Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
23
votes
3answers
6k views

How do Travel Sentry locks work? (supposedly openable only by security agencies)

Apparently Travel Sentry locks can only be opened: by their owner, by the TSA, CATSA and "other security agencies". How do they work technically? Is there some electronics embedded with ...
0
votes
1answer
172 views

Why is it recommended to use GCP service accounts vs user accounts?

I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
0
votes
1answer
73 views

How I Could Have Hacked Any Instagram Account - The Zero Hack

I am new to the field of security. I thought a lot about the following scenario and could not come up with a good solution 1) Suppose I go to instagram forgot password page. I enter a persons mobile ...
0
votes
0answers
21 views

How can I authenticate websocket over HTTP connection? [duplicate]

I have to communicate over HTTP connection only. A WebSocket server is setup in Tomcat. A web application is also running on the server. Now, I have a scenario in which a client will login into the ...
20
votes
6answers
4k views

The most secure way to handle someone forgetting to verify their account?

Suppose we send out email verification to new subscribers that where they have to click on a link to verify their account. Suppose they forget to verify it, and later try to login. Should the error ...
0
votes
0answers
38 views

How do I create a secure authentication service which works both for web apps and mobile apps?

As far as I am aware the best way to securely store session data on a client is to use an HTTP-only, secure cookie + HTTPS on a browser and to store a (JWT) token in a secure place for a mobile app. ...
0
votes
0answers
20 views

Securing Vue App in .NET MVC page

We have a .NET MVC app which requires authentication in order to see any pages within the site. Users are directed to Azure Active Directory to authenticate and the flow returns them to the MVC app ...
2
votes
2answers
33 views

Separate Auth DB for Increased Security

I'm a dev working on an app that has a monolith DB (PostgreSQL). We are using a third party provider for AUTH and MFA, but want to move MFA back into our control. The plan was to move the encrypted ...
0
votes
1answer
91 views

How to securely share only some information with a middle-man site

Scenario: you run an app OurApp which deals with users' sensitive data, some of which you are allowed to share with third parties (with the user's consent, of course) and some of which you are not ...
0
votes
1answer
69 views

Cross sign two self signed root CA

I have two self signed root CA that was used for separate kubernetes clusters (say cluster A and B). Both CA is used to sign application certs in their respective cluster. However, one of the ...
1
vote
2answers
111 views

Can (or should) a system admin test a login before sending login info to users?

I am a low-level system administrator for a new college Learning Management System, or LMS. (An LMS is the platform used by professors to post their syllabi, lecture notes, assignments, grades, ...
1
vote
3answers
171 views

Why do web browsers provide websites with plain text passwords? [duplicate]

Suppose I sign up for website.com with username "John" and password "Secret". Currently the webbrowser supplies website.com with my real plain text password, and we must trust them to salt and hash ...
-1
votes
0answers
32 views

Is it possible to hide a domain's email provider? [on hold]

All things considered, this question could possibly be a non-issue or simply too stupid a idea to consider for an attacker when other more viable options are available. Suppose you want to use a ...
0
votes
0answers
24 views

Deeplinks in email that autologin

I was wandering if, a deeplink inside an email that auto-authentication even though the session is expired, it is GDPR compliant. For instance if I send to an user an email subscription with links to ...
1
vote
1answer
84 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
1
vote
1answer
501 views

Use Personal certificate without a key with Firefox

We have a website that authenticates the user using a certificate. The certificate is installed by the IT department and I can't export it with the private key. When I navigate the website with ...
1
vote
1answer
503 views

Amazon Elastic Load Balancer and mutual authentication

Has anyone configured AWS ELB (Elastic Load Balancer) to do mutual authentication (i.e., authenticate both the server and client), probably over TLS. We're exposing a REST API using SSH and a shared ...
0
votes
1answer
61 views

With 2-factor authentication, is a backup email address or phone a good recovery option?

A lot of sites offer 5 or 10 recovery codes as the backup mechanism if the user loses access to their primary 2FA (usually a phone number). Can we just simply use a backup email address instead, or a ...
25
votes
3answers
19k views

Why is it a bad idea to use plain oauth2 for authentication?

TL;DR: What are the security implications of using oauth2 for authentication? I'm building an app (site A) that allows users to perform operations on another website (site B) through a simpler ...
72
votes
10answers
36k views

Generic error message for wrong password or username - is this really helpful?

It is really common (and I would say it is some kind of security basic) to not show on the login page if the username or the password was wrong when a user tries to log in. One should show a generic ...
1
vote
1answer
137 views

Is Certified | Ethical Hacker (C|EH) a scam or legitimate? [on hold]

I've been doing a lot of research on Certified | Ethical Hacker (C|EH) to see if it's a credible certification. But I've stumbled across a Wikipedia article on it and discovered that the sources are ...
1
vote
1answer
85 views

How to send authentication token via SMS for a REST API

I want to call my REST API with encrypted SMS(with some intermediate server and a shared key by client and server which is transmitted via SSL), I have problem with sending requests that need ...
0
votes
1answer
556 views

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network. Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
3
votes
0answers
56 views

Comprehensive list of mechanisms that automatically send authentication information in browsers

I'm trying to come up with a list of built-in mechanisms that either automatically send authentication information or automatically prompt the user to provide them in browsers. So far I have ...
3
votes
3answers
9k views

How to troubleshoot “client certificate” related errors in 2 way HTTPS

I have a webserver which is asking for client certificate for mutual authentication. I have what I think is the right certificate loaded into my client browser. However, the browser is not able to ...
0
votes
1answer
52 views

How to identify the right hash from a list of salts and pre-given password during authentication?

