Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
2answers
64 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
0
votes
2answers
40 views

How to monitor password protected web page

I want to use a website monitor to check that a web page is working but the web page requires that the user is authenticated. Is there a crafty way of achieving this that doesn't require storing an ...
2
votes
0answers
36 views

How to give end users access to accounts previously only administered by managers?

I have a question about how to handle a somewhat unique authentication situation. We have an existing system with lots of users that have never had direct access to their accounts before. They have ...
0
votes
1answer
25 views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
0
votes
0answers
20 views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
2
votes
2answers
98 views

Why is it still necessary to block brute-force attacks when passwords hash verification requires significant work?

For authentication controls, Owasp gives advice to prevent brute-force attacks by locking out account, and I see this kind of advice in several places (blocking by source IP after failed logins, ...
1
vote
1answer
19 views

restoring logged out gmail session in running instance of chromium browser?

My situation is: +I have created a special purpose gmail account +I used a complicated password to protect the account. On purpose, I did not use any 2FA options are a "reset" email address or phone ...
0
votes
0answers
27 views

Desktop login - Security about private keys

Simplified case of usage: I've been developing a desktop application storing a pair of public and private keys, which are completly encrypted as soon as they are created by a given user password ...
4
votes
2answers
123 views

Telegram (or other messenger) message as second factor in 2FA

Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why ...
0
votes
0answers
26 views

SMTP connection attempt failed user authentication check [closed]

Mailing_list@domain.com is mailing list including officers’ mail addresses from various companies. Amongst them, employees from "company 1" (employee1@domain1.com, employee2@domain1.com and employee3@...
-1
votes
1answer
41 views

Logging in to a website using my gmail account gives away my location but I can access the trail content without logging in. How? [closed]

When I use a VPN (Tunnel Bear) to India from USA and access Hotstar.com it takes me to the Indian version of the website. I can access and watch the trail streams offered but when I log in to the ...
0
votes
1answer
56 views

My site is asking for authentication username and password [closed]

Myt site Hoodtrends is requesting for Authentication username and password. Please can someone help me out with this?
0
votes
1answer
105 views

Hardening a asymmetric key based authentication process

The process involves two interested parties A (client) and B (server) and the attacker M. M is capable of intercepting all the communication between A and B (Man in the Middle) and even modify it. ...
0
votes
0answers
5 views

How to simulate U2F/MFA devices [migrated]

Is there any solution how to simulate devices for U2F/MFA for development web apps? I use Windows 10 operating system, but i prefer OS independently solution.
1
vote
1answer
56 views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...
60
votes
6answers
9k views

What should a verification email consist of?

Right now I'm generating a 25 character string stored in the database that can only have a 1 time use and expires 30 minutes after user registration. http://example.com/security/activate/...
2
votes
4answers
136 views

Is an authenticated server seeing the plaintext password a serious problem?

Typically a server ends up observing the plaintext password sent by a user at some points (correct me if it is not). Assuming that there is a secure channel established and the data are confidential, ...
0
votes
1answer
61 views

Verify the requesting domain

I have a both a http and websocket server written in nodejs (for now) and it will be receiving requests from many different domains. The request is made from the client using JS. I need to verify 100%...
0
votes
1answer
43 views

How can I make my Windows Server accessible from another Windows PC over the internet safely, without using VPN?

First, some backrgound context as follows: I have a Windows Server 2008 running for my company. It contains an ERP, which is accessible by other computers/clients on LAN. During the client setup, the ...
1
vote
0answers
12 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
1
vote
2answers
86 views

What is the point of 2FA if the recovery code (which is only one factor) can be used to access the account anyway?

I think the title says it all, but to elaborate: If, say, someone were to find my recovery code, could they not then gain access to my account? Similarly, could then someone not just hack my recovery ...
1
vote
1answer
38 views

What are the disadvantages of using Shamir's Secret Sharing to implement a Partial Password scheme?

