Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
2answers
23 views

Strength of key pair

I'm trying to find a basis for comparing key pair based authentication with password based authentication, and their relative resistance to guessing / brute force attacks. I appreciate that a user-...
0
votes
0answers
20 views

What oauth grant type should I use after social sign in

I have an application which has its own oauth microservice to issue access tokens. The flow runs as below: User enters username and password to register, which makes api call to user-microservice ...
1
vote
1answer
26 views

Mobile application authentication using UUID

I write back-end code for mobile applications. I am needing to write the code for authentication and the simplest yet secure solution I can think of is: When user signs in, device sends username and ...
0
votes
1answer
35 views

Using AES encryption to generate MAC (and provide authentication/integrity)

Ignoring that there are far better and more standard approaches to providing authentication and integrity guarantees, what (if any) weaknesses would a system as outlined below that relies on AES (AES/...
2
votes
2answers
67 views

Bypassing rate limit on home router

I'm studying Info Security and was poking around my home router (it's a cheap one) with a python script trying to brute force the admin password for the web interface (it uses HTTP basic and the ...
0
votes
0answers
3 views

Automatic authentication in desktop browser with WebAuthn [migrated]

At the Google I/O '18 a demo was shown in which a user authenticates at PayPal by just providing a fingerprint (see YouTube 24:40). This was done in a browser running on a Smartphone which has a ...
5
votes
3answers
252 views

Should I delete SMS messages containing one-time passwords?

I have had one-time passwords sent to my phone via SMS. Those one-time passwords include those for 2FA and the occasional password reset. Should I delete those SMS messages after the one-time ...
1
vote
1answer
47 views

What is the safest method to send authentication data to API?

I use Vue.js on frontend and GoLang on backend. With Vue I'm sending AJAX request with credentials for sign in/sign up. Should I use HTTP Basic Auth, or just send them in request body? In case you are ...
1
vote
1answer
56 views

Risks of building an API without authentication?

I'm planning to build an API for my project, and thinking about authentication. What is the risk of not having any authentication? Could someone 'crawl' all of my post/get routes? And how would they ...
0
votes
0answers
12 views

Where to start to develop a Secure Information Architecture for a mock up

this is my first question, so please don't be rude. For a thesis I'm asked to develop a Secure Information Architecture for a Bank. Mainly I have to concentrate on authentication system. I have to ...
0
votes
2answers
39 views

Can a static IP address be a trusted user identifier in a secure environment?

Would it be an acceptable practice, if we were to register a client (individual or company) by associating them with their static IP address to perform some secure action that only authorized clients ...
1
vote
0answers
40 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
29
votes
4answers
3k views

How should I verify a caller is from the bank or company they claim? [duplicate]

I often get telephone calls from my personal bank, mortgage provider or utility companies. In most cases they start by asking me to verify my identity through the usual name/address/date of birth or ...
1
vote
1answer
43 views

Authenticate user based on mobile device identifier

I have a hypothetical mobile game where players don't necessarily need to create accounts to play. Their data is keyed off of a device identifier like an advertising identifier (IDFA) or Apple's ...
0
votes
1answer
36 views

Is there a way to secure an API key on iOS?

When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
0
votes
0answers
16 views

Anonymous login for a web browser client

I have inherited a simple single page web app. Users do not log in - once they have the URL they can browse the (very simple) app. The app communicates with a Java API. Just some background: the app ...
0
votes
1answer
86 views

Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

There are a number of users in the business who are required to perform administrative tasks on machines, not least the IT Service Desk, also Devs etc. The only requirement for administrative access ...
-2
votes
0answers
62 views

LEGALIZED BLACMAIL [closed]

What can be done about these new "information services" that now carry an arbitrary "Reputation Score". Not only do they "sell" incorrect information to each other, now they come up with a "...
2
votes
1answer
91 views
+50

Configuration for Windows account mapped to IIS certificate authorization

I need to connect two servers in different locations in order for one of them (Linux stack) issues HTTP periodic requests to the other (Windows stack) using cron based jobs. On the Windows machine, I ...
0
votes
1answer
19 views

Mutual Auth and other protocols

I’ve implemented mutual TLS for web applications. But can you do mutual tls, specifically for auth for other protocols and services? Services like RDP (windows client) SSH MySQL Workbench oracle ...
1
vote
0answers
24 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
2
votes
3answers
102 views

PHP - Needing help to encrypt/hash a password for small application

I have created a small script for work. It's an internal web script but has to be hosted on our public domain so I have created a very small PHP based login system using a login form and a session ...
0
votes
2answers
57 views

Certificate Authentication from untrusted IP address

When I launch my Windows, certificate revocation checks are performed. These occur once when explorer.exe is launched then periodically, every 40 minutes approximately, to 5 IPs. Most of these target ...
1
vote
2answers
141 views

Why bother with certain types of 2fa if they can be easily bypassed?

In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own ...
1
vote
4answers
124 views

Methods for storing plaintext passwords on a client

I have been tasked with some backend automation that needs to scrape data off an internal website using an employee's username/password to log in to the site. There is a backend database server, but ...
0
votes
1answer
47 views

Client certificate common name? Subject alternative name?

