Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
11 views

Why is the Diffie-Hellmann exchange not enough to authenticate the communication partners in IKE_SA_INIT?

The IKE_SA_INIT does create a key seed SKEYSEED from the Diffie-Hellman values and nonces. Since the exchange does sharing the secret between the communication partners, I do not understand why it is ...
0
votes
0answers
30 views

Can anyone identify the authentication backend used by a PHP website from the following URL?

Client POSTs creds, and if authenticated, server responds with a 302 redirect to an enormous path: https://phpwebsite.com/login/auth/[encoded_data] where encoded_data is either 811, or 726 ...
-2
votes
1answer
70 views

Security without Login

I am working on a web-app where user can access his purchased item using two word/Number combination and then user add card details on same page for the payment of those item. Point to be noted ...
0
votes
1answer
61 views

Is there any solution to this system?

INTRODUCTION First of all, I'm a beginner in RSA mechanisms and similar but I'm really interested in knowing if this is possible. In this scenario, I organized a party where certain people receive a ...
1
vote
1answer
81 views

How to securely send data to a javascript broswer client?

I have a client which requires some currently public API endpoints be encrypted and secure (although it's more of a checkbox than anything I worry about someone attacking, or I would not accept the ...
0
votes
0answers
42 views

Encrypting File System(EFS): Isn't the use of public key encryption a redundant step which doesn't improve the security of the FEK? [closed]

With EFS, we know that a symmetric key, File Encryption Key (FEK), is used for encrypting files. The FEK is then protected by encrypting it with the public key of the user that can be recovered by ...
2
votes
1answer
37 views

Authentication followed by storage decryption on login?

I got a typical login setup: Username/password that is passed to server, hashed/salted with PBKDF2, then compared to hashed/salted entry in login database. After that, JWT token is generated and ...
1
vote
3answers
102 views

Using two salts - one stored with the password, one stored in a random row in a separate table

Imagine a login system is being created, and a user's password is hashed thusly: Users.password = PBKDF2(salt1 + password + salt2) The result of that ^ operation and salt1 are stored side-by-side in ...
2
votes
0answers
45 views

How to mirror user access between Windows 2016 Servers

I'm setting up an intranet web server that will handle requests coming from multiple different types of employees. One of the requests that my server will need to handle is to query data from a ...
2
votes
0answers
31 views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
2
votes
1answer
59 views

Is it possible to mac-spoof Xfinity Wireless?

Background Comcast/Xfinity operates various wireless hotspots across the US, accessed via the SSID xfinitywifi through the many wireless access points shown on https://hotspots.wifi.xfinity.com/ ...
2
votes
1answer
62 views

Does re-authenticating to apps on an unlocked phone really make an app more secure?

Several apps on my iPhone X including LastPass, and iCloud passwords prompt me for my Face ID before allowing me to use them. I guess the idea is that someone could accidentally take my unlocked phone ...
3
votes
1answer
88 views

Putting personal Data in E-Mail vs sending password in plaintext to access that data

I started working on a service that sends out mails with a link to a registration form. (e.g. a registration for a movie premier) The link would look like this https://movie-premier.com/rsvp/USERCODE ...
1
vote
0answers
34 views

OpenID Authentication Method Reference Name for a code sent via email

Introduction: I am currently implementing acr_values, acr & amr principles on a Open ID Provider server. The claim amr (described in the OpenID RFC 1.0) has no standard clearly defined in this ...
0
votes
0answers
16 views

Advantages of EAP Authenticator in EAP protocol

What is the purpose of using a EAP authenticator in the EAP protocol ? Since underhood, the authentication procedure is between the EAP peer and the authentication server, what is the advantages of ...
2
votes
2answers
75 views

Is putting an authentication tokens inside the HTML body safe?

I have a project, a webapp/website that uses cookies to authenticate users with long randomly generated strings (also with samesite:lax, httponly, secure), however I also have an API which itself ...
2
votes
0answers
41 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
3
votes
1answer
67 views

OAuth 2.0 authorization code flow vulnerable to “shoulder surfing”?

When using the OAuth authorization code flow in web applications, after successful authentication of the resource owner, the authorization server usually responds with a browser redirect to pass the ...
30
votes
9answers
7k views

Is there a way to add salted hashing to my user authentication without breaking my former login server

I am presented with the following scenario: I have a MySQL-Database with a table of users. The table has two fields: username and password. The password is stored as an unsalted hash. An over 15 ...
0
votes
2answers
100 views

Best way to authorize and authenticate a user on web API

I am doing a hypothetical web just for learn some security tips and the first problem I've found is the login, I've read like 40 articles, a lot of questions here on stackoverflow and I still don't ...
2
votes
1answer
48 views

IKEv2 Using Different PSKs

We're setting up some new tunnels and have been told to use IKEv2. I understand that IKEv2 allows different authentication methods, e.g. one side using PSK and the other using a certificate. We don't ...
2
votes
0answers
38 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
1
vote
1answer
33 views

When does OAuth re-authenticate users?

I assume OAuth protocol being something like this: user registers to Gitlab using Facebook (for example) Facebook asks if user accepts sharing profile info with Gitlab user accepts Gitlab receives ...
1
vote
1answer
44 views

What are the security risks of basic authorization in SOAP requests?

