Questions tagged [authentication]
the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.
4,413
questions
0
votes
1
answer
28
views
Can my local MySQL server be accessed without permission
I have hosted a MySQL database server on a vps to connect to a flask web app on the same vps. It only has users with host as local ip address. Can it be accessed by anyone else remotely, except me? If ...
0
votes
2
answers
43
views
How to reuse PIN codes in the most secure way?
I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes.
What could be a strategy for ...
0
votes
0
answers
26
views
Security concerns to proxy a SAML flow via regular HTTP basic authentication
I have an iDP, a server and a browser-based client application executing the SAML flow to get the assertion sent to the server. Communication between client and server and iDP is HTTPS. All that is ...
- 135
0
votes
0
answers
25
views
A Hybrid Authentication method. (JWT, MFA, Cookies, Sessions) [closed]
I am currently creating an app to help with retail management. As you may be able to imagine, user authentication is of great importance as the app will store all kinds of sensitive information such ...
1
vote
1
answer
71
views
Why is it a bad idea to accept passwords one character at a time for an authentication mechanism?
For the purpose of my studies, I am trying to answer the below scenario, in my opinion it is not a good idea, because it would leave the system open to brute-force attacks.
A novel password scheme is ...
- 11
1
vote
1
answer
49
views
AEAD: Authenticating a digest of my data instead the data itself
Relevant question for Python:
Stack Exchange: https://stackoverflow.com/questions/75739308/aead-authentication-with-huge-input-that-doesnt-fit-into-ram
Top Answers: https://topanswers.xyz/python?q=...
- 121
1
vote
0
answers
19
views
Is SRP/PAKE equivalent to an asymmetric crypto challenge?
As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
- 171
0
votes
3
answers
78
views
Avoid checking passwords for dos attacks
A server gets requests with a username and password. Checking the password can be expensive, so a hacker can do a DoS attack by sending lots of requests with random passwords. No attempt to break in, ...
- 2,107
0
votes
0
answers
25
views
store strings in db with asymmetric encryption for a python app keeping the data secure
I'm designing an app that receives sensitive data input from a user and that data needs to be saved securely in a database.
As far as I understand it needs asymmetric encryption but since this app has ...
- 1
0
votes
1
answer
24
views
How does Android/Firefox authenticate the Android Pocket app, for example?
I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. ...
- 619
0
votes
0
answers
80
views
Cross-domain login authentication
I am currently working as system integrator for a banking company, that asked me to provide an authentication integration on a third party website on which the company would like to redirect users, ...
- 1
0
votes
0
answers
90
views
best way to keep user logged in with cookie and jwt?
I'm making an SPA with Laravel REST API and trying to keep it stateless.
Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality.
On successful login the client ...
- 11
10
votes
2
answers
1k
views
Show if email exists and if password was incorrect on our login screen? [duplicate]
We're developing a new login screen for our system, we have a couple of million users and we're thinking about what to disclose to the user.
We currently:
Let the user know that the email or password ...
- 201
0
votes
2
answers
31
views
How does a validity check on a stylus-made signature compare to a validity check for a pen-made signature
In the old days, when signatures were used to sign cheques, there were people specialized in how to determine whether a signature came from a particular person or from a different person (forger).
...
0
votes
0
answers
62
views
bearer JWT client authentication and access token issued by authorization server
authorization server issues an access token with issuer details which are exposed in well-known api of that server. this server uses client authentication JWT token with clients configured , these JWT ...
- 101
0
votes
1
answer
97
views
Implementing secure two factor authentication with Google Authenticator?
I would like to add two factor authentication to a login screen. My understanding of the process is the following:
Generate a QR Code
Scan this Code with Google Authenticator app
Use a library to ...
- 121
1
vote
0
answers
36
views
Login with self-signed PGP/GPG cert. without security key
Is there a way I can use a PGP certificate to login on my computer, but without a smartcard? I have multiple self made certificates for document encryption and also a state issued one for legal ...
- 13
0
votes
0
answers
14
views
Details about pre-master secret [duplicate]
I was experimenting with WireShark and TLS decryption of the traffic. Every guide I've found states that I need to capture the pre-master secret generated by the client and then configure WireShark to ...
- 1
0
votes
1
answer
54
views
Google Security Cookies; Prevents cookie leak to malicious XHRs
Below is an excerpt from https://policies.google.com/technologies/cookies#security
The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a
browsing session are made by the user, and not ...
0
votes
2
answers
60
views
How would you enforce user to only connect on a given network?
How would you enforce user PC to only connect to a given network?
Answers need to be OS agnostic.
One weak solution could be to set client-side firewall rules to only allow communications with ...
- 213
0
votes
0
answers
22
views
OAuth2 - implicit flow sign-out
I'm using a service that implements OAuth2
Because of some network issues, I need to use OAuth implicit flow in a component I'm developing (I know, it's terrible - we are working on the way to ...
- 101
0
votes
0
answers
18
views
Is PIN method considered less secure when authenticating user before revealing passwords in Microsoft Edge's password manager?
When you are setting up authentication methods in Windows 11 (System settings → Account protection → Windows Hello → Manage sign-in options) you can learn that both PIN and fingerprint are recommended ...
- 3,619
1
vote
1
answer
72
views
Should I display the 2FA secret only once or it can be always available?
A logged-in user enables 2FA for his account and a QR code with the secret is displayed.
Is it correct to display the same QR code again when the user visits the 2FA settings page after some time? Or ...
- 123
0
votes
1
answer
41
views
Does this implementation of 2FA expose valid credentials?
I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be ...
- 185
0
votes
0
answers
41
views
Mifare Desfire EV2 data signing
I bought some mifare desfire ev2 cards because i needed a card that can be recognizable to everyone but that can't be cloned. So my idea was to store a private key into the card in a secure way and a ...