For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
2
votes
0answers
32 views

when should i use HMAC-based JWT?

I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...
0
votes
1answer
51 views

Secure custom API [duplicate]

I create desktop client for one e-shop and this client will use some functions using e-shop's API, like: GetOrders UpdateOrder SetOrder etc... I'm creating custom authentication for that client, but ...
2
votes
1answer
61 views

Can a domain name be trusted?

I'm in need of some distributed processing, the cheapest way for me to get that processing power is renting some dedicated servers from a company with specialized hardware for this. The servers that ...
0
votes
3answers
66 views

When should TouchID/Fingerprint log-in expire?

I couldn't find such a standard which mention about TouchID or fingerprint log in expiration date. Suppose I have an application and allow users to log in using the fingerprint. I would like to know ...
-1
votes
0answers
22 views

How do TOTP from 2FA work? [duplicate]

Lets take the Google Authenticator App for instance. I access a site I've secured with this 2FA and supply it the code from the App and am logged in. My phone is in Airplane mode and WiFi is turned ...
0
votes
0answers
26 views

Best techniques for periodically creating very secured but easy to remember passwords [duplicate]

I need recommendations on techniques to creating highly secured, yet very easy to remember passwords. I need to create multiple passwords for personal accounts which must change periodically (every ...
-1
votes
0answers
56 views

What vulnerability is exploited for Cosmos Bank's server hack?

What vulnerability is exploited for Cosmos Bank's server hack? Bank seems to be have high security standard for their networks. So what was the loop hole that exploited by hackers. What are the ...
5
votes
2answers
132 views

Is it possible to use drawing or scribbling as a way of authentication?

There is a service called https://www.typingdna.com/ which authenticates users based on their typing habits and it works pretty well but it still requires a password. In order to try and replace the ...
0
votes
1answer
59 views

Should client have access to 3rd party API access token?

I'm trying to determine whether to use a Token provided by a Third Party service directly, OR issue my own custom Token and store the Third Party Token server side. Authentication flow User ...
2
votes
4answers
83 views

What are some existing or ideas where the use of a password can be replaced to login to a service?

The password has been a method of authentication for a long time now and we always hear of breaches happening where users passwords get stolen and sometimes are not even hashed at all or correctly. ...
1
vote
1answer
35 views

Obtain NetNTLM/NTLM hash or login

In one CTF, I encountered a task that is solved by getting NetNTLM \ NTLM or just getting username. Tell me, please, is there any protocol that automatically sends NetNTLM / NTLM or username, when ...
2
votes
1answer
81 views

What to do if a user loses access to his authenticator code?

I have a web service that I set up which allows users to protect their accounts via two factor authentication via an authenticator app like Google Authenticator and Authy. When enabling it, I mention ...
2
votes
0answers
27 views

What is the value of multi-page login forms? [duplicate]

Various sites use a multi-page login. On the first page the user is chosen (i.e. email address), and on the second page, a password is given. Many banks use it, Google has this also. I first ...
0
votes
0answers
24 views

Are REST Authentication schemes that expose shared key protected against reverse proxies acting as bad user agents?

Recently a situation arose where a client wants a public API that doesn't require registration or login by the user (no password). The security team has identified that the server-side API needs to ...
2
votes
1answer
58 views

Is the same key used for Authorization and Encryption? (SSH Tunnel)

I am a bit confused on how SSH encryption works. From reading this question, I see you can use a private key to authenticate with the -i flag. I also know think that SSH encrypts data using ...
1
vote
1answer
45 views

Is RIPv2 MD5 authentication insecure?

While performing a vulnerability assessment, I stumbled upon RIPv1 poisoning routing table attacks. The recommendation is to use RIPv2 with MD5 authentication. The idea is that the routes need to be ...
0
votes
0answers
25 views

How to protect against rogue malicious applications in the Azure AD?

Consider the following hypothetical scenario: I create the PhotoApp - native Android application that is used by users to manage their private photos. I create the PhotoService - Web API that is ...
0
votes
1answer
54 views

Name of authentication where TV shows you code to enter on website?

I can't find any good resources about how this kind of authentication scheme works where you open an app on your TV (Plex, Youtube,...) and they show you a code (optional there's also a QR code) and ...
1
vote
1answer
21 views

How is AWS App Identity verified

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
0
votes
1answer
50 views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
0
votes
2answers
91 views

Can a hacker compromise the system if he can steal one of the factors of the 2FA?

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack: They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think ...
1
vote
2answers
38 views

Automatic push on commit (on bitbucket repository)

I have a website which commits to a git local repository all the changes done. I need to automatically push them directly from the web server to a remote Bitbucket repository. The authentication ...
1
vote
0answers
60 views

How to make sure your API key cannot just be copied and used

One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
0
votes
0answers
24 views

difference between res.header(x-auth, JWTtoken) and res.cookies(JWTtoken)?

I have seen across all blogs and articles is that there is two ways to handle JWTtokens, put them inside localStorage which subjected for XSS attack or put them inside Cookies and set httpOnly and ...