Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
0answers
13 views

Two message key agreement and mutual authentication protocol?

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...
1
vote
1answer
23 views

What's the correct way to handle a failure with Client Certificate Authentication

I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?
0
votes
0answers
13 views

How to intercept AD authentication attempts [on hold]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
-1
votes
0answers
18 views

What mechanizm of updating Last-Logon attribute in AD?

What mechanizm of updating Last-Logon attribute in AD? I suppose that its value update not just when user login (write user\pass ang login into windows? and then we whach it into AD) but plus in some ...
-1
votes
0answers
44 views

Should KYC considered as cyber a security possible threat? [on hold]

Seems like there is a lot of confusion since there is compliance for this, so not sure if KYC can also be considered as cyber security threat. More info on KYC: https://en.wikipedia.org/wiki/...
1
vote
1answer
37 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
1answer
38 views

Which party stores the link between user and device in WebAuthn?

Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
2
votes
2answers
75 views

How to provide personal User Page after User already signed up without Password?

I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password. After a while it would be useful to provide ...
3
votes
1answer
54 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
0
votes
1answer
39 views

How does using an auth server for mobile app and not storing API keys on client add security?

I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
1
vote
0answers
25 views

Can attackers intercept my credentials on an insecure site if I log in through a 3rd party service?

I recently visited a forum using non-secure protocol (HTTP) - Chrome flagged a warning at the top saying I shouldn't enter any passwords or personal information onto the site, as they could be ...
0
votes
0answers
64 views

What prevents a third party to use public API keys

In many cases, I have to add a public API key to my website (or application). For instance, in order to have an embedded map on a website, one could use google maps, and be required to provide an API ...
2
votes
0answers
36 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
-1
votes
0answers
19 views

Security workflow for intranet web application

The applications I develop (mostly ASP.NET MVC) are internal applications that are going to be exclusively used in an intranet domain working under Active Directory. Since every employer has to log in ...
2
votes
1answer
38 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
0answers
31 views

Is it secure to start a NTLM handshake not knowing if the server supports it?

I am writing a program in Python using the requests-ntlm library. That library adds support for NTLM in regular requests: import requests from requests_ntlm import HttpNtlmAuth requests.get("http://...
0
votes
0answers
16 views

Save SAML AuthnContextClassRef at login and use when signing?

I want to force reauthentication when a user signs a document using ForceAuthn and RequestedAuthnContext / AuthnContextClassRef (to bypass browser caching authentication) in the SAML request. Is it a ...
0
votes
0answers
30 views

How to make use of httpd API function to bypass authentication?

This is my first question and I'm completely new to learning about information security. If I've violated any rules while asking this question please let me know, so I can improve it! I am trying to ...
0
votes
0answers
40 views

How do I protect my BE endpoints from FE?

Is there any way to secure the endpoints from frontend? I have an API written in NodeJs and I have a frontend website written in AngularJS and app in ionic. I had jwt token from the backend to ...
-2
votes
1answer
39 views

Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?

In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS. Note, this would be used on a website that should never have more than perhaps 30 users. I'm ...
0
votes
1answer
28 views

capture authorization code programmatically in OAuth 2.0

In a standard OAuth auth code Grant flow, user is redirected to authorization server page where he provides consent to allow the requesting app to perform some actions on his behalf, after which a ...
2
votes
1answer
66 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
2
votes
2answers
54 views

User login failure - valid error messages [duplicate]

I am currently working on a web portal which allows users to login via standard authentication credentials (username, password). However, I'm required to return appropriate error messages when the ...
1
vote
0answers
38 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
1
vote
0answers
86 views

OAuth 2.0 + OpenID for authentication in mobile apps

Current Way We have a mobile application that uses SMS based OTP for logins. Till now, since the app was considered as trusted party, we had no authorization flow like in OAuth. Our flow was (similar ...
0
votes
0answers
28 views

Solutions for sharing a single web session among services in different languages

I have a system where I am running apps written a mix of Java and another language (TCL), and I am looking for there to be a single login session of the application. By single login session I mean ...
0
votes
0answers
27 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
0
votes
0answers
37 views

Is it okay to implement key files via HTTPS form?

I've been messing around in VeraCrypt and KeePassXC for a while now. And I'm trying to improve my privacy and security. I've been experimenting with different authentication methods. VeraCrypt and ...
1
vote
0answers
48 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
4
votes
4answers
272 views

Public API security: authentication vs. rate limiting etc

We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
0
votes
2answers
53 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
2
votes
1answer
79 views

How to get user and verify password so that the usernames are kept private?

According to the OWASP guidelines: Authentication failure responses should not indicate which part of the authentication data was incorrect. For example, instead of "Invalid username" or "Invalid ...
0
votes
0answers
27 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
0
votes
0answers
13 views

Communicating with things on AWS IoT without certificates problem

Is "IAM" access the only method to gain access AWS? I'm asking because I'm using AWS IoT. With AWS IoT we create things such as devices on AWS IoT Core. However, with IAM access, after creating a "...
0
votes
1answer
44 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
0
votes
1answer
96 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
1
vote
1answer
51 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
1
vote
2answers
76 views

How to sign a text in a way, so it can not be altered or split in parts unacknowledged

Given, I want to create a document (text-only for the sake of this question) and give it to someone I do not trust. I am not allowed to publish it myself. It's probably not going to be published (...
0
votes
1answer
88 views

How to catch people creating many accounts on the same website using very unique credentials?

Nowadays e-commerce is the new trend compared to the retail stores, but some sellers will manipulate their rankings through false purchases of their own items to boost rankings significantly. The ...
2
votes
3answers
48 views

SSL authentication unexpectedly failing - could this be caused by SSL Inspection/Fortinet?

I'm dealing with an SSL issue that's been plaguing me for several days. I know relatively little about security, so if anyone here could lend a helping hand I would be extremely grateful. Ultimately ...
2
votes
1answer
90 views

Secure password reset before authentication?

I have recently been considering the password reset flow for a site I'm working on. A request came up that before authentication, a user should have an option to change their password by providing: ...
0
votes
1answer
107 views

What is the protocol used for authentication/authorization of my internet access using account inside web browser?

Our university uses Microtik devices and a 3rd party application to manage our access to web and internet services. When I open browser in my desktop or connect to a wi-fi access point, it prompt that ...
0
votes
1answer
83 views

Two-party symmetric key establishment protocol

Update: original problem description I am developing a client-server system for configuration updates. The system handles update tasks. An update task is initiated on a server; multiple clients then ...
0
votes
1answer
70 views

When is it okay not to use anti-forgery token in login page?

In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page: When is it OK to leave off the anti-forgery token? In general, if ...
7
votes
3answers
274 views

Is PuttyGen secure?

I'm using PuttyGen to generate ssh keys for various windows computers. It requires a lot of manual user input, specifically in the form of swirling the mouse around in the window pane. I understand ...
0
votes
0answers
20 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...
1
vote
0answers
29 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
0
votes
2answers
52 views

How to secure an application deployed in some port [closed]

I was wondering, If there is a (private) application or service deployed at example.com:5000, how can someone prevent undesired requests to that port ? I was thinking about a solution were the ...
1
vote
2answers
91 views

Does 2-Factor Authentication protect against malware?

My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does: Every time you login to ...
4
votes
1answer
97 views

How to Best Minimize Damage After Loss of Computer

Myself and the rest of my coworkers on my (former) employer’s dev team were all just laid off from our jobs, and the employer took our MacBook Pros without letting us clear of our personal information ...