Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Why are so many sites starting to use 2FA [on hold]

Two-factor authentication is just annoying, but I see more and more sites moving to it. I hate having to have my mobile at hand when I want to log in, it's stupid. Why is this becoming standard?
0
votes
1answer
20 views

How to authorize user between each step in Multi-Factor-Authentication?

Assume an authentication process that has multiple stages ( eg: username/password then OTP) How you can authorize and identify user between each steps? If JWT tokens are used, is it an option to use ...
1
vote
1answer
36 views

Who should create the keys?

I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard. Background information: There are three parts. Integrator the client which user uses it ...
0
votes
0answers
27 views

SSH AUTH : sekey vs yubikey vs ssh-keygen

I've been pondering/hacking/experimenting/using/misusing and am torn/puzzled over this for the past month or so; Which of these methods should prove themselves more secure/least susceptible to be ...
2
votes
2answers
61 views

Does TLS have any way of exposing only the URI in a SSL-SSL proxy, or BlueCoat style appliance?

I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data. Does any standard, or feature exist ...
2
votes
3answers
56 views

Is it advisable to tie different capabilities to different session tokens?

Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical ...
0
votes
0answers
16 views

Password checking implementation: delay on unsuccessful attempts [duplicate]

What would be wrong with the username/password checker where the response is instantaneous for valid attempts but a pre-built time delay (say 1 sec) is used for unsuccessful ones? It would not slow ...
0
votes
0answers
52 views

Design and implement a centralised authentication system? [closed]

I want to develop an authentication system for my web app and mobile app with same user account, also for third-party. But I don't know about centralized user managers or an authentication mechanisms ...
0
votes
0answers
88 views

Is server authentication in SSH secure enough?

Possible ways of SSH server authentication are: Server public key fingerprint verification Implicit authentication Explicit authentication In case of fingerprint verification everything runs on ...
0
votes
0answers
27 views

Secure access to MS SQL from web applications

MS SQL provides two primary authentication methods, Windows Authentication or SQL Server Authentication. Since local MS SQL accounts are problematic to maintain and monitor this option is not ...
0
votes
2answers
76 views

Is there any security reason for re-directing to the main/mobile page after login?

Scenario: User searches for something and gets a link to a sub-page on a site, proceeds to go there, but is asked to sign-up/login - they do so, only then once they are logged in, they are redirected ...
0
votes
1answer
71 views

Cookie-Based Authentication Security of Popular Websites [on hold]

Let's take Google and other popular bank websites which uses cookie. I've been working with a website using Angular which uses Laravel as an API. Data are stored in cookies which is vulnerable in ...
262
votes
2answers
25k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
0
votes
1answer
43 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
1
vote
4answers
203 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
2
votes
3answers
145 views

Password reset vs change

My webapp has "password reset" and "password change" functionality. Password "reset" is typical: user clicks "I forgot my password", enters his email, one-time link emailed there, he visits a form to ...
1
vote
0answers
35 views

OpenID Connect Web Message Response Mode and XSS

When using the web message response mode spec with OpenID Connect for silent authentication, what prevents an attacker leveraging an XSS attack from registering a "message" listener and intercepting ...
0
votes
2answers
63 views

Failure on correct credentials with the consecutive success?

The idea to "improve" security is as follows - the service will reply with a failure code even if supplied credentials are correct, but then on a second (third/whatever configured) attempt it will ...
2
votes
1answer
94 views

Is it safe to use Redis to store username and hashed passwords? [closed]

We are taking a look at using Redis for a Cache Aside pattern, and I am thinking, is it safe to store username and hashed passwords in Redis Cache? If yes, are there security issues with having a key ...
3
votes
2answers
86 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
0
votes
2answers
60 views

Will signing messages with key derived from password work better than sending password

I was wondering recently how to create secure mechanism for sending password while log in to the system. Then i had wicked thought why to send password at all. Let's imagine mechanism where client ...
1
vote
2answers
121 views

Account verification emails with links vs codes

I need to send verification emails for things like email verification password reset email change password change In the past most webapps would send an email with a clickable verification link ...
0
votes
1answer
150 views

How I Could Have Hacked Any Instagram Account - The Zero Hack

I am new to the field of security. I thought a lot about the following scenario and could not come up with a good solution 1) Suppose I go to instagram forgot password page. I enter a persons mobile ...
0
votes
0answers
24 views

How can I authenticate websocket over HTTP connection? [duplicate]

I have to communicate over HTTP connection only. A WebSocket server is setup in Tomcat. A web application is also running on the server. Now, I have a scenario in which a client will login into the ...
0
votes
0answers
71 views

How do I create a secure authentication service which works both for web apps and mobile apps?

