Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
1
vote
2answers
58 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
1
vote
1answer
42 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
0answers
26 views

One-Time Password (Email or SMS) as the Only Authentication Information [duplicate]

I was wondering about the implications (mainly in terms of security) of using a random, one-time use, password sent by email or sms to authenticate users to a web application. The application would ...
0
votes
0answers
47 views

Google SMS verification codes broken on a loop - should I be concerned?

So this is a little out of the ordinary. Not sure what to make of it. I've enable 2-Step Verification on a Google account. When opening mail or other G-related services, it sends an SMS(text message) ...
1
vote
1answer
71 views

Who should create the keys?

I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard. Background information: There are three parts. Integrator the client which user uses it ...
0
votes
0answers
37 views

How to implement token based authentication for my API? [migrated]

I have a Django backend which will be served as my API endpoints. Users are identified by username and password and have some extra information and should be able to consume my same API, so I want to ...
0
votes
2answers
62 views

HTTP Basic authentication bypass [on hold]

I'm trying to bypass a basic HTTP authentication, but all the methods I have found are with dictionaries or with brute force. I want to know if I can use other techniques like SQL injection or ...
2
votes
1answer
108 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
1
vote
1answer
38 views

Authenticate Static Public Keys

How can a static ECC public key be authenticated when being shared between the client (who has just created the static ECC public key) and the CA (Certification Authority) - who will sign and send the ...
1
vote
1answer
53 views

Kerberos over http documentation

The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a Where is the Kerberos over HTTP official ...
0
votes
0answers
29 views

IAM to IAM federation vs IAM to application federation

Considering two different scenarios: Federating our IAM with individual applications, for example a single SaaS or in house development Federating our IAM with another IAM instance, for example when ...
2
votes
1answer
44 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
3
votes
1answer
62 views

Does Nextcloud installation gives passwordless access to all files by default?

I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
0
votes
1answer
97 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
0
votes
0answers
26 views

How to control access to open ports for externally authenticated users?

I have a server which provides license servers for software. Right now the ports are publicly accessible, meaning that anyone who knows the ip and port can get access to that software. These license ...
0
votes
1answer
94 views

Website online assistant asked for my password

Sorry if this isn't the right place for this.. I recently joined an online gambling website and clicked on live assist. To verify my identity they asked for my username and password. I did not give ...
0
votes
1answer
108 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
1answer
182 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
0answers
28 views

Security implications of client side authentication with a remote database

I'm developing a desktop app for use internal to my company. The app's installation file is located on our company server and therefore is only accessible to authenticated employees (under the ...
9
votes
2answers
1k views

Smartcard authentication SSH remote client

I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation: My desktop computer with smartcard has a ssh session to ...
0
votes
1answer
134 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
2
votes
1answer
230 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
1
vote
0answers
44 views

Is there any advantage in using Google's IAM on Android?

We are building a few corporate apps for field workers / front office. In most cases each user will have their own device, but there are some shared devices (for example reception). The devices are ...
0
votes
0answers
29 views

How to integrate an Oauth2 based application into a Wordpress plugin?

I'm working on a Wordpress plugin that integrates an external service. This service has an API that authenticates using OAuth 2.0. The plugin is public and can be used by anyone who has an account at ...
2
votes
4answers
860 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
0
votes
1answer
82 views

Deeplinks in email that autologin

I'm wondering if a deep link in an e-mail that automatically authenticate even though the session is expired is GDPR compliant. For instance if I send an e-mail to a user with links to the internal ...
0
votes
1answer
656 views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
3
votes
2answers
176 views

2-step authorization (using SMS) less secure than being without 2FA at all?

I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become ...
1
vote
2answers
86 views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
1
vote
1answer
76 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
72
votes
3answers
14k views

Does correcting misspelled usernames create a security risk?

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? I recently tried logging into facebook and misspelled my email. They prompted me with ...
1
vote
1answer
193 views

What's the risk if I accidently type my password into a username field in a website? [duplicate]

On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...
2
votes
1answer
138 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
1
vote
4answers
243 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
0
votes
0answers
57 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN [duplicate]

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
0
votes
0answers
34 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
5
votes
1answer
320 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
1
vote
1answer
378 views

In what cases is it ok keep a user logged in or provide auto login if an app starts?

I am wondering what the difference is between WhatsApp and my Bank application, and what considerations determine what is the right approach to handle user authentication. WhatsApp: I create my ...
4
votes
1answer
165 views

Authorize transitive communication between applications on behalf of the user

I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below. There is one main application with which the user ...
0
votes
1answer
53 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
2answers
397 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
4
votes
2answers
953 views

Using Fido U2F or similar as primary authentication method?

I've been wondering about this for a while, but couldn't find much on the web, so I hope that someone could point me in the right direction for better understanding about this topic. Would it be ...
3
votes
2answers
231 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
177
votes
4answers
308k views

What is the difference between authorized_keys and known_hosts file for SSH?

I am learning the basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
1
vote
1answer
50 views

Reasonable security measures for unvalidated “login”

Sorry, kind of a long question. I am hoping that someone smarter about InfoSec than I am will read what I'm doing and give me guidance... Background My website allows psychiatrists to track their ...
1
vote
1answer
256 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
0
votes
3answers
266 views

Is it safe to help a stranger login to gmail using my phone number?

I was assisting a man at the public library who was unable to login to his gmail account. He typed in his password and was prompted for a phone number, presumably so a code to be sent which would then ...
0
votes
3answers
1k views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
2
votes
1answer
37 views

How do you know which site credentials are sent to when signing into Oauth site in native apps?

I sometimes use these features where I can use my Google account to sign in to different service providers. For example, the Postman app lets me sign in to it using either their own user store, or ...
0
votes
1answer
61 views

authentication file sharing with qr code

I want to share a file for viewing purposes to customers. The qr code will be imprinted on the product, so the customer will be the only one with access to it. The file should not be accessible to ...