Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
14 votes
3 answers
3k views

Is there a problem with having a combined login/register screen?

I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login. This would be one page where the user would enter their email and press '...
Ollie's user avatar
  • 141
-1 votes
0 answers
26 views

How to achieve multi-tenant Authentication in my SaaS application? [closed]

I'm currently running a single-instance SaaS application backend where multiple tenants' data is stored in the same database, separated by tenant IDs. I'm looking to implement authentication that ...
Maverick's user avatar
0 votes
1 answer
36 views

How to verify the salt in the SCRAM protocol?

I've recently read about the SCRAM authentication protocol. One of the stated design motivations is to support mutual authentication, but how does the client verify that the salt and cost parameters ...
n-l-i's user avatar
  • 326
0 votes
0 answers
17 views

Strengthening API security far SaaS application [closed]

I have a SaaS application which will interact with on premises applications and also with various other cloud providers using rest API calls along with access keys or tokens for authentication. These ...
Jasper Henria's user avatar
0 votes
2 answers
117 views

"Duplicate" of Chrome Tabs causes stale tokens

Our implementation for authentication works like this User provides username/password to /login API API returns access token and refresh token in payload We store the access token and refresh token ...
Vin Xi's user avatar
  • 53
1 vote
5 answers
205 views

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

I'm working on making an end-to-end encrypted app that will store sensitive mental health information. The goal is to make it completely impossible for someone with access to the server to see the ...
Gradyn Wursten's user avatar
0 votes
1 answer
58 views

How OpenID over OAuth 2.0 can be trusted?

I am trying to implement "Login with Google/Apple etc..." on a web platform and I can't wrap my head around how you can trust the response that supposedly comes from the resource server ...
qUneT's user avatar
  • 3
0 votes
1 answer
56 views

Are all stateless authentication systems vulnerable to IDOR?

I have recently been introduced to the Insecure Direct Object Reference vulnerability (https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html) with ...
Rands's user avatar
  • 1
1 vote
1 answer
125 views

Library to securely expose query language to end user?

I have a DB that I would like to expose to end users for flexible search through their data. Currently using Elastic, but not tied to that: I can internally transform the data in any way to enable ...
curious-bunny1's user avatar
0 votes
0 answers
44 views

How to add accounts management to a legacy blackbox application?

I have a legacy non-commercial (in-house) application that is distributed over several workstations on a private VLAN. I have to make it conform to some cybersecurity standards, but can barely modify ...
lalebarde's user avatar
  • 617
0 votes
0 answers
47 views

Why whatsapp only let you create 1 passkey?

Whatsapp is rolling out passkeys. I don't think backing up passkeys in a password manager is a good idea. I'd like to have device bound passkeys but they only allow me to create one. How should I be ...
Gatonito's user avatar
  • 363
1 vote
1 answer
68 views

Login with roles without internet

Disclaimer: question orignally posted here but i was encouraged to ask it in this stack instead. Introduction part I'm writing an application that requires authentication to be used, specifically the ...
Nifil's user avatar
  • 113
0 votes
1 answer
55 views

Should I validate json web tokens on my app backend or login backend?

I wrote a login backend with express.js to provide authentication (through LDAP) and authorization (through a database of authorized users for each app on mysql). This backend generates jwt and sends ...
Harry Z. Huang's user avatar
0 votes
0 answers
24 views

If I'm rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on ...
Ben Johnson's user avatar
13 votes
6 answers
7k views

Is it impossible to protect an API from data redistribution?

Say there is a frontend mobile app and a backend server (let's call this service MyApp) which hosts an API for the mobile app to connect to. The backend server makes any needed requests to third party ...
Jiehfeng's user avatar
  • 233
0 votes
1 answer
82 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
anonymous's user avatar
0 votes
0 answers
36 views

Does GUIX provide cryptographic authentication and integrity validation?

Does the GNU GUIX package manager in require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages must be ...
Michael Altfield's user avatar
1 vote
0 answers
46 views

Why can't a user who is accessing the service on their own behalf find the "long term" keys to decrypt the service ticket and have to use U2U?

