Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

2
votes
2answers
57 views

Are there use cases where a mutually authenticated TLS is preferred?

I am trying to see if there are use cases where a mutually authenticated TLS is preferred over a one way authentication. Usually the authentication of the client/user is done over the TLS tunnel. ...
1
vote
1answer
16 views

sp initiated saml sso authentication

I am working on SP initiated saml sso and it is completely new to me. I have gone through lots of articles and videos(wikipedia, centrify chalktalk, medium posts) but i am not able to understand some ...
0
votes
0answers
13 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
1
vote
1answer
23 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
0
votes
1answer
42 views

An authentication protocol to prevent phishing & solve the problem of password reuse?

When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
0
votes
2answers
24 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
0
votes
0answers
19 views

Does Auth0's free account have a limit on Auth0 Guardian Usage? [closed]

I am developing an application that uses Auth0 for authentication. I want to enable multi-factor authentication using the Guardian application. On the application page it says the following: ...
1
vote
2answers
117 views

How secure is this schema for Online Licensing System?

I'm trying to make a good licensing system without affecting user's experience and at the same to make it as secure as possible. I know it's impossible to make it 100% secure, but I would like to make ...
1
vote
0answers
29 views

Most used Linux terminal tools that take passwords as a parameter [closed]

I am writing a tools that basically searches scripts and configurations files for hard-coded passwords. My first approach is to identify the most commonly used Linux terminal applications that can be ...
2
votes
1answer
71 views

Problems with this 2 factor authentication implementation

I'm implementing my own 2 factor authentication using SMS. We have a gift card service and the users are sent a link to their gift card. Every time they click on their link, we are verifying it's ...
1
vote
3answers
71 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
71
votes
8answers
14k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
0
votes
1answer
60 views

How does Google Authenticator interact with apps on an iPhone?

I am clear on how Google Authenticator works when logging on to a website and I am clear on that. However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
-2
votes
0answers
28 views

Cel im longer distance [closed]

Is title celler, one images in very sometimes save me. Did know a text one How rest connect a passowrd. some things peaceful.
1
vote
1answer
32 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
0
votes
2answers
50 views

How pincodes used as an authentication mechanism?

I'm designing a login system for my mobile app where users only need to provide a pincode to authenticate into the app after they sign-up. I'm more wondering how the backend would work in such a ...
1
vote
1answer
72 views

Is it a good idea to notify a user that they signed up with a social-login account?

Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
1
vote
2answers
151 views

Why would an attacker try SMTP login many times even though it is disabled?

I recently set up an SMTP server for myself to use, and I am getting some traffic from two IP addresses and none else (though for obvious reasons I will not state the addresses here). An example ...
0
votes
0answers
14 views

Concepts in Authentication and Identity modules in ASP.NET Core 2 [on hold]

I am really trying to get the big picture of the Authentication and Identity modules in ASP.NET Core 2: not just how to use them (which I can and which I do) but really what exactly are the different ...
1
vote
0answers
25 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
1
vote
1answer
19 views

SOAP Web Service: Basic Auth. vs Password in xml

I am testing a SOAP web service and the service sends username and password in every request as part of the XML body over SSL. I wanted to object to that and offer Basic Auth. but could not find any ...
4
votes
3answers
136 views

Drivers license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my drivers license to verify that it matches the details on the card because ...
2
votes
2answers
127 views

Is it possible to make a login safe without a TLS certificate?

I'm using free hosting and I would like to know if there is a way to have a safe login system without a TLS certificate. All I do with this server is: POST HTTP Request with username and hashed ...
1
vote
1answer
99 views

My boss installs software using domain admin. Should I show that this is bad?

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
0
votes
1answer
68 views

How can I verify a company's identity?

