Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
-1
votes
1answer
15 views

Social Engineering or Broken Authentication

If I go to a cybercafe and use one of the shared computers, and use a social media application, which deletes session IDs when the browser is closed. A clever person comes, who knows about the ...
6
votes
2answers
1k views

If hashing should occur server-side, how do you protect the plaintext in transit?

I've been working on a full stack project recently for my own amusement and would like to add authentication services to this project, but want to make sure I'm doing it the right way. And before ...
0
votes
2answers
49 views

Best practice for authenticating resend email requests

I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database. In my service, upon signing up/resetting a password, the user will be redirected to ...
1
vote
3answers
62 views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
0
votes
2answers
73 views

My passwordless authentication approach

I implemented a passwordless authentication with a good UX in mind. But I am not a security expert so I am asking for your advice. This is the authentication flow: User types in email address client ...
2
votes
0answers
75 views

The Other Side of CAPTCHA [closed]

CAPTCHA stands for "Completely Automated Public Turing Test to Tell Computers and Humans Apart", but we only consider one half of it i.e. a test to separate genuine humans from bots. Can a ...
0
votes
0answers
30 views

Registration process by OAuth2

I have been analyzing the security process in 3gpp specs (pg 11) and the registration process in the spec explained with that flow. The flow represents the registration of a client to the server.. I ...
-1
votes
0answers
32 views

Error 403 Permission Denied [closed]

I'm trying to hide a page in a website, so I made every request to this specific page return "403 Permission Denied". How can someone pass this defense?
0
votes
0answers
47 views

Why Api_Key and Api_Secret based auth for bots? [closed]

While user accounts are still username and password-based, why are Twitter/Discord bots authenticated using only api key and secret, which is based on private key signature-based authentication?
10
votes
7answers
3k views

Does client side hashing reduce insider risk?

One of the companies I worked for used client-side hashing to minimize risk when logging the password in the server logs. Can this be a good reason to implement client-side hashing?
31
votes
7answers
7k views

How can we eliminate passwords given the problems with biometric authentication?

I've read articles suggesting that passwords will eventually go the way of the dinosaur only to be replaced by biometrics, PINs, and other methods of authentication. This piece claims that Microsoft, ...
2
votes
2answers
109 views

Is autologin dangerous? (Debian/Linux)

If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin: /etc/lightdm/lightdm.conf [Seat:*] autologin-...
0
votes
0answers
25 views

Choosing oauth flow-type for on-prem installations

So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
1
vote
0answers
57 views

How to implement a web login using a public/private key pair?

I am trying to create a web form, where the user can login without creating/entering a password. Assume the following pre-requisites are met: The user and server have pre-generated a public/private ...
2
votes
1answer
76 views

Why don't fingerprint authentication systems don't store 'hashes'? [duplicate]

Usual password authentication systems do not store passwords directly on the server, but only hashes of those passwords. Why do fingerprint authentication systems not offer this possibility?
0
votes
0answers
32 views

Authenticating Adobe .pdf electronic signatures

Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
0
votes
1answer
27 views

Does a password-derived public key authentication improve security over pure password-based authentication?

Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of ...
35
votes
6answers
5k views

What is the suggested best practice for changing a user's email address?

I recently jumped onto the hypetrain for an unnamed email service and am currently on my way to update all my accounts on various websites to get most of my (future) data off Google's Gmail. During ...
2
votes
1answer
32 views

How to design a single-request, non-CA-based custom server-to-server authentication method?

We have a series of services exposed as web servers. Potentially, every web app could contact and be contacted by any other one. I want to secure the communications between the applications, which ...
2
votes
1answer
99 views

Authenticate limited client devices from server without login process

I have limited client devices and one server. I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or ...
0
votes
0answers
24 views

NFC Ultralight C - design an authentication system (can it be clone protected?)

I am trying to design an authentication system that will be based on NFC Ultralight C cards. Key concept in my system is that the card identifies a specific person, but this concept can be easily ...
0
votes
0answers
37 views

Understanding TS 133 501 (5G) Step 2 of EAP-AKA'

I got a question dealing with the EAP-AKA' used in 5G to authenticate clients coming from a 3GPP-Network. I read the latest specification on ETSI. The problem which I have is based on Step 2 on Page ...
0
votes
0answers
18 views

How do I implement a token based authentication system in a mesh network?

