Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

2
votes
1answer
88 views

How could ASP.NET forms authentication session leak into a different site?

We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur Steps: Login to ...
6
votes
3answers
977 views

How secure is E-Z Pass?

E-Z Pass is an American company that allows people to electronically pay tolls without having to carry change or come to a stop at toll booths. Instead, you have a device that you attach to the inside ...
-2
votes
0answers
51 views

How to secure apis so that it can be used by my app and web only

I am creating a platform which is based on REST APIs. My platform has apps and web both. I don't want to make my APIs public and want that my APIs can be used by my own clients (app and web) only. I ...
2
votes
1answer
28 views

Is it possible to setup 1-way TLS client authentication without server certificates?

Is it possible with TLS to only authenticate the client? In other words can one-way TLS be setup in such a way that only the host initiating the connection uses a client certificate and the second ...
37
votes
1answer
51k views

How do NFC tags prevent copying?

Ten years ago, we opened our building's front door with a badge. Five years ago we paid public transports with an RFID card. Today we pay for our bread with the same system and tomorrow we would ...
41
votes
1answer
79k views

Why does HTTP Basic authentication encode the username and password with base64?

RFC 2617 requires that in HTTP Basic authentication, the username and password must be encoded with base64. To receive authorization, the client sends the userid and password, separated by a ...
2
votes
2answers
146 views

Rest API Authentication with JWT

This is my first time working with JWTs so I decided to ask here on Information Security as I'm very unsure about my approach towards JWT Authentication. I'm currently working on an API that will ...
15
votes
2answers
5k views

Possibility of faking someone's public key

I know how public key cryptography works; (very) simplified: Alice takes Bob's public key and sends an encrypted message with said key and sends it to Bob. Bob and only Bob can decrypt the message, ...
0
votes
0answers
4 views

Strongswan eap-identity no trusted certificate [migrated]

Here is the situation : GW installed on CentOS7 with Strongswan 5.7.2 with these plugins loaded : charon pkcs11 tpm aesni aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation ...
2
votes
2answers
282 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
42
votes
5answers
42k views

How to achieve non-repudiation?

If I have a message that I need to send to another person, how do I achieve non repudiation ? Is digitally signing the message sufficient ?
0
votes
0answers
25 views

OpenId Connect Authorization Code Flow in Microservice Scenario (API-Gateway?)

Im building a SPA with a couple of backend-microservices and i want to authenticate using OIdC. I'm aware of the fact that the implicit flow is not recommended anymore for this. So the recommended ...
8
votes
2answers
10k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
4
votes
2answers
5k views

Authentication vs. Verification in General and with Biometrics

I am reading The Basics of Information Security, 2nd. Ed., Andress, Jason. He says on p.25, "Identity verification is a step beyond identification, but it is still a step short of authentication, ...
1
vote
1answer
44 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
22
votes
2answers
5k views

If the Charles SSL Proxy shows me sensitive data, is that data insecure/exposed?

Today I was exploring a website used for keeping track of student grades and everything related to school. Basically like a school progress tracker for your child which is used by 90% of schools in my ...
0
votes
1answer
72 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
0
votes
0answers
37 views

EAP-TLS with NPS

I am trying to authenticate devices onto Wi-Fi using EAP-TLS against NPS. My PKI and NPS are all part of the same domain but my clients (devices) are on various domains. In my head this should be ...
-1
votes
0answers
23 views

Biometrics Authentication Open Source Projects [closed]

I am trying to get involved with the Biometric Authentication community but I seem to be having difficulties finding where exactly it congregates. I understand things may still be fragmented between ...
2
votes
2answers
44 views

What prevents an identity provider from falsifying authorization in a SAML 2.0 flow?

I'm confused about something in the SAML 2.0 flow. When the initial access to the service provider is made, the service provider must first validate that the user indeed has access and so the service ...
3
votes
1answer
779 views

Does TrustManager PKIX (or RFC 3280/X.509) really check the expiration date of a client's certificate?

It was noticed that the default java implementation of TrustManagerFactory for PKIX trust manager algorithm (X509ExtendedTrustManager) doesn't really check the expiration date of a client's ...
0
votes
1answer
82 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
1answer
73 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
1answer
109 views

Is it safe to store the token expiration time in local storage?