I started to study how the U2U mechanism works and got confused. The gist is as follows. When we use U2U the service ticket will be encrypted with the session key KDC of the user-"server". ...
Deoni Deon's user avatar
0 votes
2 answers
102 views

Alternatives for password where at least one secret is not know by the server, with similar transparency

Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password's hash ...
Delfin's user avatar
  • 103
0 votes
1 answer
71 views

How are Sentry's public key protected when the token is in front end code?

In Sentry's documentation they explain that you can use a public token to use their API; <script src="https://js.sentry-cdn.com/examplePublicKey.min.js" crossorigin="anonymous&...
Alexis Benoist's user avatar
0 votes
2 answers
142 views

Is it possible to send data from an open-source program but make it impossible for a user with source code to do the same?

If I want to store a global scoreboard for a game running locally on the user's computer and I want to make sure that all the requests coming to the server are really generated by the game and not ...
Reverent Lapwing's user avatar
0 votes
0 answers
90 views

Hydra says different passwords with are correct each run, but only one works

I am doing CTF 'Skynet' from THM and came across this problem. Enumerating SMB, I gathered credentials 'milesdyson' and a list of passwords 'log1.txt'. I figured that I could try to brute force ...
Juan Vega Seco's user avatar
0 votes
1 answer
123 views

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
DannyNiu's user avatar
  • 374
0 votes
1 answer
82 views

OAuth2: Storing temp values in session vs database

I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
Ryan's user avatar
  • 101
0 votes
0 answers
72 views

One time password as passwordless authentication [duplicate]

When logging in to azure the login process emails me a short one time code to use and doesn't require a password. I am assuming it is a well trusted process in order to be used on such critical ...
Sabrina Gelbart's user avatar
0 votes
0 answers
70 views

Single JWT as authentication and refresh token

I'm implementing an authentication mechanism using JWT tokens and exploring best practices for securely storing these tokens on the client side. My JWT includes a jti claim populated with random bytes ...
OhGodWhy's user avatar
0 votes
0 answers
77 views

Why does IPsec use tunnel-mode for an external laptop? Could transport-mode be used? Why can't a gateway control access in transport-mode?

In an IPsec Secure gateway setup, why is tunnel-mode used when an external laptop wants to access an internal service protected by a firewall? Is tunnel-mode necessary or could transport-mode be used ...
Allexj's user avatar
  • 137
2 votes
0 answers
551 views

Repeated passwordless login links from linkedin

In the past few weeks I've seen periodic attempts of someone logging in to my linkedin accounts. They appear to use some sort of one time login link feature that linkedin has, which allows ...
Ccm's user avatar
  • 153
2 votes
0 answers
107 views

Why does Bluetooth Low Energy Secure Connections with Passkey Entry check the Passkey bit by bit?

If we want to enable an authenticated connection via BLE the passkey method seems like a good idea. A 6-digit PIN is generated randomly on one device and has to be entered on the other - these 20 Bit ...
jusaca's user avatar
  • 71
0 votes
1 answer
96 views

How is the authenticity and integrity of the various chips inside laptops and mobile phones ensured by their vendors?

Modern laptops and mobile phone platforms are built around a main, beefy SoC, which generally supports Secure Boot for its firmware and also has a unique hardware identity that is used to attest to a ...
Silviu's user avatar
  • 56
31 votes
2 answers
5k views

What is the point of entering numbers in the two-factor authentication app?

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator: This is ...
hb20007's user avatar
  • 559
1 vote
2 answers
116 views

Authenticating a device for remote motor control

I'm looking for a standard solution to the following problem. I've been unable to find how something like this is normally accomplished. Even a key word that points me in the right direction would be ...
Joseph Rappaport's user avatar
1 vote
0 answers
80 views

Is this openvpn auth script secure or am I'm just being too naive?

I'd like to setup an openvpn server so that clients either use a certificate to authenticate or send username & password. In certain situations I don't want to issue a certificate for clients and ...
Pablo's user avatar
  • 111
8 votes
2 answers
2k views

Doubts about Bluetooth Secure Authentication

I'm reading "Guide to Bluetooth Security" by NIST (available here). At page 22 (page 33 of the PDF), they describe the Secure Authentication scheme. From what I can understand, both the ...
StefanoTrv's user avatar
1 vote
2 answers
752 views

Do we really need refresh tokens?

