Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
0answers
14 views

Does Auth0's free account have a limit on Auth0 Guardian Usage? [on hold]

I am developing an application that uses Auth0 for authentication. I want to enable multi-factor authentication using the Guardian application. On the application page it says the following: ...
1
vote
1answer
65 views

How secure is this schema for Online Licensing System?

I'm trying to make a good licensing system without affecting user's experience and at the same to make it as secure as possible. I know it's impossible to make it 100% secure, but I would like to make ...
1
vote
0answers
27 views

Most used Linux terminal tools that take passwords as a parameter [on hold]

I am writing a tools that basically searches scripts and configurations files for hard-coded passwords. My first approach is to identify the most commonly used Linux terminal applications that can be ...
2
votes
1answer
62 views

Problems with this 2 factor authentication implementation

I'm implementing my own 2 factor authentication using SMS. We have a gift card service and the users are sent a link to their gift card. Every time they click on their link, we are verifying it's ...
0
votes
0answers
27 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
55
votes
7answers
11k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
0
votes
1answer
57 views

How does Google Authenticator interact with apps on an iPhone?

I am clear on how Google Authenticator works when logging on to a website and I am clear on that. However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
-2
votes
0answers
25 views

Cel im longer distance [on hold]

Is title celler, one images in very sometimes save me. Did know a text one How rest connect a passowrd. some things peaceful.
1
vote
1answer
30 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
0
votes
2answers
50 views

How pincodes used as an authentication mechanism?

I'm designing a login system for my mobile app where users only need to provide a pincode to authenticate into the app after they sign-up. I'm more wondering how the backend would work in such a ...
1
vote
1answer
69 views

Is it a good idea to notify a user that they signed up with a social-login account?

Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
1
vote
2answers
141 views

Why would an attacker try SMTP login many times even though it is disabled?

I recently set up an SMTP server for myself to use, and I am getting some traffic from two IP addresses and none else (though for obvious reasons I will not state the addresses here). An example ...
0
votes
0answers
13 views

Concepts in Authentication and Identity modules in ASP.NET Core 2

I am really trying to get the big picture of the Authentication and Identity modules in ASP.NET Core 2: not just how to use them (which I can and which I do) but really what exactly are the different ...
1
vote
0answers
22 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
1
vote
1answer
19 views

SOAP Web Service: Basic Auth. vs Password in xml

I am testing a SOAP web service and the service sends username and password in every request as part of the XML body over SSL. I wanted to object to that and offer Basic Auth. but could not find any ...
4
votes
3answers
133 views

Drivers license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my drivers license to verify that it matches the details on the card because ...
2
votes
2answers
127 views

Is it possible to make a login safe without a TLS certificate?

I'm using free hosting and I would like to know if there is a way to have a safe login system without a TLS certificate. All I do with this server is: POST HTTP Request with username and hashed ...
1
vote
1answer
98 views

My boss installs software using domain admin. Should I show that this is bad?

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
0
votes
1answer
68 views

How can I verify a company's identity?

I'm a web developer working on a project for a client. To keep it short, the project has company listings. These company listings are not provided by the companies themselves and instead it is just a ...
2
votes
1answer
145 views

Why are pins required on boot on devices with fingerprint readers? [duplicate]

Both my iPad and my android phone are configured to allow access via either a pin, or a fingerprint scan. However, immediately after a reboot, neither device allows a fingerprint for the first unlock; ...
1
vote
2answers
61 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
1
vote
0answers
16 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
0
votes
1answer
37 views

How to implement CN/DN certificate validation between two internal servers?

In an internal environment I have two Windows servers which both have Internal CA Signed SSL Certificates used to implement a Mutual Authentication HTTPS connection. Is it mandated that a CN/DN ...
1
vote
1answer
42 views

Implementing mutual authentication between two components on the same server

Mutual authentication between application interfaces are mandated in my place of work. We are looking to implement a vendor provided software where they are installing two "components" on a single ...
4
votes
2answers
97 views

Rate Limiting An API

I am busy developing an API for a mobile application, currently one of the endpoints require that the users username and password be POST'ed to it. What I am worried about is someone discovering that ...
2
votes
1answer
43 views