In this i would like to build a token based system where the MAP(mesh access point) generates a token for verified client and that token can be used for seamless handoff when the client travels from ...
0
votes
2answers
81 views

How do I write my own authentication protocol and add that to OpenWrt? [closed]

I would like to add a ticket based authentication mechanism to my network. Can you give me brief idea where do I start, which language should i write the protocol in and how do i get those in my ...
-1
votes
1answer
68 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
2
votes
4answers
167 views

Passing plain text password over HTTPS

My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
1
vote
1answer
51 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
0
votes
1answer
66 views

Is it less secure to force periodic user logouts vs keep them logged in?

I've been unable to find any research or information on this. Google periodically signs me out and forces me to sign back in. I have multiple devices and multiple google accounts so it's a bit ...
1
vote
1answer
56 views

How exploitable is a none JWT?

A recent penetration test has discovered that my org is using the JWT authentication scheme that allows the 'none' algorithm. How exploitable is this in the real world? I understand that the issue can ...
1
vote
1answer
84 views

Is it OK to store the user's plain-text password in a claim?

For customer reasons, my web app authenticates the user against a proprietary user database using a simple API like bool authenticate(string username, string password) In case the user changes his ...
25
votes
2answers
9k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
2
votes
2answers
45 views

how to deal with with authentication tokens in the client browser and in my database?

I am building an asp .net mvc project and I want to save the user who is currently logged in , So I read about sessions and cookies and I found that authentication tokens stored in a cookies are a ...
2
votes
1answer
98 views

Understanding Secure Boot

I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around. At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
1
vote
0answers
57 views

Secured data upload to Aircraft over ARINC 615A

We have a requirement for Data loading function to Aircraft. There is Avionics standard termed as ARINC 615A and ARINC 665. 615A specifies high speed Ethernet based data load operation; where POINT-TO-...
1
vote
1answer
46 views

What are the logical steps taken to perform ssh key authentication?

I understand the logical steps of asymmetric key cryptography as it relates to TLS, however, I've started using Git and in a bid to avoid having to use a password for authentication, I've set up ssh ...
0
votes
1answer
59 views

MacOS able to access data without password

On a Mac, one can go into recovery mode by turning off the Mac and clicking Command R while turning it on. Then, by typing resetpassword into Terminal, one is able to reset the password without ...
3
votes
2answers
246 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
0
votes
0answers
35 views

Security concern on locally stored authentication token

It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device. This is to strike a balance ...
0
votes
0answers
6 views

krbtgt password expiration policy [migrated]

I am asking about krbtgt password in Active directory which is used to encrypt tickets issued by KDC,what i know is that this krbtgt account has a security issue that it's password is rarely changed. ...
0
votes
1answer
74 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
1
vote
0answers
44 views

Automating SAML login for service users?

Is it possible to fully automate the login of a service user (i.e. a programmatic, software based "user") without user interaction? I have a service provider that's SAML protected. Basic Auth and ...
2
votes
0answers
117 views

How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?

My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
0
votes
2answers
74 views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
2
votes
1answer
32 views

Is an LDAP injection possible for a basic search query?

I'm trying to secure a login endpoint by attempting to bypass the login that uses LDAP. It employs a search query of "cn=" + username + ", dc=example, dc=com" with a filter of "(objectClass=*)". Is ...
8
votes
3answers
209 views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
1
vote
2answers
71 views

Replay Safe Mutual Authentication (libsodium)

I am working on an end-to-end encrypted messaging application as an educational activity with some of my extra time. I have chosen to use libsodium for the underlying crypto. I have run into a hang-up ...
0
votes
1answer
51 views

Why would a software need my IP address in authentication token?

I was looking at the authentication token used in my network requests to a software that we use at work. I noticed that this is not a general JWT OAuth token but some XML based token. I guess, old way ...
0
votes
1answer
35 views

Same session cookies for a user logging from different browser/machine

I am new to web application security and have a few doubts regarding session cookies. Which of these is considered more vulnerable: Having the same session cookies for a user logging in from ...
2
votes
1answer
86 views

Explaining a bad approach - not comparing hashes

Today I saw a snippet a code for authentication logic : function checkPass($pass, $login){ $inputedPass = $pass; $req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
1
vote
2answers
62 views

What is the benefit of public Certificate Authority when using SSL mutual authentication?

I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct. In terms of SSL Mutual Authentication a self signed CA and a public CA ...

1
2 3 4 5
79