I have read a number of posts of many people expressing their confusion around the extra security gained from using an access token and a refresh token to control access to a resource API. Picking up ...
ASP's user avatar
  • 119
0 votes
0 answers
72 views

What is the correct way to implement a change-of-email request flow?

I am currently implementing a change-of-email request flow for a web service without MFA. My initial approach is to consult the current OWASP Guide for such a flow. In reading the document, I've ...
peteredm's user avatar
0 votes
0 answers
61 views

What are the best practices for a scheduled program to store credentials to access a secure resource?

If I have a program that runs on a regular basis, such as a cron job or systemd timer and it needs to access a secure resource like a hsm or encrypted database, what are the best practices to store/...
user962460's user avatar
0 votes
0 answers
48 views

Does Node.js's npm provide cryptographic authentication and integrity validation?

Does Node.js's npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
Michael Altfield's user avatar
0 votes
0 answers
100 views

How 2FA with Biometrics improve security?

Where I work, this is the passwordless registration/login flow for our Mobile App A user registers with a username and a phone number. An SMS OTP is sent to the phone number to verify it. Initial ...
Sentenzalb's user avatar
0 votes
0 answers
65 views

Secure Passwordless MFA authentication on mobile app

I want to secure my mobile app with a passwordless MFA mechanism. The registration/login flow would be: You register you account online with a username and a mobile phone (an OTP will be sent to ...
PinkWhaleRider's user avatar
0 votes
1 answer
71 views

cURL not returning status 302 after correct login for Hack the Box Machine 'Crocodile'

cURL is returning a 200 status code after correct login. The common response code after user login should be 302. Why am I not receiving this status code? All information is provided below. #!/usr/bin/...
Michael Sodeke's user avatar
-1 votes
1 answer
77 views

Digital Signatures as an Alternative to TOTP Backup Codes

It seems pretty common for websites to issue a bunch of backup codes for MFA that the user saves somewhere. Instead, why don't they provide the user with the private key for a digital signature and ...
SameOldNick's user avatar
0 votes
0 answers
131 views

Is this a safe setup to prevent email account hack?

I would like to protect a Gmail account from being hacked. Suppose I use the following approach for login/authentication: Username, Password 2FA via security stick the stick is in a place that is not ...
fkarger's user avatar
  • 21
0 votes
0 answers
110 views

Security on home system - ssh keys etc

I use two computers every day, my home server which is a desktop system and my laptop. Both systems run xubuntu and, being mostly a command line user, I use ssh to connect between the systems, to ...
Chris Green's user avatar
0 votes
1 answer
95 views

How to securely use service account credentials in an Android App

I have an Android application distributed to my users through an .apk file. That app collects some data, and my goal is to upload that data to a cloud service, like BigQuery. To achieve this, I am ...
Jorge's user avatar
  • 1
7 votes
3 answers
2k views

Is storing authentication tokens in local storage with a strong CSP safe?

Whenever the topic comes up, almost every source recommends to never store authentication tokens in a place where they can be accessed by client-side Javascript. The recommendation is almost always to ...
Mad Scientist's user avatar
0 votes
1 answer
193 views

What is the benefit of a passkey over using 2FA like Google Authenticator?

At the moment to log into (for example) Paypal I type a password then the code from Google Authenticator. If I understand correctly having a passkey installed on my phone eliminates the password. It ...
John Rennie's user avatar
11 votes
2 answers
1k views

Do passkeys allow an attacker to gain account access by accessing a single device?

Some companies such as Github suggest passkeys replace both passwords and 2FA: passkeys satisfy both password and 2FA requirements Github thus allows logging in with a passkey without any second ...
holocronweaver's user avatar
1 vote
1 answer
119 views

Is 3DS compatible with secure 2FA technologies? (TOTP, WebAuthn)

Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn? For the purposes of this question, I'm classifying all systems where an ...
Michael Altfield's user avatar
1 vote
1 answer
86 views

Replay of previously used cipher, IV and authentication tag in authenticated encryption

It is known that an authenticated encryption scheme is better than just encryption because, in the latter, an attacker can alter the ciphertext, which cannot be verified. In the former, altering the ...
Mohit Kumar Jangid's user avatar

1
2 3 4 5
91