As far as I am aware the best way to securely store session data on a client is to use an HTTP-only, secure cookie + HTTPS on a browser and to store a (JWT) token in a secure place for a mobile app. ...
0
votes
0answers
25 views

Securing Vue App in .NET MVC page

We have a .NET MVC app which requires authentication in order to see any pages within the site. Users are directed to Azure Active Directory to authenticate and the flow returns them to the MVC app ...
2
votes
2answers
48 views

Separate Auth DB for Increased Security

I'm a dev working on an app that has a monolith DB (PostgreSQL). We are using a third party provider for AUTH and MFA, but want to move MFA back into our control. The plan was to move the encrypted ...
29
votes
6answers
5k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
20
votes
7answers
5k views

Is encryption still applied if you ignore the SSL certificate warning for self-signed certs?

Would encryption still be applied on communication with devices using self-signed certificates if you ignore the warning and proceed without installing the certificate? Would you need to install it to ...
1
vote
3answers
195 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
0
votes
1answer
69 views

Deeplinks in email that autologin

I'm wondering if a deep link in an e-mail that automatically authenticate even though the session is expired is GDPR compliant. For instance if I send an e-mail to a user with links to the internal ...
1
vote
2answers
118 views

Can (or should) a system admin test a login before sending login info to users?

I am a low-level system administrator for a new college Learning Management System, or LMS. (An LMS is the platform used by professors to post their syllabi, lecture notes, assignments, grades, ...
0
votes
1answer
65 views

With 2-factor authentication, is a backup email address or phone a good recovery option?

A lot of sites offer 5 or 10 recovery codes as the backup mechanism if the user loses access to their primary 2FA (usually a phone number). Can we just simply use a backup email address instead, or a ...
1
vote
1answer
147 views

Is Certified | Ethical Hacker (C|EH) a scam or legitimate? [closed]

I've been doing a lot of research on Certified | Ethical Hacker (C|EH) to see if it's a credible certification. But I've stumbled across a Wikipedia article on it and discovered that the sources are ...
1
vote
1answer
93 views

How to send authentication token via SMS for a REST API

I want to call my REST API with encrypted SMS(with some intermediate server and a shared key by client and server which is transmitted via SSL), I have problem with sending requests that need ...
3
votes
0answers
65 views

Comprehensive list of mechanisms that automatically send authentication information in browsers

I'm trying to come up with a list of built-in mechanisms that either automatically send authentication information or automatically prompt the user to provide them in browsers. So far I have ...
0
votes
1answer
54 views

How to identify the right hash from a list of salts and pre-given password during authentication?

I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online. From what I've gathered, the safest-without-sacrificing-efficiency way ...
1
vote
0answers
68 views

Implementing an anonymous, password-less login model

I would like to implement a password-less login for a mobile application (discussion board/social media). The data contains non-critical social media content (usernames, posts, replies, photos). The ...
0
votes
1answer
46 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
0
votes
1answer
73 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
3
votes
3answers
253 views

Should a logout request be authenticated?

I have implemented access tokens and refresh tokens, without an auth server (my API server also does authentication). Access tokens: stored in the client (localstorage). Expire in 20 minutes. Refresh ...
1
vote
0answers
32 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
0
votes
1answer
85 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
2
votes
2answers
166 views

How can I secure Wifi against these specific attacks?

I have found myself in a situation where I need to setup a somewhat secure Wifi network. I am primarily concerned about these attacks, however I welcome any advice about other attacks that I should be ...
0
votes
0answers
16 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
0
votes
0answers
23 views

Why is authentication through url/route a bad idea? [duplicate]

I was building an API that would accept a users username and password in the url, otherwise it would return a 403. I was told this is a really bad idea. Why is it a bad idea? Note that the username ...
0
votes
1answer
67 views

How to make USB drive read only and write by a password or key or certificate?

I am trying to distribute a software, a simple exe file, that can be executed directly from an USB drive. I would like to make that USB drive read only to avoid any malware infection and accidental ...
24
votes
6answers
4k views

Passwordless authentication - how and when to invalidate a login code [duplicate]

Our system uses passwordless login to send user a login code+link by e-mail by which they can login. We found one of our customers has a mail scanner that actually follows those links. We invalidate ...
0
votes
1answer
36 views

Kerberos Authentication : Client authentication only

I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos". I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
1
vote
1answer
55 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...