- 101
0
votes
2
answers
30
views
Security/Liability Concerns with Sign-In-Provider Account Merging
Assume my solution offers 5 identity providers that users can choose from
Apple
Facebook
Github
Google
Microsoft
These providers all take user identity very seriously. Is there any legitimate ...
2
votes
1
answer
98
views
Oauth: redirect uri validation [duplicate]
As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/
we should validate the redirect url at 3 points:
at time of app registration
when the auth flow ...
- 263
0
votes
0
answers
148
views
Is using the CSN of a mifare desfire EV2 safe?
From what I know, Mifare Classic cards are easy to copy/clone using a device such as a flipperzero, and it has to do with authentication using the CSN (card serial number)
However, let's say that a ...
- 1
1
vote
0
answers
32
views
Storing auth token in html
Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
- 11
1
vote
1
answer
322
views
Is it safe to send an API key in an HTTPS request? [duplicate]
Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ?
We need to send data to a 3rd party from ...
- 113
2
votes
2
answers
508
views
Oauth: native UI for internal / first party apps
We have an oauth implementation, which was chosen because of the following reasons:
session sharing across different applications
easy to reason about the security considerations as oauth is well ...
- 263
0
votes
1
answer
41
views
How WhatsApp knows that account is logged in on 1 device
Recently I was switching devices and my WhatsApp got logged out from 1st device when I logged in to 2nd device.
And I got this question on my mind
How WhatsApp knows that account is logged in on 1 ...
- 1
0
votes
0
answers
45
views
Providing encryption and password for an IOT device over gRPC
I've been breaking my head over how to do this, as it doesn't seem to fit any example I could find online.
My IOT device servers will run on the client network and may be accessed over it or over the ...
- 101
0
votes
0
answers
19
views
Need of Transaction SIGnature (TSIG) record
Can't we simply send the shared secret key along with AXFR query?
A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?
- 11
3
votes
3
answers
116
views
Can a security system detect there are multiple copies of a single-issued fob?
My building gave me a single fob. I made 3 copies of it for my family and they all opened the building entrance but not my actual apartment door, until one day the building told me they had noticed I ...
2
votes
1
answer
78
views
When signing with server public key, how do I prove server key is trustworthy?
I have a server-side app in a Docker container that communicates with my desktop client app.
I am struggling with how to ensure that the response from the server is trustworthy. I am fairly new to ...
- 33
0
votes
1
answer
46
views
Automatic Certificate Signing Request (CSR) Validation
I was wondering if there are papers or well-known algorithms to automate the validation of a Certificate Signing Request (CSR).
Suppose I have a group of trusted services where I expose a "CA ...
- 3
1
vote
1
answer
122
views
Authentication using JWT signature, without header and payload
I am evaluating JWT as authentication mechanism for an API. The idea is to use JWT as API key.
One thing I want to implement is revoking API keys. Since revoking involves a state change in my backend, ...
- 113
0
votes
2
answers
142
views
How does a single mobile banking app implement a two factor authentication? [duplicate]
Recently I had more or less the same discussion with the helpdesk of several banks; a bank has a new mobile app that allows logging in without sending an SMS and without asking a confirmation code by ...
1
vote
0
answers
52
views
How to achieve an authentication method FIPS 140-3?
I've been studying the FIPS 140-3 but I still have questions about how to determine if an authentication protocol is FIPS compliant or not:
1- Is RADIUS over EAP-TLS FIPS 140 compliant? I know that ...
- 11
3
votes
1
answer
101
views
How to design a desktop application that has access to a database via LAN?
As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
- 31
2
votes
1
answer
79
views
Determine if the client certificate comes from a smarcard in mTLS [closed]
I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
- 31
0
votes
0
answers
31
views
How to implement challenge-response authentication using PKCS11
I have been searching for a way to use challenge-response over PKCS11, is that possible? I have found that it is possible for Windows Minidriver, but all the PKCS11 challenge-response protocols are ...
- 141
2
votes
2
answers
400
views
Mutual TLS replacement
When last time I was thinking about mTLS, I came to a conclusion that this is too hard to implement but at the same time it provides high security. The reason why it's hard to implement is that it's ...
- 307
2
votes
0
answers
12
views
What datums are required for an Oauth 1.0 replay attack?
I am working with some software where the vendor creates log files on exception. The files include a number of Oauth fields, and the vendor claims this is not a security risk. The Oauth fields ...
- 121
1
vote
1
answer
43
views
How can I share web-platform credentials across multiple desktop apps on Windows?
I have two desktop apps, each authenticate against our server using OIDC in order to call our web api. Currently the users need to login independently in each application.
I noticed when using ...
- 113
1
vote
1
answer
190
views
How to interpret a Google "Someone is trying to sign in to your account from another device" message?
I received this message on my Pixel 4a phone yesterday evening:
I pressed "No, it's not me" and then saw this message:
I was at home with cat and five year old son. I was cooking and son ...
- 1,609
0
votes
1
answer
143
views
OAuth2: Is PKCE required if the callback is located in the backend?
This is the architecture I want to follow
Source:
https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization
I'm using a backend to ...
- 103
0
votes
0
answers
41
views
Auto-login to account with PII using a random URL
I have a booking system where passengers need to add information that is quite sensitive (passport details etc). When they book, I generate a (difficult to crack) reference number, which they use to ...
- 101
1
vote
2
answers
114
views
How can Alice ping and authenticate Bob without any of them sharing their public keyes beforehand
Both hosts have just their public and private key pair (but they do not have the other party’s public key).
Bob should be authenticated
Assume that the two hosts share clocks that are synced, i.e ...
user285662