Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
0answers
17 views

Authentication as a service (AaaS) [on hold]

I'm looking for a service that would help me to get rid of custom API token implementation. I would like to go through all of them and compare. My shortlist is: Okta Auth0 Cognito I don't need ...
3
votes
1answer
86 views

Why OWASP considers TouchID as insecure?

As could be reviewed in 1 under Am I Vulnerable... section, OWASP page states that If the mobile app uses a feature like TouchID, it suffers from insecure authentication. The reasons for this are ...
0
votes
1answer
52 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
1
vote
1answer
54 views

MFA for multiple accounts?

We are thinking about enabling 2FA with Google Authenficator for all our services. But the only concern for me now is that users will have to have a dedicated Authenticator's account for every ...
0
votes
0answers
26 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
1
vote
1answer
65 views

CVV info for over the phone or by mail transactions

I am a newspaper circulation manager and a subscriber just informed us that we aren't allowed to ask for the CVV over the phone or by mail subscriptions. What is the correct procedure?
1
vote
0answers
36 views

Is Mobile ID secure? Certificates on SIM card (Mobile identity management)

In Switzerland Mobile ID is popular. It looks like it's international known as Mobile identity management. Mobile identity is a development of online authentication and digital signatures, where ...
0
votes
1answer
52 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
1answer
56 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
0
votes
0answers
17 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
2
votes
1answer
36 views

How do client and server authenticate random number which is sent

Both a client and a server send their random number each other in the ClientHello and ServerHello of handshake protocol of TLS. At the time, how do they authenticate the client or server which they ...
0
votes
0answers
26 views

Perform an authorized action via Postman [closed]

There's an old php website that I want to automate some tasks. Think of it as Craigslist in another country but much less sophisticated. In this website, I can send messages to users only when I am ...
3
votes
1answer
131 views

Is hashing without a salt secure for random passwords?

I'm designing an API with token authentication. I don't want to store tokens as plain text in the database, for the same reason user passwords are not stored as plain text: if the database gets ...
2
votes
0answers
43 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
2
votes
2answers
49 views

For PCI compliance, is a central Auth required for domain and non-domain security principles?

We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
0
votes
0answers
20 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...
0
votes
0answers
37 views

How to create an anonymous user account like the app Day-One does?

A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
0
votes
1answer
26 views

Authentication of AP with hidden SSID

In this post it is stated that the supplicant (entity who wants to connect) identifies the Access point by its SSID as it would do for any wireless network. This post says that a de-auth can be sent ...
-1
votes
1answer
96 views

How does this Session work (web)

It is difficult for me to fully understand this whole process. I am using express.js and express-session.js with Node. Now if someone logs in, a session is stored in the session store(server side) ...
-1
votes
0answers
30 views

Accepting old email after email update

I am testing an ecommerce website. I tried changing the email address after login. It was successful. Now I am able to login with both old and new email addresses. Is this an issue or just a bad ...
1
vote
1answer
53 views

Why should I use jwt in Refresh Token? [duplicate]

I use Refresh Token to handling expired Access Token, and in log out, I can remove Refresh Token from the database. Refresh Token must never expire (not sure) because the user can check "remember me". ...
0
votes
0answers
44 views

How to safely store JWT using React App

Currently I'm working on a React-Laravel stack application. Having already built an SPA using React and a backend in Laravel, the plan is to use the backend as a REST API to make requests from the ...
-1
votes
1answer
134 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
0
votes
0answers
65 views

What is the right way to share the digital assets to the will executor and eventually detect the person's death?

These days I brainstormed about how does one give their passwords/pin codes/etc to their will executor so that the executor can do what the person wanted after their death? For instance, how would a ...
0
votes
0answers
40 views

Google's recommendation of server-side authentication over client-side [duplicate]

I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to. One main problem I ...
1
vote
1answer
107 views

Authorization over Internet without storing user details

We have a requirement where we are creating an user generation page over internet for various vendors. This was earlier done by our operations team on intranet. For each vendor to create a unique ID ...
0
votes
0answers
61 views

Why does Instagram let me to login without confirming my email

I am designing a website with a login/signup feature. I was testing some websites to see how they handle this correctly. I confronted Instagram and see it lets me login without confirming my email ...
0
votes
1answer
49 views

Authentication System Usernames [duplicate]

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why ...
0
votes
2answers
79 views

Could Someone Use a Stolen Cookie Session ID to Bypass Htaccess Login?

