Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
5
votes
1answer
472 views

Is there a security reason to require email address and password in separate steps? [duplicate]

I have noticed lately that instead of having an email address and password entry box on the same page/screen, a lot of websites and apps will instead ask for your email address first, then it will ask ...
1
vote
0answers
33 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
0
votes
0answers
34 views

Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
0
votes
0answers
22 views

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
1
vote
1answer
63 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...
2
votes
3answers
335 views

Securing client side code of react application [duplicate]

I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription. Are there any methods to ...
0
votes
0answers
58 views

How do I assure that a site that I visit does not know I have been there before? [duplicate]

If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
1
vote
0answers
38 views

Problems understanding the use of Distance Bounding against Man-In-The-Middle attacks

I currently have to write a paper for university in my Network Security lecture about methods of secure location verification. Therefore, I chose to write about several distance bounding protocols, e....
2
votes
1answer
101 views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
-1
votes
0answers
17 views

How To Generate An OV - Extended validation certificate using OpenSSL [duplicate]

I Want To Generate A Ov Cert With The Authority PmzDevENV But I Cant Find Out How (I Want To Use OpenSSL) I Want To Do This So That PADLOCK PmzDevENV [US] Will Appear In The Browser
8
votes
4answers
2k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
2
votes
1answer
64 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
74
votes
8answers
10k views

Why is email often used as the ultimate verification?

In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
1
vote
1answer
111 views

Secure HTTP login in an embedded (IoT) system

HTTPS in an embedded (IoT) system is (as far as I know) not necessarily a good solution. Basic Authentication is not secure. Acceptable in an internal network. Idea: Login.html (when called up) sends ...
3
votes
1answer
148 views

Spooky Suspicious Sign-In From My Town

I just had a weird experience that I am trying to figure out. I received a suspicious sign-in notification from google on my gmail account. They had my correct password. This isn't that surprising, ...
1
vote
1answer
49 views

What happens if a secure token is provided to a trusted party that gets compromised

Take for example - AWS STS token or JWT tokens. Let’s say node A got a token for accessing a resource of account X on behalf of account X. Access includes read/write privileges. Let’s say few minutes ...
1
vote
0answers
61 views

Zero-Trust alternative to google sign-in, is this a feasable design?

I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
2
votes
1answer
86 views

How do I add 2FA to my personal computer?

I have a Windows 10 PC that I would like to protect a little better. I've looked for solutions online, but they're all business oriented. What I would like, in an ideal situation, is having to enter ...
0
votes
0answers
26 views

How to prevent the device from connecting to the original AP?

I'm running an Evil Twin attack with airgeddon. Point is that after deauth the account is going, automatically, to get reconnected to the orginal AP and not the fake one. The aireplay is likes so: ...
1
vote
1answer
101 views

Logging into remote server via SSH using VPN (Wireguard). Is it foolproof?

I have a remote server into which I login via ssh. On this server I have setup a Wireguard VPN to which my host connects. The ssh server (ssh daemon) listens on a private IP interface (the server's ...
1
vote
0answers
41 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
2
votes
0answers
43 views

client_id vs distinguished name in mutual tls

i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
0
votes
3answers
104 views

Problem understanding salting

I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
0
votes
0answers
48 views

How to implement ChaCha20Poly1305 with large files? (Streamed/Chunked AEADs)

I have a private file encryption project that I'm working on that currently uses Encrypt-then-MAC. However, I've been looking at age and the article that's referenced in the spec that discusses ...
1
vote
0answers
43 views

Difference between JSON web token, bearer token, and MAC token in OAuth2

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format { "iss&...
0
votes
1answer
47 views

Should the API automatically renew the expired JWT or wait for the client to?

