Skip to main content

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
1 vote
1 answer
46 views

Is local password recovery for each device a viable security approach?

I'm developing a multi-platform application using Flutter, which involves sensitive user data and requires both online and offline accessibility. To enhance security and usability, I am considering ...
george orwell's user avatar
2 votes
1 answer
179 views

CORS credentials option set to true

To allow cookies to be sent to my ExpressJS server,credentials: true has to be set in my CORS config. What potential security risks/ vulnerabilities could arise from this configuration? If possible, ...
a_duck's user avatar
  • 33
8 votes
4 answers
3k views

How to receive large files guaranteeing authenticity, integrity and sending time

I need to receive some important documents from another person. It may be important to be able to prove (in justice) which files exactly I received from that person at a specific moment. My first ...
alex's user avatar
  • 181
2 votes
2 answers
41 views

Is Kerberos Constrained Delegation (KCD) deprecated?

Referred to the official microsoft documentation on KCD where they are using the terms KCD & Resource Based Constrained Delegation (RBCD) almost interchangeably which got me confused. They have ...
Aryan's user avatar
  • 65
1 vote
0 answers
43 views

Where to store Refresh Token in custom Authentication

I am currently trying to build an authentication flow where the front end lives on one domain, say X.com and the backend lives on Y.com. I have implemented a refresh/access token system where when a ...
Kiran Manicka's user avatar
1 vote
1 answer
68 views

Is electronic signature a proper/sufficient mean for identification/authentication?

We have received an electronically signed GDPR data request from a person who has only provided his name and surname. We wanted to be sure that this person is who he claims he is, so we have asked to ...
ZygD's user avatar
  • 279
1 vote
0 answers
28 views

Leveraging MS SSO for teams tab secure?

I have an app I want to embed as a tab in MS Teams. Users may already have an account outside of teams and I use magic login link to typically to log users in. I want to know if I can leverage teams ...
user25622659's user avatar
0 votes
0 answers
30 views

Is MS number-matching MFA still amenable to bypass in this scenario?

On August 2, 2023, the Microsoft security blog presented this scenario, in which the protection normally afforded by number-matching MFA on MS Authenticator can be thwarted: In this activity, ...
Peter Collins's user avatar
2 votes
1 answer
1k views

Offline, multi-machine, 2-factor authentication information vault?

I think this should be the right SE, apologies otherwise I have been researching ways to be more careful with how I handle important documents and credentials, but everything I found sounded ...
Mister Mystère's user avatar
1 vote
0 answers
52 views

how to apply authentication/authorization on CLI tools

I am doing a security audit on a command line tool. The tool is java based and it runs on the server side, it collects some info and generate a report at the end of the run. This tool can run ...
anonymous's user avatar
1 vote
0 answers
54 views

How to verify authentication tag during chunked AES-GSM-128 decryption

Due to there are large encrypted files we are dealing with, we can't afford to keep entire file in memory during a decryption process. I've implemented the algorithm of chunked decryption of AES GSM ...
Lesha Pipiev's user avatar
1 vote
0 answers
39 views

Authenticating via device

I want to authenticate users based on their devices. Basically, when a user deletes my app, I want to make sure that their local storage is independent of who they are, so that they do not evade a ban ...
a_duck's user avatar
  • 33
1 vote
1 answer
115 views

How effective is re-entering your password to enable high-risk functions on your account when autofill is always available?

Websites ask for passwords to ensure you are the account owner before you make changes to high-risk settings, but autofill works all the time, even when the browser is in Incognito mode. If someone ...
Yami Odymel's user avatar
1 vote
0 answers
42 views

Mutual Authentication after ECDH Exchange with pre-shared secrets

I´m currently building a protocol, in which two parties establish a connection via ECDH Key Establishment. The shared secret after ECDH is used to derivate Keys (with HKDF) for symmetric encryption. ...
Jonas's user avatar
  • 11
0 votes
1 answer
49 views

Using mTLS for API access control and authentication

my question is about using mTLS for API access control and authentication. I understand in mTLS, both the server and client (making the API request) will verify each other's identity. This allows the ...
huthut28's user avatar
1 vote
1 answer
47 views

Besides checking whether the session ID is valid, what other things should we check in order to prevent session ID leakage? [duplicate]

If the SessionID is leaked/hacked by someone else and they use that SessionID to get access to the account, can we double-check whether the SessionID is used on the right device? I'm thinking of ...
blamm01's user avatar
  • 25
0 votes
1 answer
43 views

In Kerberos, is the "Authentication Server" the only "Trusted Third Party"? Or is "Ticket Granting Server" also a "Trusted Third Party"?

