Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

ELI5 what is the benefit of separating my resource server and auth server?

I have heard people say that separating the resource server and auth server makes it easier to scale but also improves the security. As I don't know much about hacking I hope that someone could ELI5 ...
0
votes
0answers
22 views

Standard existing authenticated channels [closed]

Which standard secure channels (or even authenticated) allow me to sign every message I send? For instance, can we use TLS or PKI to achieve our goal?
0
votes
0answers
20 views

Can I Use AWS Cognito to protect external service, not AWS hosted service

I have a requirement to offer an Open ID Connect Identity Provider server. (That is, i have some users with their credentials checked against some data store under my control, and users are using ...
-1
votes
0answers
100 views

Former Boyfriend has hijacked my computer systems, software programs and/or network communications [closed]

How do I recover from a calculated near unbelievable cyber hijacking? It started with my Verizon phone two weeks after a break up. The phone began linking and syncing apps, contacts just everything to ...
0
votes
1answer
82 views

Why some payment methods allow being embedded in an iframe and some don't?

Let's take some examples: Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame ...
1
vote
0answers
42 views

Is Google OAuth login in 3rd party applications via system browser secure?

Numerous mobile applications allow me to "Login with Google". From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
1
vote
1answer
70 views

Creating Client certificate for mutual TLS authentication

I have an application that is installed at customer premises. This sometimes has to communicates with their server(PACS server), and the details are configured in our application. I have to enable TLS ...
0
votes
0answers
62 views

Using contacts as an authentication factor for a password reset [closed]

What are the drawbacks of using the contacts of the user as an authentication factor when resetting a password? Is this a reliable method of authentication to verify who you are (eg. when compared to ...
1
vote
1answer
45 views

How does the supplicant connect to the auth server in EAP TTLS?

I understand that a tls has to be established between the supplicant (end user device) and the auth server but a few things are unclear : How does the supplicant know the ip adress of the auth server ...
0
votes
0answers
18 views

CTRL+ALT+DEL login option gets disabled on every shutdown [migrated]

My issue is the opposite: I WANT to have the CTRL+ALT+DEL requirement on every logon but something keeps resetting my local Security Policy back to 'Enabled', meaning 'disable the logon requirement ...
1
vote
0answers
44 views

Alternatives to OAuth 2 for first-party native applications

I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
42
votes
2answers
6k views

Why don't car keys use algorithms like RFC 4226?

I've been reading a bit into car security and all of the ways cars can be stolen through various alterations of replay attacks. Upon researching whether any of the more modern cars are using anything ...
0
votes
0answers
37 views

REST API with OAuth-Authorization running in different domains

We are attempting to set up authentication for a Web-API (build on .NET Core) that is being hosted on different domains, mostly within the the respective intranets. Currently relying on Windows ...
2
votes
1answer
68 views

ePassport Chip Authentication - how to verify?

I want to implement Chip Authentication for ePassport documents, and wish to validate my understanding of it. I've managed to get it up and running by using the JMRTD library, specifically the ...
0
votes
0answers
37 views

how to securely authenticate to artifactory in deployment (with conan) [closed]

We're using artifactory to store binaries and conan to retrieve them. What's the best way to securely authenticate to artifactory via conan on test clients (and in production)? Currently we're ...
0
votes
2answers
93 views

Could blockchain be useful for a protocol to verify content from a trusted publisher in the way I'm thinking of? [closed]

The problem with static software whitelisting is that in the real world, employees with versatile jobs need to run unexpected programs. Company sets up a whitelist to limit what programs can run - ...
0
votes
1answer
67 views

How to force web sites and services to stop resetting passwords of accounts without user's permission and prompt? [closed]

A new trend in account security is spreading: web services like LinkedIn reset passwords automatically when detect attempts of getting access with wrong password or from new locations. Thus, a user ...
0
votes
0answers
4 views

Windows 802.1x authentication metods automatically switch - Windows NPS server [migrated]

Is it possible that if Windows 10 the client does not pass 802.1x certificate authentication to switch automatically to username and password authentication without affecting the user, ie how to set ...
1
vote
1answer
52 views

Security risks of the following authentication flow

Let's say Party A has many customers (one of them let's call it Customer X) with data in Party A. Party A is allowing Customer X to get data from their API. In order to do that: Customer X downloads ...
2
votes
2answers
93 views

Digital Signature verification Automate vs Manual

Digital Signature verification process for software installation can be done automatically during execution or manually by user. (I'm considering PKI Method of certification.) For example, in case of ...
-3
votes
2answers
124 views

Number of biometric samples required to form an exhaustive set of fingerprint hashes?

Number of biometric samples required to form an exhaustive set of fingerprint hashes? Slight variations in the sample produce different hash values of the sample data. The answer linked below ...
4
votes
4answers
211 views

Is a “magic link” a kind of authentication?

From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system. Can this ...
0
votes
0answers
33 views

Figure out security and auth for mobile app which uses Firebase

I need a bit of help to figure/plan out this scenario: So for a mobile app I'm currently working on, the use case requires authenticating users via mobile number and OTP. So basically the user enters ...
0
votes
0answers
39 views

What is Threat Profile is Microsoft addressing with the MSAL URI format?

Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName This is in contrast with what other IDP's are doing. Can anyone explain the benefits or drawbacks ...
0
votes
0answers
44 views

Authentication & Authorization for multiple separated APIs

Architecture Overview: Single Authentication Server and a separate API for each group of users, that can access their API through multiple SPAs with SSO feature. Let’s say we have three APIs A, B and ...
1
vote
1answer
60 views

RSA vs ECC certificate for IoT device client side certificate authentication

I am using client-side certificate authentication (mutual authentication) in my IoT prototype. we acquire client side certificates using embedded PKI through a CA. There are the provisions of ...
0
votes
2answers
73 views

Can cookies with a complicated secret be manipulated?

Im currently working on a personal full stack application using cookies with the express-session middleware. Theyre secured with some sort of secret. Im not really too sure how that works but I think ...
0
votes
0answers
66 views

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
0
votes
0answers
23 views

Multiple user specific APIs with a single Authentication Server

I’m currently in need of some clarification for an authentication/overall strategy. First I will describe the use case and then the questions that arise for me. Use Case I want to have a single docker ...
0
votes
1answer
26 views

Creating a separate privileged (admin) user account for authenticated VA scans

When reading many sources on performing authenticated vulnerability scans, it has been mentioned that creating and using a separate admin (privileged) user account for scans is recommended rather than ...
0
votes
0answers
33 views

Multi stage/request SQLmap with challenge

I have a scenario where I'm testing for injection points but the authentication form has a challenge token that refreshes with each GET. The credentials are sent in a POST accompanied by that ...
0
votes
1answer
78 views

Identifying unique visitor using only info that can be gathered through the browser?

There is a site that allows a voter to vote for their favorite nominee once a day for a certain amount of days. While entering a vote, the only info given is the ballot choice you choose and nothing ...
0
votes
2answers
129 views

Does sending hashed password over url path parameter secure?

I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to ...
0
votes
1answer
59 views

WPA2 Enterprise Authentication Certificate Security

While reading up about WPA2-Enterprise, it states that it is more preferred over WPA2-Personal as it allows authentication via digital certificates which prevents over-the-air attacks. However, I am ...
0
votes
0answers
33 views

Can a client with x509 certificate and server side validation of ip-address and deviceId considered a trusted system for less secure login method?

we are working on an web application in which users needs to be able to switch easily between user accounts while working on the same computer. The idea is to have: a strong login (email,password) ...
0
votes
1answer
50 views

Why does message 1 of the WPA2 4 way handshake begin with the access point sending a random number?

All the references I have found https://en.wikipedia.org/wiki/IEEE_802.11i-2004 https://www.wifi-professionals.com/2019/01/4-way-handshake https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...
0
votes
0answers
32 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
3
votes
0answers
113 views

Should I build my own login functionality? [closed]

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
4
votes
2answers
511 views

Sending OTP before authentication / password verification

One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and ...
1
vote
1answer
80 views

Can Google authenticator be used to link all my accounts together?

For example, if I add two accounts from different non-Google services, can Google (or maybe those services) because of that link them both together with my gmail account?
-1
votes
3answers
111 views

What's stronger: phone/text 2FA or authenticator app? [duplicate]

I noticed some very advanced sites don't offer 2 factor authentication via phone/text. Example Salesforce's Heroku: Is phone/text based 2 Factor Authentication generally weaker than using an ...
6
votes
3answers
782 views

Key differences between X509 TLS Client certificate and server certificate

Is there any difference between a X509 TLS client cert and a server cert? I had been implementing certificate-based mutual authentication and hence trying to get/use certificates for IoT devices. ...
2
votes
1answer
63 views

Validation of server identity via SSL certificate in during SSL connection handshake

My IoT Device is connecting to server using TLS. on Device side implementtaion (with wolfSSL) we are just passing CA (root) cert to validate/ authenticate the server! any specific identity of server ...
1
vote
0answers
75 views

What are the security risks to NFC based YubiKeys?

What are the risks of using NFC on a YubiKey versus just a hard connector? I imagine it would be possible to sniff some data off of these security keys? How real is the risk of sniffing and what could ...
0
votes
0answers
58 views

Using HMAC signed cookies instead of JWT for authentication

Since most people seem to caution against storing JWT tokens in the localStorage and recommend keeping them in the HttpOnly cookies, in this case I don't really see the advantage of using JWT auth. ...
1
vote
0answers
43 views

Is it bad practice to use only one token for a SPA (no applications, only user)?

Say we have multiple instances of application X deployed on site1.com, site2.com, site3.com, etc. And we have a centralized server at example.com serving all of these. All the instances of X are ...
1
vote
3answers
94 views

Use-case for decentralized identifiers (DIDs) with unique identities for each relationship

The W3C working group is working on the standardization of Decentralized Identifiers (DIDs). I watched a video presentation about DIDs and the presenter mentioned several times the possibility of ...
0
votes
1answer
95 views

Downgrade of NTLM Authentication

I have been experimenting NTLM and its different relay mitigations, including MIC and channel bindings. In my understanding: ntlm auth starts with a negotiation packet sent by the client. In this ...
1
vote
1answer
71 views

EMV choose crypto method between SDA/DDA/CDA

I'm a newbie in emv world. I'm trying to follow this flow: I'm in the third step. I have to manage the Offline Data Authentication. How can I negotiate the correct way (SDA, DDA or CDA) with the ICC ...
1
vote
1answer
61 views

How do Services recognise 2-Factor Authentication codes as correct?

Something about the flow of setting up 2-factor authentication is not clear to me. This is the flow of setting up a Service* to use a 2-factor auth app**: Choose setup 2-factor auth in the account ...

1
2 3 4 5
83