Where custom auth source code fits into the micro-segmentation, zero-trust architecture

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of ...
0
votes
0answers
29 views

How to legally verify a digital signature was validly created and used, and the audit trail was not forged

I am still learning about how exactly a digital signature is created, but I'm wondering about the process of making sure a digital signature was actually created by the end user. For example, say a ...
0
votes
2answers
45 views

Authenticated Sessions on a Desktop Application

I want to implement a login into my C++ desktop application and I'm having a hard time finding information on managing login sessions without cookies or JWT (JSON Web Token) (more on that in a bit). I ...
0
votes
1answer
21 views

Basic Auth Credentials on Mobile Device

I am testing a mobile app that makes requests to a web service. Web service has two sets of functions. Class A functions can be called before login and Class B functions can be called after login. ...
0
votes
1answer
75 views

Is It POSSIBLE to Bypass a Login with Blind SQL Injection to the Username field ONLY [closed]

Good to have you reading this, my questions are: (The title) If it is possible, can you please give me an idea of how I would do this for MSSQL because I'm not good in it? I'm trying to demonstrate ...
1
vote
1answer
64 views

Is it possible to eavesdrop the wireless data transmission without being authorized to a router?

I read in computer security book that there are three places in wireless networking where you can be attacked: wireless transmission, access points and wireless network itself. The book illustrates ...
0
votes
2answers
43 views

Is it reasonable to store HMAC secret key in memory only?

I'm building a web application using Spring Boot for the backend and Angular for the frontend and planning on using JWTs signed with HMAC-SHA256 for authentication/authorization. I've been thinking ...
1
vote
0answers
44 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
0
votes
0answers
11 views

Client certificate as a second factor [duplicate]

Client certificates get stored into the OS or browser trust store. So normally they are stored there permanently. Is it suitable to use them as a second factor for web authentication under some ...
2
votes
1answer
46 views

Is providing authentication data for other web applications unsecure?

I started to work on a company whose software engineers tried to reinvent everything. They did not use(or know) industry standarts and for authentication, they use their custom solution. Their "...
1
vote
0answers
19 views

git credential cache and store

I just noticed we can use git credential in order to cache our username and password so we do not need to do it everytime especially if it's on server as usually for me I would add ssh for local ...
0
votes
0answers
18 views

Webauthn and TLS channel binding

my understanding is that webauthn supports a variety of authentication schemes --not necessarily FIDO2/CTAP ; is that true? if so what is the api at webauthn that provides the hook? TLS channel ...
0
votes
0answers
30 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
1answer
67 views

Securing protected routes/pages with JWT

Let's imagine I have a website with a React front-end that renders two pages, one is "View Data" and the other is a welcome page with a login form. Scenario: You log in and the server accepts it and ...
0
votes
1answer
65 views

Got “Security alert” e-mail from Google about a sign-in from an unknown device I'd like to track down [closed]

I just got a horrifying e-mail from Google that led to a webpage stating that there was a "New sign-in on LG Nexus 5". I immediately scrambled to change all my passwords to protect myself because I ...
0
votes
1answer
131 views

Is telegram SMS login secure?

TL;DR: Can 1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or 2) A "telegram ...
4
votes
2answers
175 views

Windows 10 seems to load session before user log in, is it safe?

Last few days I noticed a really annoying problem with Windows 10 (not sure if it is caused by last update). After computer is turned off gracefully, on next startup it loads completely session of ...
0
votes
1answer
59 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
1
vote
1answer
49 views

How does the public key get authenticated during an ssh session

When using SSH, my private key is stored on my computer safely and my public key is given to the other party I wish to communicate with. I understand that the two keys are mathematically related, and ...
0
votes
0answers
12 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...
-1
votes
1answer
49 views

What are the flaws in this security protocol between client and server? [closed]

Here is my security protocol for the use of a service provided by server. It utilises a symmetric key: Client requests to use a service Server sends back nonce Client sends back nonce encrypted with ...
0
votes
1answer
26 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
0
votes
0answers
41 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
1
vote
1answer
55 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
0
votes
1answer
79 views

Suspicious email! “Data removal request”

Please help me. I’m really scared about this and I don’t know what to do. I’ve never gotten this kind of email and I was stupid and replied.