I'm doing some pen testing for my place of employment. I was able to grab the session id from the browser cookies, but i still cannot get past the htaccess login. I initially thought that by setting ...
3
votes
1answer
90 views

Is there any benefit using a two-step salted hash? [closed]

Commonly when implementing authentication mechanisms that accept passwords is to add salt when hashing the password. Reading the article here: https://engineering.gosquared.com/evolution-of-password-...
0
votes
1answer
66 views

How to do authentication when FE and BE are on different domains?

We're doing authentication by sending a JWT via an httpOnly cookie. (client sends credentials, server answers with a token cookie, client attaches it to all subsequent requests). Due to some ...
0
votes
1answer
97 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
1
vote
0answers
69 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
0
votes
1answer
95 views

Rest API Authentication with JWT

This is my first time working with JWTs so I decided to ask here on Information Security as I'm very unsure about my approach towards JWT Authentication. I'm currently working on an API that will ...
2
votes
2answers
124 views

Does client have to send the CA chain along with the client certificate after ServerHello?

During the MTLS handshake, after ServerHello is done client sends the client certificate back to the server, I need to know if the client should only send the client certificate or is it required to ...
2
votes
1answer
229 views

Is there any flaw in my API-to-API authentication concept I missed?

I've been thinking lately about how all of the authentication methods used in API to API communications (RESTful API's) are mostly methods that have been designed to be human oriented first (tokens\...
1
vote
0answers
28 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
0
votes
1answer
41 views

Session invalidation for 2 browsers

I have an app with the authentication using WSO2, using the scenario below: Login to the same apps with the same credentials in 2 different browsers (Chrome and FireFox) I change my password of my ...
1
vote
3answers
131 views

Hash pepper in web application possible?

I have read a few articles and several question on here about hashing correctly. While hashing, adding salt and especially pepper is primarily a server side use case, I am interested in the ...
0
votes
1answer
51 views

Is there such a thing as an Authenticated Protocol?

I need two devices to communicate in plain sight and I want to know what to ask for. Nothing is secret so no need to encrypt. However, I need the source to be authenticated to prevent bad actors from ...
0
votes
1answer
57 views

Does FIDO2 token works as two-factor on password-less authentication?

As authentication factors, I know the following You are (e.g. Biometrics) You have (e.g. USB) You know (e.g. Password) If I use a FIDO2 certified fingerprint reader for password-less authentication ...
1
vote
3answers
93 views

Best practices to prevent logging of LDAP credentials by intermediate apps

I am working on transitioning our project management tool (PMT) to use LDAP authentication instead of native auth that's currently in use. We also have some internal web-based tools that interface ...
1
vote
0answers
12 views

Client authentication (certificate + private key) using WinInet [migrated]

I'm trying to communicate in https with a server using WinInet (from the Win32 API). Here is a very minimalist code : HINTERNET ses = InternetOpenA("test",INTERNET_OPEN_TYPE_DIRECT,NULL,NULL,0) ; ...
-1
votes
0answers
52 views

how does Google login differentiate between it's own apps and third party apps?

When you're using one of the Google apps, you enter your credentials and the app can now access all the relevant Google APIs.. When you're using a third party app and using "Login with Google", ...
3
votes
1answer
72 views

SSO level of trust external identity providers

I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
0
votes
1answer
64 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
0
votes
1answer
62 views

Two message key agreement and mutual authentication protocol?

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...
1
vote
1answer
38 views

What's the correct way to handle a failure with Client Certificate Authentication

I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?
1
vote
0answers
20 views

How to intercept AD authentication attempts [closed]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
1
vote
1answer
47 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...