We changed our privacy policy. Read more.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
39 views

Is the authentication system of this website secure enough?

Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak... When I login, I send POST ...
-1
votes
1answer
32 views

What are characteristics of secure TOTP 2FA Authenticator

There are tons of TOTP (2FA) Authenticators out there (for Windows, Android, iPhone ...). However, in terms of security, what are the main characteristics that an app needs to meet to be called really ...
1
vote
0answers
27 views

Relation between Radius - PAP - CHAP

I struggle to understand what relation RADIUS has with PAP and CHAP. Individually, I understand how CHAP and PAP work but I need clarification Based on the image above, imagine I set up the switch ...
1
vote
0answers
32 views

Advice on authenticating client requests for multiple APIs behind a load balancer

We've built a number of APIs that sit behind a load balancer. request -> lb -> app1 -> app2 -> app3 The load balancer routes requests based on the path to the ...
1
vote
0answers
11 views

Digital signature with Big Brother [migrated]

I have read digital signature with Big Brother but don't understand the sequence. One approach to digital signatures is to have a central authority that knows everything and whom everyone trusts, say ...
1
vote
1answer
65 views

Hashing sessions and retrieving them using cookie(s) with session "id" and "token"

I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed). OWASP and ...
0
votes
0answers
50 views

Can double public key authentication be used as 2fa in privacy based use cases?

MFA with the characteristics of "Something we have" commonly consists of FIDO, OTP and TOTP. In my use case(privacy focused), FIDO, OTP and TOTP can't be used due to the fact that they ...
1
vote
1answer
48 views

Extended expiration on JWT

When we are talking about JWT authentication, how big of a security risk would it be to eliminate the concept of a refresh token and just have a single JWT have an expiration time of, let's say 30 ...
1
vote
1answer
76 views
+300

Is it possible to use cookie-based single sign-on authentication scheme if sites do not share a common DNS parent domain?

According to Wikipedia, A simple version of single sign-on can be achieved over IP networks using cookies but only if the sites share a common DNS parent domain. This means that if the user has ...
1
vote
0answers
36 views

How to do auth without user interaction in an enterprise environment?

We are building a Chrome Extension that will be force-installed on each employee's browser for the companies we work with. We currently use OAuth but many employees are forgetting to sign up. We are ...
3
votes
1answer
174 views

What is Google's "match the number" verification trying to achieve?

When I log into my Google account from my laptop with 2FA enabled, I usually get a prompt on my smartphone in order to confirm the log in. I tap OK and then I am logged in. However sometimes I am not ...
0
votes
1answer
122 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
0
votes
1answer
55 views

Does having secondary email for 2FA increase security

Bank account have portals that one can access online. After entering my uname/password, OTP is sent via SMS to mobile phone. After entering OTP and password again, one is allowed access to online ...
0
votes
0answers
26 views

Do I need to authenticate a user on WhatsApp when using twilio?

We are building an online shop using django. We have developed an API for our application to interact with Twilio. This is so users can buy products on WhatsApp from our application. I want to know ...
0
votes
0answers
8 views

Is it possible to limit AWS Account access from corporate devices only [migrated]

Is it possible to ensure that AWS accounts that have been created by an organisation cannot be logged in to from devices that are not part of the corporate infrastructure? I am struggling to ...
0
votes
0answers
50 views

Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?

CONTEXT There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive RESEARCH Here is what I found of how Authorization Code Grant flow ...
0
votes
0answers
37 views

Is it bad practice or major security risk to cache decoded auth tokens in my backend?

I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
0
votes
0answers
3 views

Debugging HTTP 403 Forbidden when using cURL for mutual authentication SSL (mTLS) [migrated]

I'm a beginner in security but I am trying to send a request to a server through mutual authentication. I was given CA pem file client cert pem file private key pem file Right now, I'm trying to ...
0
votes
1answer
90 views

Store a password as an identifier (as safely as possible)... since there is no other choice

I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
1
vote
1answer
49 views

Is username + password functionally equivalent to a single login string of the same length?

My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database? I can see that in the case of a single login string, ...
0
votes
2answers
86 views

Authentication strategies for dealing with users that willingly provide their credentials to others

Let's say we have an employee that has an account on an online system that she does her work on. Let's say she doesn't want to do the work. So she provides her login credentials to someone else. 2FA ...
2
votes
1answer
109 views

Is multiple methods of Two-Factor authentication less secure than a single method of 2FA?

If I set up 2FA on my Microsoft account (for example) and I create multiple methods such as SMS, email, and an authenticator app, will I be more vulnerable than if I only set up the authenticator app? ...
2
votes
3answers
160 views

Is it sensible to accept a password + any other random characters for successful authentication?

Supposing a user of my system has set their password to Password123 At the login screen, what would be the security implications of me accepting: Password123 or Password1234 or Password123ABC Based on ...
1
vote
1answer
88 views

Is 2FA based on Google Authenticator Real?