I apologize for being naive, but I only recently started learning about cryptography and how to go about the security online. From what I've gathered, the safest-without-sacrificing-efficiency way ...
2
votes
2answers
160 views

How can I secure Wifi against these specific attacks?

I have found myself in a situation where I need to setup a somewhat secure Wifi network. I am primarily concerned about these attacks, however I welcome any advice about other attacks that I should be ...
1
vote
3answers
171 views

Should a logout request be authenticated?

I have implemented access tokens and refresh tokens, without an auth server (my API server also does authentication). Access tokens: stored in the client (localstorage). Expire in 20 minutes. Refresh ...
1
vote
0answers
60 views

Implementing an anonymous, password-less login model

I would like to implement a password-less login for a mobile application (discussion board/social media). The data contains non-critical social media content (usernames, posts, replies, photos). The ...
0
votes
1answer
37 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
12
votes
1answer
2k views

Can/do botnets brute force “high value” users of services like Gmail?

On an intranet a login is generally disabled after a very small number of failed logins. But a public email service like Gmail can't do the same, otherwise pranksters would just be continuously ...
0
votes
0answers
57 views

Reccomendations to become a self taught expert in cybersecurity? Are there online lessons similar to code academy for coding? [closed]

I'm mostly a nerd and computer/hackintosh hobbyist who is very interested in cybersecurity. I have no career in the IT department, but I would eventually like to build enough expertise to pry my way ...
1
vote
0answers
29 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
0
votes
1answer
81 views

Can 2FA keys be duplicated?

I want to order a 2FA key (like yubikey) online and I want to know if someone could make a duplicate of whatever key I order during shipping. I don't want to discuss if someone could access my package....
0
votes
1answer
61 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
0
votes
1answer
50 views

Does split knowledge always require an implementation of dual control?

Maybe I'm misunderstanding something here. Dual Control: Actions taken by different operators to affect a change. Split Knowledge: Information needed to affect a change is split between ...
0
votes
0answers
16 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
24
votes
6answers
4k views

Passwordless authentication - how and when to invalidate a login code [duplicate]

Our system uses passwordless login to send user a login code+link by e-mail by which they can login. We found one of our customers has a mail scanner that actually follows those links. We invalidate ...
0
votes
1answer
55 views

Ipsec: Is it possible to use both pre-shared keys and pubkeys auth methods at the same time?

So if we have a server configuration with local auth pubkeys and remove psk and at the same time for a client(initiator) a local auth psk and remote pubkey. Something like this. Server - local { ...
0
votes
0answers
23 views

Why is authentication through url/route a bad idea? [duplicate]

I was building an API that would accept a users username and password in the url, otherwise it would return a 403. I was told this is a really bad idea. Why is it a bad idea? Note that the username ...
0
votes
1answer
61 views

How to make USB drive read only and write by a password or key or certificate?

I am trying to distribute a software, a simple exe file, that can be executed directly from an USB drive. I would like to make that USB drive read only to avoid any malware infection and accidental ...
0
votes
1answer
32 views

Kerberos Authentication : Client authentication only

I am currently implementing a way to authenticate using Kerberos mechanism. Then only explanation have is "SSO using Kerberos". I know technically how works Kerberos (Keytab, SPNEGO, Token, KDC, SPN)...
1
vote
1answer
51 views

Feedback for self-signed certificates setup for custom product auth?

HW (linux) <---Eth---> Official PC (win,mac,linux) | | ----> Man-in-the-middle eavesdrop I'm looking to prevent an unauthorized party inside the ...
1
vote
3answers
102 views

Is it wise to completely rely OAuth2 for new users and not have our own login(with username and password) system

My question is: Is it fine to build applications where the user login is completely handled by OAuth2 and services like that. That way we do not have to have our own password database for the users. ...
1
vote
1answer
157 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
1
vote
2answers
4k views

RSA for authentication?

Is it possible to use RSA public and private keys to authenticate two computers (or to make sure they're both the right computers)? If so, how? Thanks!
0
votes
0answers
51 views

How to decrypt a google Authenticater OTPAuth Token? [duplicate]

I have this token, I want to know what somebody be able to tell me how Google Authenticator works, and what someone be able to get the original passphrase from below token? otpauth://hotp/Token?...
1
vote
3answers
189 views

Is it possible to truly hide content behind a paywall in a single page app?

I would like to hide certain content behind a paywall in my VueJS app. In googling around... Some tutorials recommend storing the currently logged in user in local storage. And then before showing ...
0
votes
0answers
19 views

Does the Loginizer WordPress plugin also limit XML-RPC-calls?

I learned about about XML-RPC and specifically XML-RPC in WordPress. Now, the safety of XML-RPC in WordPress this is disputed. But given, that I would like to continue using XML-RPC, in the most save ...
1
vote
1answer
157 views

What's the risk if I accidently type my password into a username field in a website? [duplicate]

On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...