I know that AS (Authentication Server) is a TTP (Trusted Third Party) because it generates keys for two entities (for the client and the TGS). But what about TGS (Ticket Granting Server)? It also ...
allexj's user avatar
  • 129
0 votes
1 answer
37 views

Is there a difference between data origin authentication and sender authentication?

Here the author writes "sender authentication". Does he mean data origin authentication? Or is sender authentication something different? Wikipedia says that "data origin authentication ...
allexj's user avatar
  • 129
1 vote
2 answers
103 views

JWTs as refresh tokens, beside the JWT access token?

While reading up on refresh tokens, I've come by some interesting comments in this answer: Refresh tokens can be in the form of a JWT as well After going through all the responses and doing some ...
Advena's user avatar
  • 139
0 votes
0 answers
41 views

Is creating an internal API within a VPN a recommended practice for securing database access for customer-facing applications?

The InfoSec team of the client I work with has mandated that any customer-facing application's backend should not directly access the database for that application. They require we create another ...
muad'dib's user avatar
1 vote
1 answer
145 views

Security doubts around the refresh token and how it works

I am trying to understand how refresh tokens and access tokens works, and I ready several threads and documentations. It seems that I am not the only one confused around this topic. Based on this ...
anonymous's user avatar
0 votes
1 answer
100 views

Do 2FA Codes on the same device defeat their purpose? [duplicate]

I have my iPhone connected to my MacBook and receive SMS codes on my computer, which is very convenient. I also recently learned you can have an authentication app on your MacBook too. I just wonder ...
user1721135's user avatar
22 votes
3 answers
5k views

Is there a problem with having a combined login/register screen?

I am designing a new login/register process for a system and want to combine the 2 initial pages for register and login. This would be one page where the user would enter their email and press '...
Ollie's user avatar
  • 221
0 votes
1 answer
51 views

How to verify the salt in the SCRAM protocol?

I've recently read about the SCRAM authentication protocol. One of the stated design motivations is to support mutual authentication, but how does the client verify that the salt and cost parameters ...
n-l-i's user avatar
  • 421
0 votes
2 answers
166 views

"Duplicate" of Chrome Tabs causes stale tokens

Our implementation for authentication works like this User provides username/password to /login API API returns access token and refresh token in payload We store the access token and refresh token ...
Vin Xi's user avatar
  • 53
1 vote
5 answers
237 views

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

I'm working on making an end-to-end encrypted app that will store sensitive mental health information. The goal is to make it completely impossible for someone with access to the server to see the ...
Gradyn Wursten's user avatar
0 votes
1 answer
72 views

How OpenID over OAuth 2.0 can be trusted?

I am trying to implement "Login with Google/Apple etc..." on a web platform and I can't wrap my head around how you can trust the response that supposedly comes from the resource server ...
qUneT's user avatar
  • 3
0 votes
1 answer
82 views

Are all stateless authentication systems vulnerable to IDOR?

I have recently been introduced to the Insecure Direct Object Reference vulnerability (https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html) with ...
Rands's user avatar
  • 1
1 vote
1 answer
141 views

Library to securely expose query language to end user?

I have a DB that I would like to expose to end users for flexible search through their data. Currently using Elastic, but not tied to that: I can internally transform the data in any way to enable ...
curious-bunny1's user avatar
0 votes
0 answers
48 views

How to add accounts management to a legacy blackbox application?

I have a legacy non-commercial (in-house) application that is distributed over several workstations on a private VLAN. I have to make it conform to some cybersecurity standards, but can barely modify ...
lalebarde's user avatar
  • 617
0 votes
0 answers
80 views

Why whatsapp only let you create 1 passkey?

Whatsapp is rolling out passkeys. I don't think backing up passkeys in a password manager is a good idea. I'd like to have device bound passkeys but they only allow me to create one. How should I be ...
Gatonito's user avatar
  • 363
1 vote
1 answer
90 views

Login with roles without internet

Disclaimer: question orignally posted here but i was encouraged to ask it in this stack instead. Introduction part I'm writing an application that requires authentication to be used, specifically the ...
Nifil's user avatar
  • 113
0 votes
1 answer
74 views

Should I validate json web tokens on my app backend or login backend?