In most examples I’ve read, I see people mentioning that when the server returns a 401 the client should hit the jwt refresh endpoint, passing in the refresh token somehow (i.e as a cookie), and then ...
0
votes
0answers
51 views

validation of an access token from the resource server

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Boun Access Tokens The client after receives an access token (which is also entails his certificate in a hash format) from ...
0
votes
0answers
22 views

method for optaining access token from an authorization server [migrated]

I am reading this Auth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens The manual states that the client asks the auth server for an access token. However, the manual does not ...
0
votes
1answer
44 views

symmetric keys during mutual TLS

I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server. Between the client and the server, a handshake is utilized in order the two ...
0
votes
1answer
45 views

Client — CertificateVerify during handshake

I am trying to understand how the client is authenticated to the server during mutual tls So during the handshake, the client sends this message Client — CertificateVerify This message is used by the ...
0
votes
0answers
33 views

Certificate and public key flows in mutual TLS

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens I am interested to know how the certificates and public keys are exchanged between the client and the ...
0
votes
1answer
125 views

What is an endpoint in the context of TLS?

What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access ...
0
votes
1answer
72 views

OAuth alternative for two-party scenario?

I'm trying to come up with an authentication/authorization system for what seems like a really simple scenario, but as far as I can tell it's virtually unsupported. There are two parties, total; ...
0
votes
0answers
59 views

SAML-Authentication with angular, node.js and an identity provider

I want to to implement SSO using SAML2. But I don't know how to get it work with a distributed system where each instance is running independently on its own server. The environment consists out of ...
0
votes
1answer
55 views

CSRF token in SPA login JSON response?

Is it safe to include the CSRF token as part of an HTTPS successful login JSON response in an SPA? If not, is there a better mechanism for sending it which avoids the Double Submit Cookie pattern? ...
1
vote
0answers
17 views

HMAC with random application Id and secret with DPAPI

We have open endpoints because there is a flow where access token is still not presented. Because of that, I've implemented HMAC + DPAPI (using Azure Blob Storage) to store the keys, without involving ...
0
votes
1answer
77 views

How an IDP sends SAML assertion to an SP?

I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible. First is ...
1
vote
2answers
64 views

Case sensitive logins

Why does owasp recommend using case insensitive logins ? Make sure your usernames/user IDs are case-insensitive. User 'smith' and user 'Smith' should be the same user. What's the security aspect of ...
0
votes
0answers
24 views

TLS with only server certificates [duplicate]

Up until now, I believed that TLS authentication and encryption can only be achieved when both the client and server exchange certificates with each other initially? Now I am seeing an example in ...
0
votes
0answers
22 views

Authentication Cookie Security Features

I am completely stuck and I need to make sure that I am correct. Any help is greatly appreciated. Based on the cookie, I need to answer these questions: Select which security features does the cookie ...
0
votes
0answers
37 views

What are modern protections against mobile application cloning

I recently started thinking about an attacker which would clone a mobile application, and add some code which would do something malicious, e.g. credential theft. This cloned app would communicate ...
0
votes
1answer
19 views

Error message when logging in with valid credentials while registration not complete

I have a registration login process which includes a one-time activation link sent via email when the user registers. When the user clicks the link the account get's activated. Now what error message ...
0
votes
1answer
28 views

Account switcher in browser implementation and secure design

I am trying to understand how websites implement in-browser account switcher. e.g you can login to twitter using multiple accounts. On the bottom left when you click your currently logged in account, ...
0
votes
1answer
50 views

Host Keys in Public/Private Key Auth

I've chased my tail into a late night circle thinking about public key authentication to cloud instances. As such, I have some questions on the function of host keys when authenticating an SSH session....
0
votes
0answers
52 views

For what good security good principles Facebook using auth digest over ssl?

I want to know if there are no real advantages of using "auth digest" over SSL, then why facebook and many other famous e-commerce websites and SM platforms still uses it. https://...
0
votes
1answer
71 views

Challenge-Response authentication and SSL

I'm currently developing an Android Application that communicates with a server and needs the user to login. The connection is secured with SSL and certificate pinning. For user authentication I'm ...
0
votes
3answers
142 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
1
vote
1answer
57 views

Does this official “Enforce MFA” AWS policy make any sense?

At https://aws.amazon.com/premiumsupport/knowledge-center/mfa-iam-user-aws-cli/ the AWS officially recommends to have this policy { "Sid": "...
2
votes
1answer
117 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
0
votes
1answer
50 views

Is client-side hashing secure during password creation when verification is still done server-side?

Trying to do this to distribute the work of creating a lot of users in which their passwords are hashed. This will cause the server to do a very large amount of work. The idea is this: (Assume ...

1
2 3 4 5
81