Suppose I want to implement a partial password scheme, where the user authenticates by using two passwords: one a normal password, the other is partial, where he only needs to type the selected three ...
2
votes
1answer
48 views

What is the proper flow for authentication?

I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
4
votes
1answer
59 views

Generating QR code from seed in browser - possible security issue?

I need to implement 2FA in my web app. I'm doing this the standard way: the newly created user's seed is retrieved from the server(I use speakeasy) and the QR code is generated. The thing is, it's ...
5
votes
1answer
68 views

Can I use `lsof` to reliably determine which local process has connected to my open port?

Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<...
-2
votes
0answers
82 views

Access login form protected by session cookie [closed]

I have a website in a CTF behind HTTP basic auth which I know and use with my credentials, but the website itself has database accounts with credentials to access non-public area. The login to ...
0
votes
0answers
21 views

RADIUS authentication. Password hiding

From what I know, when a user wants to login to a RADIUS server, it sends their username and password to a NAS, and the NAS hides the password by hashing (MD5 (shared secret, request authenticator) ...
1
vote
1answer
76 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
0
votes
0answers
9 views

Authentication in production [duplicate]

I have never worked on a production project of any sort, and I have been wondering about something. Say we're making a desktop or web app that talks to a database, and that database needs ...
1
vote
2answers
74 views

Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance ...
1
vote
3answers
132 views

How can I maintain my two factor authentication when my phone is in for repairs?

I recently got a new phone that has various hardware issues with it. As such, before the warranty expires, I need to send it back for repairs. Unfortunately, I already have Google Authenticator ...
1
vote
1answer
30 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
0
votes
1answer
17 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
0
votes
0answers
8 views

Windows 10 still allows old password [migrated]

Desktop with Windows 10 (at home). I changed my Windows password several days ago, restarted several times, and still both old and new passwords work. How to make Windows forget the old password?
1
vote
1answer
44 views

How to authenticate a specific client program? [duplicate]

I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
0
votes
1answer
44 views

Multiple contributor security for blog

I currently develop a big blog website with Firebase as my backend just for information. Right now (not released/published the page yet), I give my authors accounts special rights to access pages ...
69
votes
3answers
26k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
9
votes
3answers
340 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
0
votes
2answers
61 views

How can I secure a REST service intended to be used by my customers' customers via their public website?

I am developing a service with an associated REST API for customers (companies which have their own websites) to use. In other words, one of my customers would typically make the REST call directly ...
2
votes
1answer
60 views

Allowing unauthenticated user access web page information

Our web application should allow unregistered users to browse certain information. This information is returned by apis Currently we are using hardcoded guest login to achieve this The mere ...
0
votes
1answer
41 views

OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario. I know Oauth 2 ...
0
votes
0answers
29 views

Google login 2FA: security events to cell / always require Cell confirmation (2FA)

For Google account with 2FA enabled : How to require cellular confirmation to a critical event such as a password change. How to get notifications to cellular regarding a password-change. How to ...
0
votes
1answer
26 views

How does Authenticator gets the PMK which is used to calculate PTK?

I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism. I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
1
vote
1answer
34 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
0
votes
0answers
13 views

Use local administrator and Domain Cached Credentials to obtain access to AD domain?

I have obtained local administrator privilege on a Windows machine connected to AD domain. Using Mimikatz I see the Domain Cached Credentials of a few Domain Admins. I know that, it is possible to ...
0
votes
0answers
71 views

Where/how to store the password for (REST) authentication?

What I have at the moment is as follows: There are Java clients where I store the passwords locally in files in clean-text format. There is a REST endpoint where I store all the passwords in one file. ...
2
votes
1answer
46 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
0
votes
1answer
34 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
1
vote
1answer
74 views

Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?

I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
2
votes
0answers
42 views

Verifying the source of a request [duplicate]

I am currently writing a network multiplayer game that uses a lobby system to find available matches for players to join. The list of available matches is served and updated by a web application via a ...