Questions tagged [authentication]
the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
4,480
questions
0
votes
0
answers
5
views
Is it secure to use session ID as authentication token received from an HTTP header?
I am writing a mobile application for an already existing web app.
In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with ...
- 1
0
votes
0
answers
25
views
Will these actions better secure my web app
I'm trying to figure out what else I should (not) do to reduce the possibility of my web app getting hacked. And like most development efforts, while it would be great to have a security expert on the ...
- 493
0
votes
0
answers
42
views
Should I redirect user to login screen after validating email and first password?
I'm working on authentication on the backend of an application and I want to know which of the following methods is the best.
After the user registers in the application an email is sent to the ...
- 101
0
votes
2
answers
53
views
Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?
A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
1
vote
1
answer
46
views
Are JWT's needed when implementing passwordless magic link authentication?
I'm working on a web application where a user gains access by clicking on a magic link sent to them by an internal co-worker. Upon clicking this link, the user is automatically authenticated and a ...
0
votes
1
answer
90
views
Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?
I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
0
votes
0
answers
14
views
Double-factor auth to unlock iPhone in general and, especially, Passwords app in particular? [migrated]
Is it possible to make iPhone require both FaceID and passcode when unlocking the device?
Especially Passwords app is guilty of relying solely on FaceID to pull up a password for a website or an app. ...
- 101
0
votes
1
answer
72
views
What happens at a low level when authenticating server certificates?
Regarding the TLS 1.3 Handshake Protocol:
When the Server sends it's certificate, exactly how does the Client validate this?
I know at a high level the Client is verifying the data the Server sent ...
- 145
1
vote
1
answer
31
views
What's the relation between Mathematica's authentication keys called MathID, activation key, and password?
I'm curious about how desktop softwares' installation authentication/validation process work in general, and hopefully apply it to softwares I make. But to start with a specific example, consider ...
- 123
0
votes
2
answers
137
views
Is WIFI that is 'open' but requires a password to access the internet safe?
It is common knowledge that connecting to open public WIFI networks can pose a security risk (e.g. to man-in-the-middle attacks). However, I have come across 'open' WIFI networks that require no ...
- 101
0
votes
1
answer
67
views
token leak by copying cookie
Imagine this scenario: I have a website where the token is stored in cookies without any session validation. If I were to take this exact token and use it in another web browser, I would be logged ...
0
votes
1
answer
54
views
Isn't there a critical built-in vulnerability in OAuth's Implicit flow?
I've read some blogs and did some labs regarding OAuth's implicit flow,
but it seems to me everyone just turn a blind eye to a very critical point in the flow.
Assuming that site A uses the implicit ...
0
votes
1
answer
48
views
Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?
It's considered a best practice in security for login form to provide a vague error message
your username or password is wrong
rather than the more precise:
username does not exists
wrong password
...
- 103
0
votes
0
answers
78
views
If only 'two' insecure MFA options are available (email and sms) which is 'most secure'? [duplicate]
Although I disagree with the term MFA entirely if it refers to 'login code send to email', it's a one-time password at best, and likely badly implemented with its associated risks. I do see quite some ...
- 6,661
1
vote
0
answers
59
views
Why is there no prevention of malicious polkit authentication agents?
A polkit authentication agent provides the user interface for administrators to input their password. It runs in user space. (https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html) An ...
- 11
0
votes
1
answer
85
views
Authentication that immune to cookie hijacking [duplicate]
There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability.
...
- 423
0
votes
0
answers
71
views
Are banks significantly reducing security by migrating everyone to mobile banking?
I have noticed a disturbing trend across banks (in the EU). Previously, many banks used 2FA by combining a login/password for an online banking website with a mobile authenticator app. However, many ...
- 841
2
votes
1
answer
124
views
Is TOTP "more secure" and harder to crack than HOTP and why?
In addition to my question: How many known time/result combinations does it take to guess a HOTP/TOTP secret?.
I've read often that TOTP is more secure than HOTP. One example:
TOTP provides higher ...
- 6,661
0
votes
0
answers
55
views
Prevent Session Hijacking with copying all metadata from a browser
For example, I'm signed in to my Gmail account. If I copy all data from all the places that Chrome uses (localstorage, all the cookies, all temp folders and so on) to another PC.
How does Google ...
- 423
11
votes
3
answers
6k
views
Why do some websites require logging in twice? Not two steps, but two full username/password entries
There are a couple of web applications that I use that seem to require two successive logins. Not two steps, but two full logins. The behavior is such that I login in, get kicked out, then have to ...
- 223
0
votes
1
answer
55
views
Showing a license/id to a shopping website, worth it? [duplicate]
I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
10
votes
5
answers
4k
views
How to best obfuscate a built-in key in an application?
We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
- 219
0
votes
2
answers
88
views
OAuth2 authorization server dictating the resource server to the client
I am looking for any specifications, prior art, and known security considerations for a specific OAuth2 use case where:
an authorization code grant is being performed.
the client does not know the ...
0
votes
1
answer
45
views
Authentication via User Interaction (Game play, using ML)
Something you know (password), something you are (biometrics), something you have (key card/security key) are the typical authentication factors.
Several years ago I've seen a paper in which the users ...
- 3,916
0
votes
1
answer
174
views
Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?
Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
- 131
0
votes
0
answers
78
views
Progressive profiling with auth0: Security when communicating with auth0 actions
I currently try to implement progressive profiling with auth0 according to: https://auth0.com/blog/using-redirect-with-actions-to-gather-user-info-and-increase-conversions/ to gather first name and ...
- 101
0
votes
0
answers
81
views
IP Address 47.128.16.39 has been going through our site for more than 4 days
This IP address has been going through everything - every image, every page. How can we know who this is and whether they are doing any harm? Is this abuse? Should we report this? If yes, to whom ...
- 1
0
votes
0
answers
33
views
Do `Signature` headers have real benefits? [duplicate]
I'm working with an HTTPS API that requires me to include a Signature header, the signature is calculated as codeBase64(hmacWithSha384(key, body)). I'm wondering if it provides any real-life benefits ...
- 1
0
votes
0
answers
97
views
Optimal way to securely store password on client with server invalidation but not knowledge
A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario.
...
- 121
0
votes
0
answers
52
views
Difference between PassKeys and using touch-id to login in Apps
PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance.
I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to ...
0
votes
0
answers
48
views
ow do I move password securely between api and web?
I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
- 1
0
votes
0
answers
114
views
Refresh-token rotation without additional frontend requests
I'm implementing a refresh-token rotation mechanism. For the sake of simplicity in implementing the frontend I would like to remove the need for requesting a new access token when an old one expires.
...
- 101
1
vote
3
answers
384
views
is mTLS authentication alone considered secure for authentication
We have recently engaged an external party to undertake a pen test on a recently implemented API. The API is considered internal although it itself is on AWS and is consumed from on-prem resources, ...
- 113
0
votes
1
answer
318
views
Identifying a session hijacking attack [closed]
I understand session hijacking has been a widespread attack vector in the past months.
If an attacker steals a user’s session cookies, they can bypass 2FA and login/password.
If this is the case, how ...
- 3
0
votes
1
answer
53
views
Simplest federated authentication protocol: is this the right way to do it?
I've been struggling to find very simple, low level explanations of federated authentication protocols. Previously I've seen SAML and oauth, but they both seem to be very high level and far more ...
- 103
0
votes
1
answer
59
views
Is csrf protection required for extremely short lived cookies?
I have an app with token-based authentication (stateless).
for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie.
so I creates a cookie with my access token, ...
- 103
0
votes
1
answer
114
views
Evading authenticated diffie hellman with MITM
I understand that in a non-authenticated Diffie-Hellman setup, a man-in-the-middle attack can occur. Now i'm curious about the feasibility of the following scenario:
Let's assume a situation where www....
0
votes
1
answer
82
views
WebAuthn does not guarantee public-key integrity other than trough attestation?
I've been reading about WebAuthn and try to write some code to exercise.
One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
- 370
0
votes
0
answers
52
views
What's the best approach to storing JWTs on the client
I'm developing a web application and I want to use token based authentication, but after implementing the feature on the server side I got stuck on trying to figure out what is the best approach to ...
0
votes
0
answers
58
views
Passkeys versus passwords for intranet websites
Do passkeys offer more security for intranet websites compared to passwords?
I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
- 53
-1
votes
1
answer
77
views
PATCH request on a login attempt
I have a problem deciding what is the most secure method to send a login request with a username and password strings, I understood that PATCH is less secure than PUT while both are less secure than ...
1
vote
1
answer
327
views
Where are wifi passwords stored? [duplicate]
I'm looking for technical details on how Windows, Linux, and macOS all store the SSIDs and passwords for every wireless network you've ever connected to. I've tried searching for this, but my Google-...
- 777
0
votes
1
answer
320
views
Perfect DMZ: LDAP auth to AD
My goal is to integrate a public facing service with AD using LDAP.
While I vouch for federated approach to user authentication, the business dictates LDAP.
We run a DMZ subnet and I insist on not ...
- 281
0
votes
1
answer
91
views
Is using the computer for MFA safe?
Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer.
But what are ...
1
vote
0
answers
43
views
MS-CHAPv2 Auth protocol downgrade
I'm researching about PPP (Point to Point protocol) and it's security aspects.
While exploring PPP Authentication I've noticed possibility for security downgrade attack. Generally authentication ...
- 11
0
votes
2
answers
231
views
Most secure way to pass data from client to server?
I'm writing an authentication system and would like some suggestions on improving its security. Currently, I use RSA to communicate data between the client and the server. Here's the process:
The ...
0
votes
0
answers
32
views
Make use of encrypted or anonymous data in database [duplicate]
As an answer to the following question, I read the idea of encrypting user data with 2 keys based on random generation and the user password:
Store encrypted user data in database
But could anyone ...
- 1
0
votes
0
answers
69
views
Bearer JWT session token value
I am working on a personal project, I am now working on the authentication. My back-end is written in Python (fast-API) and I am generating a JWT bearer token that I put on my cookies for my front end....
- 101
1
vote
0
answers
49
views
Best practice of x.509 client certificates accross multiple systems
I have several MongoDB's where I use x.509 Certificates to Authenticate Clients
Let's say I create certificate and user for admin:
subject: CN=admin
issuer: CN=MongoDB Issuing CA
-> db.createUser({...
2
votes
1
answer
157
views
Should I return JWT tokens on a login route even if I am using cookies?
I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to ...
- 21