Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
1answer
51 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
0
votes
1answer
46 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
1
vote
1answer
95 views

Is there any system that can authenticate my device to open only select apps on it?

I am looking to have an authentication system with which I can link a device to an employee, and then put in place certain privileges so that the employee is only able to open select apps on only that ...
3
votes
1answer
87 views

Why OWASP considers TouchID as insecure?

As could be reviewed in 1 under Am I Vulnerable... section, OWASP page states that If the mobile app uses a feature like TouchID, it suffers from insecure authentication. The reasons for this are ...
1
vote
1answer
47 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
4answers
157 views

Anything particularly wrong with putting an auth code in marketing emails?

I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
0
votes
1answer
53 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
77
votes
5answers
83k views

Should we store accesstoken in our database for oauth2?

I have a requirement to implement Facebook and Google login in my web application. I also need to access a user's Facebook/Google+ friend list. I have gone through the complete OAuth2 documentation of ...
0
votes
1answer
55 views

How does using an auth server for mobile app and not storing API keys on client add security?

I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
1
vote
1answer
55 views

MFA for multiple accounts?

We are thinking about enabling 2FA with Google Authenficator for all our services. But the only concern for me now is that users will have to have a dedicated Authenticator's account for every ...
0
votes
1answer
42 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
2
votes
1answer
52 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
0
votes
0answers
26 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
1
vote
1answer
65 views

CVV info for over the phone or by mail transactions

I am a newspaper circulation manager and a subscriber just informed us that we aren't allowed to ask for the CVV over the phone or by mail subscriptions. What is the correct procedure?
1
vote
0answers
37 views

Is Mobile ID secure? Certificates on SIM card (Mobile identity management)

In Switzerland Mobile ID is popular. It looks like it's international known as Mobile identity management. Mobile identity is a development of online authentication and digital signatures, where ...
0
votes
1answer
52 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
1answer
56 views

Password storage which avoids privileged insider attack

What are the standard password authentication protocols in client-server setting where authentication happens at the remote server? Is there any password/pin verification protocol which reveals zero ...
2
votes
1answer
36 views

How do client and server authenticate random number which is sent

Both a client and a server send their random number each other in the ClientHello and ServerHello of handshake protocol of TLS. At the time, how do they authenticate the client or server which they ...
0
votes
0answers
17 views

Security risks in confirming the username instead of confirming the username and password combination [duplicate]

Most of the login pages like Google, Outlook and Yahoo! confirm the username first and then ask for a password instead of confirming the username and password combination altogether. Isn't it less ...
0
votes
0answers
26 views

Perform an authorized action via Postman [closed]

There's an old php website that I want to automate some tasks. Think of it as Craigslist in another country but much less sophisticated. In this website, I can send messages to users only when I am ...
3
votes
1answer
133 views

Is hashing without a salt secure for random passwords?

I'm designing an API with token authentication. I don't want to store tokens as plain text in the database, for the same reason user passwords are not stored as plain text: if the database gets ...
1
vote
1answer
218 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
2
votes
0answers
43 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
4
votes
1answer
971 views

Sharing access-tokens in response header?

What's the best way to share my access tokens? Is it okay to share it in the header as plain-text, or do I need to look into e.g. JWT? Current workflow: -> POST /api/login -d {**creds} <- 201 [...
3
votes
1answer
462 views

In the context of FIDO U2F, when is a new ephemeral key reused, or cached?

I'm reading this paper from Yubico on Universal Second Factor and OpenID Connect and see the description about ephemeral keys I'm confused on when a ephemeral key is used, and under what conditions ...
4
votes
1answer
444 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue. We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
2
votes
2answers
49 views

For PCI compliance, is a central Auth required for domain and non-domain security principles?

We have a Saas offering that is hosted within our own data centers. Our software offering utilizes OpenLDAP as it backing for token auth security. Our operations team has asserted that for PCI ...
0
votes
0answers
20 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...
-1
votes
1answer
96 views

How does this Session work (web)

It is difficult for me to fully understand this whole process. I am using express.js and express-session.js with Node. Now if someone logs in, a session is stored in the session store(server side) ...
0
votes
0answers
37 views

How to create an anonymous user account like the app Day-One does?

A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
0
votes
1answer
27 views

Authentication of AP with hidden SSID

In this post it is stated that the supplicant (entity who wants to connect) identifies the Access point by its SSID as it would do for any wireless network. This post says that a de-auth can be sent ...
2
votes
1answer
231 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
2
votes
2answers
202 views

Why does WebAuthn use only one factor?

One of the main things that surprises me about the new WebAuthn standard is the fact that these biometrics or U2F keys replace passwords instead of complementing them. Why is this done, and is it ...
1
vote
1answer
53 views

Why should I use jwt in Refresh Token? [duplicate]

I use Refresh Token to handling expired Access Token, and in log out, I can remove Refresh Token from the database. Refresh Token must never expire (not sure) because the user can check "remember me". ...
-1
votes
0answers
30 views

Accepting old email after email update

I am testing an ecommerce website. I tried changing the email address after login. It was successful. Now I am able to login with both old and new email addresses. Is this an issue or just a bad ...
2
votes
1answer
136 views

Penetration testing - how to fix a vulnerability?

Welcome, I always wanted to ask this, how you fix/patch a vulnerability by yourself? /maybe possible duplicate, but I have not find the same, or I search the wrong way.. (sorry) / I know a bit how to ...
0
votes
1answer
81 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
2
votes
2answers
60 views

Can attackers intercept my credentials on an insecure site if I log in through a 3rd party service?

I recently visited a forum using non-secure protocol (HTTP) - Chrome flagged a warning at the top saying I shouldn't enter any passwords or personal information onto the site, as they could be ...
0
votes
0answers
45 views

How to safely store JWT using React App

Currently I'm working on a React-Laravel stack application. Having already built an SPA using React and a backend in Laravel, the plan is to use the backend as a REST API to make requests from the ...
0
votes
0answers
65 views

What is the right way to share the digital assets to the will executor and eventually detect the person's death?

These days I brainstormed about how does one give their passwords/pin codes/etc to their will executor so that the executor can do what the person wanted after their death? For instance, how would a ...
-1
votes
1answer
134 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
1
vote
1answer
107 views

Authorization over Internet without storing user details

We have a requirement where we are creating an user generation page over internet for various vendors. This was earlier done by our operations team on intranet. For each vendor to create a unique ID ...
0
votes
0answers
40 views

Google's recommendation of server-side authentication over client-side [duplicate]

I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to. One main problem I ...
0
votes
1answer
280 views

Is telegram SMS login secure?

TL;DR: Can 1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or 2) A "telegram ...
0
votes
1answer
49 views

Authentication System Usernames [duplicate]

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why ...
0
votes
0answers
61 views

Why does Instagram let me to login without confirming my email

I am designing a website with a login/signup feature. I was testing some websites to see how they handle this correctly. I confronted Instagram and see it lets me login without confirming my email ...
3
votes
1answer
38 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
0
votes
2answers
79 views

Could Someone Use a Stolen Cookie Session ID to Bypass Htaccess Login?

I'm doing some pen testing for my place of employment. I was able to grab the session id from the browser cookies, but i still cannot get past the htaccess login. I initially thought that by setting ...
286
votes
9answers
162k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
2
votes
1answer
999 views

HTTP Basic Auth is enough?

I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?