I'm a web developer working on a project for a client. To keep it short, the project has company listings. These company listings are not provided by the companies themselves and instead it is just a ...
2
votes
1answer
147 views

Why are pins required on boot on devices with fingerprint readers? [duplicate]

Both my iPad and my android phone are configured to allow access via either a pin, or a fingerprint scan. However, immediately after a reboot, neither device allows a fingerprint for the first unlock; ...
1
vote
2answers
61 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
1
vote
0answers
16 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
0
votes
1answer
39 views

How to implement CN/DN certificate validation between two internal servers?

In an internal environment I have two Windows servers which both have Internal CA Signed SSL Certificates used to implement a Mutual Authentication HTTPS connection. Is it mandated that a CN/DN ...
1
vote
1answer
42 views

Implementing mutual authentication between two components on the same server

Mutual authentication between application interfaces are mandated in my place of work. We are looking to implement a vendor provided software where they are installing two "components" on a single ...
5
votes
2answers
104 views

Rate Limiting An API

I am busy developing an API for a mobile application, currently one of the endpoints require that the users username and password be POST'ed to it. What I am worried about is someone discovering that ...
2
votes
1answer
43 views

Where custom auth source code fits into the micro-segmentation, zero-trust architecture

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of ...
0
votes
0answers
30 views

How to legally verify a digital signature was validly created and used, and the audit trail was not forged

I am still learning about how exactly a digital signature is created, but I'm wondering about the process of making sure a digital signature was actually created by the end user. For example, say a ...
0
votes
2answers
48 views

Authenticated Sessions on a Desktop Application

I want to implement a login into my C++ desktop application and I'm having a hard time finding information on managing login sessions without cookies or JWT (JSON Web Token) (more on that in a bit). I ...
0
votes
1answer
21 views

Basic Auth Credentials on Mobile Device

I am testing a mobile app that makes requests to a web service. Web service has two sets of functions. Class A functions can be called before login and Class B functions can be called after login. ...
1
vote
1answer
68 views

Is it possible to eavesdrop the wireless data transmission without being authorized to a router?

I read in computer security book that there are three places in wireless networking where you can be attacked: wireless transmission, access points and wireless network itself. The book illustrates ...
0
votes
2answers
43 views

Is it reasonable to store HMAC secret key in memory only?

I'm building a web application using Spring Boot for the backend and Angular for the frontend and planning on using JWTs signed with HMAC-SHA256 for authentication/authorization. I've been thinking ...
1
vote
0answers
45 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
0
votes
0answers
11 views

Client certificate as a second factor [duplicate]

Client certificates get stored into the OS or browser trust store. So normally they are stored there permanently. Is it suitable to use them as a second factor for web authentication under some ...
2
votes
1answer
46 views

Is providing authentication data for other web applications unsecure?

I started to work on a company whose software engineers tried to reinvent everything. They did not use(or know) industry standarts and for authentication, they use their custom solution. Their "...
1
vote
0answers
19 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
0
votes
0answers
18 views

Webauthn and TLS channel binding

my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook? TLS channel ...
0
votes
0answers
30 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
1answer
69 views

Securing protected routes/pages with JWT

Let's imagine I have a website with a React front-end that renders two pages, one is "View Data" and the other is a welcome page with a login form. Scenario: You log in and the server accepts it and ...
0
votes
1answer
68 views

Got “Security alert” e-mail from Google about a sign-in from an unknown device I'd like to track down [closed]

I just got a horrifying e-mail from Google that led to a webpage stating that there was a "New sign-in on LG Nexus 5". I immediately scrambled to change all my passwords to protect myself because I ...
0
votes
1answer
133 views

Is telegram SMS login secure?

TL;DR: Can 1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or 2) A "telegram ...
4
votes
2answers
187 views

Windows 10 seems to load session before user log in, is it safe?

Last few days I noticed a really annoying problem with Windows 10 (not sure if it is caused by last update). After computer is turned off gracefully, on next startup it loads completely session of ...
0
votes
1answer
60 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
1
vote
1answer
49 views

How does the public key get authenticated during an ssh session

When using SSH, my private key is stored on my computer safely and my public key is given to the other party I wish to communicate with. I understand that the two keys are mathematically related, and ...
0
votes
0answers
13 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...