I wrote a login backend with express.js to provide authentication (through LDAP) and authorization (through a database of authorized users for each app on mysql). This backend generates jwt and sends ...
Harry Z. Huang's user avatar
0 votes
0 answers
24 views

If I'm rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on ...
Ben Johnson's user avatar
13 votes
6 answers
7k views

Is it impossible to protect an API from data redistribution?

Say there is a frontend mobile app and a backend server (let's call this service MyApp) which hosts an API for the mobile app to connect to. The backend server makes any needed requests to third party ...
Jiehfeng's user avatar
  • 233
0 votes
1 answer
156 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
anonymous's user avatar
0 votes
0 answers
42 views

Does GUIX provide cryptographic authentication and integrity validation?

Does the GNU GUIX package manager in require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages must be ...
Michael Altfield's user avatar
1 vote
0 answers
58 views

Why can't a user who is accessing the service on their own behalf find the "long term" keys to decrypt the service ticket and have to use U2U?

I started to study how the U2U mechanism works and got confused. The gist is as follows. When we use U2U the service ticket will be encrypted with the session key KDC of the user-"server". ...
Deoni Deon's user avatar
0 votes
2 answers
109 views

Alternatives for password where at least one secret is not know by the server, with similar transparency

Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password's hash ...
Delfin's user avatar
  • 103
0 votes
1 answer
110 views

How are Sentry's public key protected when the token is in front end code?

In Sentry's documentation they explain that you can use a public token to use their API; <script src="https://js.sentry-cdn.com/examplePublicKey.min.js" crossorigin="anonymous&...
Alexis Benoist's user avatar
0 votes
2 answers
150 views

Is it possible to send data from an open-source program but make it impossible for a user with source code to do the same?

If I want to store a global scoreboard for a game running locally on the user's computer and I want to make sure that all the requests coming to the server are really generated by the game and not ...
Reverent Lapwing's user avatar
0 votes
0 answers
118 views

Hydra says different passwords with are correct each run, but only one works

I am doing CTF 'Skynet' from THM and came across this problem. Enumerating SMB, I gathered credentials 'milesdyson' and a list of passwords 'log1.txt'. I figured that I could try to brute force ...
Juan Vega Seco's user avatar
0 votes
1 answer
135 views

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
DannyNiu's user avatar
  • 374
0 votes
1 answer
137 views

OAuth2: Storing temp values in session vs database

I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
Ryan's user avatar
  • 101
0 votes
0 answers
87 views

One time password as passwordless authentication [duplicate]

When logging in to azure the login process emails me a short one time code to use and doesn't require a password. I am assuming it is a well trusted process in order to be used on such critical ...
Sabrina Gelbart's user avatar
1 vote
0 answers
94 views

Single JWT as authentication and refresh token

I'm implementing an authentication mechanism using JWT tokens and exploring best practices for securely storing these tokens on the client side. My JWT includes a jti claim populated with random bytes ...
OhGodWhy's user avatar
0 votes
0 answers
86 views

Why does IPsec use tunnel-mode for an external laptop? Could transport-mode be used? Why can't a gateway control access in transport-mode?

In an IPsec Secure gateway setup, why is tunnel-mode used when an external laptop wants to access an internal service protected by a firewall? Is tunnel-mode necessary or could transport-mode be used ...
Allexj's user avatar
  • 137
2 votes
0 answers
598 views

Repeated passwordless login links from linkedin

In the past few weeks I've seen periodic attempts of someone logging in to my linkedin accounts. They appear to use some sort of one time login link feature that linkedin has, which allows ...
Ccm's user avatar
  • 143
2 votes
0 answers
127 views

Why does Bluetooth Low Energy Secure Connections with Passkey Entry check the Passkey bit by bit?

If we want to enable an authenticated connection via BLE the passkey method seems like a good idea. A 6-digit PIN is generated randomly on one device and has to be entered on the other - these 20 Bit ...
jusaca's user avatar
  • 71
0 votes
1 answer
117 views

How is the authenticity and integrity of the various chips inside laptops and mobile phones ensured by their vendors?

Modern laptops and mobile phone platforms are built around a main, beefy SoC, which generally supports Secure Boot for its firmware and also has a unique hardware identity that is used to attest to a ...
Silviu's user avatar
  • 66

1
2 3 4 5
91