Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
1answer
42 views

Risks with setting up a authentication-less public VPN

I'm in the process of setting up an authentication-less public VPN. To prevent against DoS attacks, I'm going to set up some sort of IP address based rate limiting. The VPN is port-bound, i.e., it ...
2
votes
0answers
31 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
0
votes
0answers
26 views

How can multiple factors in authentication be combined to have a higher level of security? [closed]

Authentication factors can be categorized as "Something you have" "Something you know" "Something you are" "Somewhere you are How can these factors be combined to ...
3
votes
1answer
72 views

How do we verify a human agent in light of WCAG 2.2?

WCAG is a set of standard web accessibility criteria developed by the W3C that have been adopted by regulatory agencies in a number of countries, including Section 508 in the U.S., which makes ...
1
vote
1answer
45 views

How to properly invalidate JWT tokens and sessions in this use case?

I am building a web app, which is made of a Node.js Backend and Angular (NOT AngularJS!!! I only used the tag, because Angular was not available..) Frontend. How do I properly secure this app? I ...
0
votes
0answers
21 views

How is EAP transmitted to authentication server? [closed]

For example I would like to connect my smartphone to the internet via my wifi-Router. Then the router needs to authenticate my device by handing my credentials to an Authentication Server. But for ...
0
votes
0answers
66 views

Is there a way to generate certificates without using the command line? [closed]

I need to authenticate users for a key exchange process since in my case they will be considered the untrusted party. In my research I could not find many ways to authenticate the client that is not ...
1
vote
0answers
63 views

Strange account activity - how to investigate

Today I have observed very strange scenario which appears to be attempts to hack an account. So first, let me tell the pre-story: I have started to receive 2-factor authentication SMS messages from ...
0
votes
1answer
70 views

Server to server authentication

I need to perform sensitive REST API calls between 2 server applications that I am writing. To do this I need to be able authenticate the server that is performing the sensitive API calls. The current ...
0
votes
0answers
43 views

SSH certificates and mutual authentication

SSH certificates are a recent addition to the protocol, and I see them as being used mostly for the clients. Can the server use an SSH certificate too? And if so, is it possible to have mutual SSH ...
0
votes
0answers
58 views

What is the need of HMAC in Diffie-Hellman? [duplicate]

When Alice and Bob both have the same shared secret to encrypt their data (Diffie-Hellman) and Alice encrypts her data with this key and Bob can decrypt it with the same key, then Bob knows that the ...
0
votes
0answers
30 views

Authenticate Windows/Linux process against hardware security module

I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
2
votes
2answers
78 views

Magic links: JWT vs random string

Tutorials I've come across about implementing magic link authentication (in Node) recommend a mechanism like this: the user hits your endpoint with their email address you generate a signed JWT from ...
14
votes
7answers
2k views

Timing attacks in password hash comparisons

I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
0
votes
1answer
48 views

OAuth 2.0: what's stopping a client from lying to the Resource owner about scopes

I'm seeing token scopes as more of a contract between what a third-party application can do on behalf of some user's consent. Therefore, let's say a client asks a Resource owner to authenticate and ...
0
votes
2answers
62 views

Protecting OTP based authentication

Let's say I have a website which uses 4 digit OTP based authentication for login i.e. users will enter their mobile number, receive OTP on the entered mobile number, enter the received OTP to login ...
0
votes
0answers
67 views

2 person 2-factor authentication?

I'm trying to build a system as follows: User 1 is a low permission user. They will be using their phone and at some point will need to do a secure action. User 2 is an admin user and will be in the ...
0
votes
0answers
14 views

Is password less login secure? [duplicate]

Recently I came across this password less login. For authentication, we need to enter an email address and click on a login button. We will receive a link in your email and when we click on that link ...
0
votes
0answers
34 views

Providing shared access to a single machine without a shared account

In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
3
votes
0answers
114 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
27
votes
9answers
7k views

How does “Somewhere you are” authentication add further security?

In addition to the authentication techniques that are based on “something you have”, “something you know” and “something you are”, authentication techniques that consider “somewhere you are” are also ...
0
votes
1answer
43 views

Is it safe to add “Access-Control-Allow-Origin:*” to an API endpoint with custom authentication via header?

Lets say I have a site at myapp.com that talks to the api at myapi.com. For that to work I have to turn on CORS. I want to do it like that: Access-Control-Allow-Origin: * and my API authentication is ...
0
votes
0answers
36 views

LMv2 in NTLM authentication

I have done some research about NTLM and his challenge responses, and I have one last thing left unresolved. The LMv2 response, which is the newer version on of the old Lan Manager response, is ...
1
vote
0answers
65 views

SECURITY VIOLATION: Root login attempted - Which password is affected?