I was reading this response on SE about 2FA: Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of ...
1
vote
3answers
163 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
0
votes
0answers
65 views

Security: Plaid vs Quicken vs Mint

Why are people so quick to criticize Plaid for using login info when trusted apps like Mint do the same thing? They require username and password for bank info, but seem to be trusted. I wanted to use ...
0
votes
2answers
116 views

How/What to prompt user for fingerprint login using smartcard?

We are using a PIV smartcard that has biometric information (fingerprint) of the user encoded on the card to login into our application. We have the capability to read the fingerprint from a reader ...
0
votes
4answers
173 views

Forget Me Not? Abandoning the Forgot Password Functionality

They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
0
votes
0answers
54 views

Security requirements for public API keys

I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients. The scripts will be run on the endpoints several ...
0
votes
1answer
90 views

Are there still ways that OTP is safer than FIDO?

From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
1
vote
1answer
111 views

Your username can only be changed once?

I've seen quite a few security centric sites enforce this policy: Your username can only be changed once My question is: Is this done from a security standpoint? If yes, what is the logic behind it? ...
0
votes
0answers
38 views

Strategies for segregating anonymous and secure access to APIs

Traditionally, we used either path-based access control or a separate DNS for public and private content segregation. In the modern era of standard-based auth, what are the best auth strategies for ...
0
votes
0answers
27 views

Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)

For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
1
vote
2answers
143 views

Are 6 digit number verifications secure?

I've noticed that many services and/or platforms now send 6 digit codes to verify user actions. Typically sent to an email. With these being 6 digits long & assuming that you get at least 3 tries ...
33
votes
8answers
12k views

Why don't some services offer Google/Facebook/Apple/Twitter login

Why don't some services offer Google/Facebook/Apple/Twitter login? Namely Crypto exchanges. I assume they want as many users as possible & this is a great way to get more. Is there some sort of ...
0
votes
1answer
96 views

Secure ajax login form

When the client is logging in, I send an xhr request to the server. However the request looks like this: localhost:80/api/login-ajax/&username=johndoe&password=123456 This is insecure for ...
0
votes
1answer
54 views

Lab Environment Authentication Best Practice

Looking for best practice advice regarding lab environment authentication. We have a lab to evaluate and perform regression testing of third-party applications and hardware. No proprietary information ...
1
vote
0answers
57 views

What prevents attackers from posing as legitimate smb server?

Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens: The computer is booted up in another network ...
2
votes
0answers
54 views

IoT Device Authentication

I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/ I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
1
vote
1answer
78 views

What are the benefits of using different certificates to identify the same service to different audiences?

Recently I was having a discussion with a team which uses a separate certificate for each different backend service that it interacts with. The backend services do client auth as well so that is what ...
0
votes
0answers
57 views

How does Nessus offline registration work?

To use the free trial of Nessus, you need an email address to receive an activation key. There are two modes to activate a Nessus server: Online mode registration If the computer running Nessus ...
0
votes
0answers
58 views

Why my yubikey is not protected by a PIN to log into Google?

I just setted my yubikey on Google so I can login into Google without any passwords. However, I don't even have to put a PIN on the yubikey, it simply works. I find this very very dangerous as anyone ...
0
votes
0answers
36 views

How Does it Work - User Authentication using Yubico Smart Card (Yubico PIV) on Mac

Background: I have setup my macOS Catalina so that I can authenticate my user account using my Yubico (set up as a Smart Card) and its PIN After setting this up I can see that there are now 2 ...
4
votes
1answer
148 views

How does Firefox protect Logins and Credit Card Data?

I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
0
votes
0answers
36 views

Is a Keycloak User ID sensitive?

I am using Keycloak for OpenID Connect single sign on. I can see that the various users each have an ID in Keycloak, with the format similar to this example: a12346fb-bd93-fedc-abcd-0739865540cb. Is ...
0
votes
0answers
27 views

Authenticating Infrastructure SOAP-based API

I have been involved in a discussion the other day regarding the implementation of backend-to-backend authentication. The communications between each backend happen via SOAP (XML) message protocol. ...
1
vote
1answer
61 views

OpenSSH AuthorizedPrincipalsFile Allows Any User

I am bewildered as to the below config and subsequent behaviour. /etc/ssh/sshd_config: AuthorizedPrincipalsFile /etc/ssh/principals /etc/ssh/principals: all host.example.com dev This allows me to ...
0
votes
0answers
54 views

Confirm User Account Without Exposing IP of Server?

Right now, when a user signs up for a new account on my site, the server sends the user a email verification link. When the user clicks the verification link, the link redirects to my server to ...
7
votes
3answers
185 views

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches?

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches? For example one where similar input data generates a similar hash, with the difference in the ...
0
votes
0answers
42 views

Which OAuth2 flow should I use?

Context I'm trying to build an hybrid multi-tenant API using OAuth2.0 using Laravel 8 Passport, so my system has 2 parts: one process the request from the tenant application, and the other part ...

1
2 3 4 5
85