Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
35
votes
7answers
16k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems ...
0
votes
0answers
18 views

Does Corporate Outlook Webmail Provide Rate Limiting of Login Attempts? [on hold]

My company provides a corporate Outlook webmail access similar to this one, and our employees login thru the Outlook webmail regularly when they're working in the field. Recently, a co-worker in my ...
1
vote
1answer
190 views

Kerberos composite authentication that reflects user's origin

I'm experimenting with Kerberos and was wondering if some sort of composite authentication that identifies both a user and the origin of the users request was a) possible and b) implemented anywhere....
0
votes
3answers
171 views

Is it safe to help a stranger login to gmail using my phone number?

I was assisting a man at the public library who was unable to login to his gmail account. He typed in his password and was prompted for a phone number, presumably so a code to be sent which would then ...
0
votes
0answers
41 views

OAuth access token/API key patterns for large web sites

First off, let me preface this post by saying I'm not a security expert. I'm trying to build regular expressions to find OAuth 2.0 access tokens and API Keys for common web sites such as Google, ...
1
vote
0answers
18 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
0
votes
1answer
40 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
0
votes
2answers
60 views

Is a web app vulnerable if it only uses session token in cookie to authenticate a user

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...
0
votes
0answers
40 views

Is it possible to crack a CRC value for short text validation when someone tries to change a readable text?

I'd like to validate message texts with CRC-8/16/32 but I'm afraid that they could be changed to another one (for example, adding a "No" at the beginning). There will be no special characters besides ...
263
votes
3answers
26k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
8
votes
2answers
5k views

How does a server validate the Certificate Verify message in SSL/TLS?

Client authentication may be used in a SSL/TLS negotiation. For this, the client will send a Certificate Verify Message after the server requested it. The Certificate Verify Message contains the ...
1
vote
2answers
648 views

When is it okay not to use anti-forgery token in login page?

In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page: When is it OK to leave off the anti-forgery token? In general, if ...
0
votes
2answers
52 views

How to authorize user between each step in Multi-Factor-Authentication?

Assume an authentication process that has multiple stages ( eg: username/password then OTP) How you can authorize and identify user between each steps? If JWT tokens are used, is it an option to use ...
-1
votes
0answers
70 views

Why are so many sites starting to use 2FA [on hold]

Two-factor authentication is just annoying, but I see more and more sites moving to it. I hate having to have my mobile at hand when I want to log in, it's stupid. Why is this becoming standard?
1
vote
1answer
46 views

Who should create the keys?

I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard. Background information: There are three parts. Integrator the client which user uses it ...
0
votes
1answer
70 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
0
votes
1answer
67 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
1
vote
1answer
116 views

Is there any system that can authenticate my device to open only select apps on it?

I am looking to have an authentication system with which I can link a device to an employee, and then put in place certain privileges so that the employee is only able to open select apps on only that ...
0
votes
2answers
231 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
2
votes
2answers
64 views

Does TLS have any way of exposing only the URI in a SSL-SSL proxy, or BlueCoat style appliance?

I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data. Does any standard, or feature exist ...
1
vote
1answer
142 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
3answers
3k views

Two-factor authentication Without Mobile Phone

Two-factor authentication is based on the notion of “something you know” and “something you have”. Is it absolutely necessary for having your mobile phone involved in two-factor authentication, which ...
1
vote
3answers
362 views

Two factor authentication(Mobile)

Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
55
votes
9answers
50k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
4
votes
1answer
1k views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
4
votes
1answer
1k views

what is a valid challenge for 2 factor authentication?

When designing a password reset process: Is an email address or an assigned username a valid piece of information (identifier) to ask for in two factor authentication? How does two factor ...
5
votes
3answers
2k views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
3
votes
4answers
841 views

Multi-Single-Factor vs. Multi-Factor Authentication

I was told at university that there exists a difference between the terms Multi Single Factor and Multi-Factor: Multiple single-factor-authenticator are presented to a verifier. Each of them will ...
30
votes
4answers
4k views

How is “something you have” typically defined for “two-factor” authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
0
votes
0answers
33 views

SSH AUTH : sekey vs yubikey vs ssh-keygen

I've been pondering/hacking/experimenting/using/misusing and am torn/puzzled over this for the past month or so; Which of these methods should prove themselves more secure/least susceptible to be ...
2
votes
3answers
58 views

Is it advisable to tie different capabilities to different session tokens?

Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical ...
0
votes
1answer
48 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
19
votes
3answers
14k views

Do readers for the “Mifare DESFire EV1” smartcard really need to know the card's secret key in order to authenticate the card?

I'm trying to understand the security of a contactless smartcard system, used for access control and payment. The card is a Mifare DESFire EV1 implementing ISO 14443 (see the this documentation ...
2
votes
1answer
66 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
0
votes
0answers
16 views

Password checking implementation: delay on unsuccessful attempts [duplicate]

What would be wrong with the username/password checker where the response is instantaneous for valid attempts but a pre-built time delay (say 1 sec) is used for unsuccessful ones? It would not slow ...
9
votes
3answers
790 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it a ...
1
vote
1answer
246 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
4
votes
1answer
459 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue. We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
0
votes
0answers
97 views

Is server authentication in SSH secure enough?

Possible ways of SSH server authentication are: Server public key fingerprint verification Implicit authentication Explicit authentication In case of fingerprint verification everything runs on ...
0
votes
0answers
27 views

Secure access to MS SQL from web applications

MS SQL provides two primary authentication methods, Windows Authentication or SQL Server Authentication. Since local MS SQL accounts are problematic to maintain and monitor this option is not ...
0
votes
1answer
46 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
20
votes
3answers
80k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
2
votes
1answer
246 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
0
votes
1answer
69 views

Deeplinks in email that autologin

I'm wondering if a deep link in an e-mail that automatically authenticate even though the session is expired is GDPR compliant. For instance if I send an e-mail to a user with links to the internal ...
0
votes
1answer
150 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
6
votes
2answers
764 views

Cellular phone cloning

It is known that certain methods of authentication are used to tie a particular device to a particular phone number, so that cloning can be prevented. What are these authentication mechanisms? ...
0
votes
2answers
77 views

Is there any security reason for re-directing to the main/mobile page after login?

Scenario: User searches for something and gets a link to a sub-page on a site, proceeds to go there, but is asked to sign-up/login - they do so, only then once they are logged in, they are redirected ...
0
votes
1answer
72 views

Cookie-Based Authentication Security of Popular Websites [on hold]

Let's take Google and other popular bank websites which uses cookie. I've been working with a website using Angular which uses Laravel as an API. Data are stored in cookies which is vulnerable in ...
127
votes
7answers
75k views

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

I am very confused the difficult jargon available in web about OAUTH, OpenID and OPENID Connect. Can anyone tell me the difference in simple words.
1
vote
4answers
205 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...