (eg Stripe, Unbounce) sends the API key as the username, leaving the password field ...
0
votes
0answers
44 views

“Something you have” on a multi-user device - what is the opinion regarding the NIST AAL3 definition?

The NIST AAL3 specification requires In order to authenticate at AAL3, claimants SHALL prove possession and control of two distinct authentication factors through secure authentication ...

1
2 3 4 5
77