I understand why one shouldn't store the contents of the JWT token client-side but what about just storing the token expiration time? I'm using the auth0 authentication service in my app and I'd like ...
1
vote
0answers
46 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
4
votes
2answers
1k views

Is SSH secure against MiTM if server fingerprint is not checked, public key authentication is used and confidentiality is not needed for that service?

When connecting to a server for the first time, ssh usually requires users to check server's fingerprint and then caches the info. This is needed in order to prevent MiTM. Is it a design flaw in SSH ...
0
votes
0answers
78 views

Secure Http Connection With Authentication Header

I am trying to create an authentication header algorithm that can be used for authentication on HTTP server. Not sure it is good but it seems OK to me. I also used similar approaches for previous WS ...
2
votes
0answers
48 views

Does not using CAS when it's availible encourage phishing?

My (U.S., R1) academic institution uses CAS (Central Authentication Service) to authenticate almost all our web services. However, they don't use CAS for our GitHub Enterprise instance. Instead they ...
1
vote
2answers
7k views

How can I avoid sending passwords in plain text when logging into a website?

Suppose that I login to a website. When I type my personal data, aka, password and email, the password is sent in clear text to the server, correct? Then, a network card in promiscuous mode can ...
0
votes
1answer
66 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
130
votes
10answers
256k views

Where can I find good dictionaries for dictionary attacks?

I’m wondering where I can find good collections of dictionaries which can be used for dictionary attacks? I've found some through Google, but I’m interested in hearing about where you get your ...
2
votes
2answers
1k views

How safe is Two Factor Authentication (TOTP)?

If someone gets my phone and saves the values my authenticator generates, will that person be able to find out the shared key (to be used to generate codes themselves)? If so, how many codes will ...
1
vote
1answer
175 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
6
votes
4answers
2k views

Best practices for usefully storing two factor authentication backup codes?

For a lot of web services offering two factor authentication, after setting up the system, you are given a short list of backup codes (one-time pads) that are around 7-10 characters long. These are ...
0
votes
3answers
69 views

Why is passing a token for each API request more secure than passing a username and secret for each API request?

I guess this could also be phrased as JWT vs. Basic Auth, similar idea? Passing a token for each API request seems to be the more common and recommended approach, and I have the gut feeling that it ...
1
vote
1answer
68 views

how wifi web authentication works?

Some wifi are open networks, but when we connect, it redirects to a web page for authentication. How does this work? how the future packets will be authenticated? Does it bind IP and MAC address (...
0
votes
1answer
387 views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
0
votes
1answer
36 views

Safe to consider webapp user's email as implicitly confirmed after a password reset?

In my system, a new user must confirm his email. But there is an edge case: he registers does not confirm forgets password, performs password reset (which involves a mail loop) At that point I know ...
21
votes
2answers
8k views

Why is it always `HASH( salt + password )` that we recommend?

Browsing over this site, many forums, online articles, there's always one specific way we're suggesting to store a password hash: function (salt, pass) { return ( StrongHash(salt + pass) ) } But ...
5
votes
3answers
3k views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
-1
votes
2answers
87 views

is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?

My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and ...
1
vote
1answer
59 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
2
votes
1answer
104 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
0
votes
1answer
43 views

Preventing account enumeration with 2FA

What are some methods for preventing account enumeration on login when accounts have optional two factor authentication? Without two factor authentication we would just return the same response for ...
0
votes
0answers
24 views

EAP-TLS : implementation and testing of a communication between two processes

I'm trying to make a simple EAP-TLS communication between two processes and capture it with Wireshark. Is there any library that can be used? (like mbedtls in the TLS case). I have found a lot of ...
1
vote
1answer
2k views

OWASP ZAP bruteforce by password not username

I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like: user001:...
5
votes
1answer
274 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
0
votes
0answers
22 views

is there an alternative way to automate the process of adding lookup attributes, when integrating cyberark with Rapid7 InsightVM? [closed]

CyberArk integration with Rapid7 enables Rapid7 easily to run credentialed sans and dynamically assign credentials for authentication for multiples assets. Looking up credentials in the CyberArk Vault ...
1
vote
1answer
65 views

Websocket Authentication at Opening Handshake Sufficient?

Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header. Suppose the websocket ...
3
votes
1answer
100 views

Is there a security benefit to requiring a login before and after a captcha test?

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha. I've been trying to ...