What are the security risks of basic authorization in SOAP requests? I know that the username and password are concatenated and sent in Base64 in an HTTP header on every subsequent request, but it is ...
1
vote
2answers
91 views

Hashing Session ID

For my app I use redis as a session store. Is it safe to store the session id without using a hash function? If I should use a hash function, the client would receive the cookie with the raw or the ...
17
votes
3answers
5k views

Storing info in JWT payload

Currently, the access token expires in 15 minutes and the only info stored in the payload is the user id. Each user has a balance which he can use inside the app. Should I query the database on each ...
1
vote
2answers
58 views

wordpress remote user authentication

I am having multiple wordpress sites with multiple users working on those. Therefore I would like to centeralize the user management, by having one authentication server, storing the username, ...
1
vote
1answer
53 views

Can session/cookie request token be sent via url?

What are the security concerns if a session token is sent via url over https? After authentication a rest api sends a unique session token that is used to validate subsequent requests. It is ...
0
votes
0answers
34 views

Why use a refresh token for authentication?

I recently stumbled upon this article which recommends using two tokens for authentication. Once the user is logged-in (or registered), the client receives an access token and a refresh token, ...
0
votes
0answers
35 views

What are token types used by secure modular systems nowadays?

What are the possible token types for the authentication and authorization in a modular system? Are all of them bearer tokens?
0
votes
1answer
61 views

Token Based Authentication

I have a React app that connects to a REST API for which I have to implement token based authentication. The only info stored in the token is the user id. The following flow will be used: User logs ...
0
votes
0answers
24 views

When Deserializing a User in Passport is there any reason not to remove Secrets?

I am using the passport-local passport strategy. I want to follow the principle of least privilege, so I was wondering if I should remove certain secret properties from the user when I deserialize ...
0
votes
1answer
70 views

How can user-less servers be authenticated without sharing secret data?

Background: This is the architecture of the platform I'm working on: The API has several secured endpoints for accessing the database. Users login on the Front End with their credentials, and if ...
1
vote
0answers
49 views

using public key crypto instead of password for authentication [closed]

I'm the head of IT and development in a small group of enthusiasts spending their free time with a bit of hobby development. We don't have an office yet, but maybe consider to rent some small office ...
-1
votes
1answer
44 views

How to protect my webserver from unauthorized client applications? [duplicate]

I would like to host simple HTTP webservices and develop a web client for it (basic javascript app in the browser). any person (even without registering) shold be able to access the webservices but ...
1
vote
1answer
95 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
6
votes
1answer
104 views

Western Union prompts for bank login information — ridiculously bad practice? [duplicate]

I was trying to initiate a Western Union transaction from my bank account, but toward the end of the process I was prompted by this request, which is to type in my bank's login information. The ...
2
votes
2answers
137 views

What should I think about users with huge numbers of successful login attempts in a short period?

What to think about a user making thousands of successful login attempts over a short period? What are the dangers of such a behavior and how to protect against them? A couple of examples of dangers ...
3
votes
1answer
62 views

Password strength when used with 2FA

We have two factor authentication, with passwords and one time code received on SMS. Now normally I know you could restrict users to create passwords with min 8 character length, lower and caps ...
2
votes
1answer
89 views

Protecting private encrypted data on public computers

Consider an (Java) application that will be deployed on an off-the-shelf laptop in a public location. The laptop is not connected to any network or the internet. A USB barcode scanner is available as ...
0
votes
0answers
32 views

SSO - How Auth Code flow with PKCE is secure?

I've run into this docs when I was studying some SSO concepts; This grant adds the concept of a code_verifier to the Authorization Code Grant. When the Client asks for an Authorization Code it ...
0
votes
1answer
64 views

How to mitigate risk of leaking information of a user not found in database during login

As far as I understand the process of logging someone into your system goes like this: 1) The user which wants access transmits credentials to your system (typically login - being a unique ...
1
vote
0answers
68 views

Hosting password compromised [closed]

Last Monday I received two emails from my hoster: 10h42: Connection notification 10h42: Confirm your notification I didn't login that day, so I knew something was wrong. I immediately logged in, ...
4
votes
0answers
134 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
0
votes
1answer
63 views

Backend Authentication of Mobile App: Session ID vs. OAuth

Currently I am developing an iOS/Android app and a corresponding backend in PHP. In the last days I read a lot about user authentication and now I am a bit confused. For now I am using a session ID ...
0
votes
0answers
34 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
1
vote
1answer
84 views

Can 2FA / MFA be secure & functional in a purely offline state (PWA)?

I'm building a Progressive Web App intended to be used primarily in an offline state. The user can "login" while disconnected, which verifies the password against a locally-stored hash and some other ...
3
votes
0answers
42 views

Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]

I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description). User signs in over ...
1
vote
0answers
39 views

What does jarsigner verify in the first place (integrity or authenticity)?

I was reading sth about android code signing and have run into this statement: The second jarsigner command at v in Listing 3-7 first verifies the signature block and signing certificate, ...
1
vote
1answer
78 views

Capture WiFi AP authentication attempted password

Is it possible for someone who is doing air monitor mode (ex. using airmon-ng) or is using a rogue device to capture attempted authentication on a Wi-Fi AP ? For example, I have a home router WPA2-...