Logwatch shows that proftpd was tried to be logged into using root 0.0.0.0 (111.254.68.221[111.254.68.221]) - SECURITY VIOLATION: Root login attempted I found: Normally, proftpd does not allow root ...
0
votes
0answers
43 views

Secure Authentication of Technical User to a Network-Appliance-HSM

Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
0
votes
1answer
65 views

Why does the server generate a random challenge for SSH authentication?

Wouldn't it be more efficient if the client initiated the connection by generating their own message, and encrypting it using their private key, then sending both messages to the server so it would ...
1
vote
1answer
125 views

Authentication in Next.js application (SSR SPA with long sessions)

We’re currently developing a Next.js application (server side rendering) and are looking for secure ways to keep the users logged in for longer periods of time. AFAIK this can either be done using ...
2
votes
1answer
33 views

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection?

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? Can they agree on a cipher suite? Why?
1
vote
2answers
140 views

2FA authentication with QR code

Can someone confirm if the following solution is actually 2FA? User has to install a special mobile app. When the mobile app is opened for the first time, the user is asked to associate the device ...
0
votes
1answer
62 views

B2B authentication best practices

I'm in the process of developing a B2B (business-to-business) application. I've implemented JWT auth, and it is working as expected. Right now the authentication functions as if it were a B2C (...
0
votes
0answers
30 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
0
votes
0answers
27 views

Handling parallel login and Max invalid attempts using OTP with same phone number

I am designing a login system that performs login operation using OTP and Email ID of the registered user. The current approach is as below User enters the Registered Email Id If the Email ID is ...
0
votes
2answers
130 views

Why hasn't push notification authentication replaced SMS for 2FA?

So we use DUO for 2FA at work and it uses push notification authentication as the second factor for 2FA. It's so quick and easy! I enter my username and password, get a push notification on my phone, ...
0
votes
1answer
137 views

Can I use an ID token as proof of authentication?

I have a reverse proxy, configured as the Relying Party of an OpenID Connect identity provider. Then, it delegates the request processing to another web server, exposed on the internet. In order to ...
0
votes
1answer
68 views

For failed logins, what information should be given to users?

When a user fails to successfully login, what information should be given back to them? Normally, we post back "Account not found" or "Incorrect password" or "Incorrect ...
0
votes
0answers
77 views

(Re)Hacked Instagram accout even if Two Factor authentication was enabled

A friend of mine, let's call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this: Alice gets a link from a Business Account via WhatsApp, and clicks ...
0
votes
2answers
87 views

Is it unsafe to have some users with passwords and some without?

I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
0
votes
0answers
55 views

Can a secure key-exchange algorithm replace hashing for password authentication?

Over the weekend I was thinking about the problem of scaling various web services. One common practice to scale authorization is to use cryptographically signed tokens. This way when a request comes ...
0
votes
1answer
57 views

API open endpoint best practices

I am currently developing an API for my front-end React application. All my routes (besides the two I'll mention below) are secure by the use of JWTs. They get generated once a user logs in and is ...
1
vote
3answers
142 views

What to include in emails to make them acceptable to email servers?

I need to send some automated emails from a program I'm working on. This is a new feature. I'm generating the emails, but they get filtered by most of the email servers that I send tests to. Only one ...
0
votes
0answers
32 views

Potential risk of allow login sites to be accessible through webview

I know that allowing site (especially login site) to be accessible by iframe is a bad practice. But I plan to use webView to "outsource" the login process in a mobile app to a website (owned ...
2
votes
1answer
85 views

Pros/Cons for showing a user how many failed login attempts they have remaining before getting blocked?

For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this? Something like:
0
votes
0answers
40 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
0
votes
1answer
48 views

Is it good idea to re-authenticate a user to access sensitive actions and data?

In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
2
votes
2answers
126 views

Is it safe to store data of small company in MySQL database on webhost?

A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at ...
1
vote
1answer
72 views

Verifying client certificate by passing client cert in the header

I'm implementing client certificate authentication. My server is behind a proxy to which I have no control of. And also I don't have any control over the client side communication. During every ...
0
votes
1answer
97 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
0
votes
2answers
146 views

Replace hashing function with asymmetric cryptography when password authentication

I would like to know if the following ideas are feasible: Hash function is one-way function. Generate public key from private key is irreversible(asymmetric cryptography). User password entry -> ...
1
vote
2answers
63 views

What is the name of the crypto system used by ICANN's DNS recovery system?

I once heard about a type of crypto system that behaves in the following way: I have x secret keys that work together to decrypt messages encrypted with a public key d. If I get at least n of the x ...
0
votes
1answer
74 views

Is it safe to use a JWT as an Authorization Code?

I'm implementing an OAuth 2.0 Authorization Code grant type flow and considering to use a very short-lived JWT as the authorization code so this step doesn't require a database. I understand that this ...

1
2 3 4 5
80