Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
0answers
38 views

How to Use the Carter-Wegman MAC

I have a block of ciphertext, only two hundred characters long, and I want to give it authentication and proof of data integrity. I have decided upon the Carter-Wegman MAC because I like its ...
0
votes
0answers
23 views

Convert openssl private key to openssh format [duplicate]

I have an openssl format private key that i need to use as a host key for openssh connection.How can i convert the openssl format private key to openssh identified format?
0
votes
1answer
66 views

How to securely share only some information with a middle-man site

Scenario: you run an app OurApp which deals with users' sensitive data, some of which you are allowed to share with third parties (with the user's consent, of course) and some of which you are not ...
0
votes
1answer
39 views

double-new attack? replace contact method twice so that the “new” and “old” one are both attacker-controlled

With some services, if an attacker changes the value of a user's contact information (email address, for example), when the user tries to recover their account, they can use either the new or the old ...
1
vote
1answer
58 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
5
votes
4answers
4k views

Hardware token to authenticate web application

My company is developing a web application, and I was asked to research how to do hardware-based token authentication to login into our web application. Let me repeat: basically there will be a web ...
0
votes
1answer
87 views

How effective is mobile phone verification in stopping fake user registration?

Or in other words, how much work and money does someone has to do/have to have many SIM cards with many numbers, each loaded in a mobile phone.
3
votes
1answer
70 views

Storage of API authentication token in single-page-applications

I'm building a JSON API. For authentication I plan to use a random-token based approach, with the random token having 256 bits of entropy and generated using a CSRNG. A hash of the token will be ...
1
vote
1answer
52 views

What point in Authenticator App 2FA when SMS fallback is enabled

I would like to move away from SMS 2FA (because of Should 2FA over SMS be considered insecure in the wake of recent SS7 attacks? for example). But some services that provide Authenticator apps ...
0
votes
0answers
34 views

What are security/privacy implications when using WeChat as OAuth provider?

Account information of the chinese WeChat service can be used to authenticate on other websites/services (like discussion forums) by the OAuth protocol. Since WeChat plays a major role in surveillance ...
75
votes
11answers
46k views

Why is client-side hashing of a password so uncommon?

There are very few websites that hash the users password before submitting it to the server. Javascript doesn't even have support for SHA or other algorithms. But I can think of quite a few ...
3
votes
1answer
4k views

Use (or not use) OAuth for internal service to service communication in SOA

So we are a group of students making an online platform for our University. We are modelling our platform as a set of services. For example, a service "A" might store only personal information of ...
1
vote
2answers
70 views

Should Google User ID's be hashed when stored in the database

I'm currently developing an auth backend that allows for both Google and Email/Password as authentication methods. I'm basically treating the Google ID and Password as credentials here. I'm already ...
1
vote
1answer
71 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
2
votes
1answer
76 views
+100

Distribute Program with Sheets API Credentials

I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data. My program contains a credentials.json file which I obtained from the Java Quickstart page ...
7
votes
3answers
7k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
1
vote
1answer
42 views

How to get access token programatically when we try to authorize by grand_type auth-code in the OAuth 2.0 like a user?

There is a bank service that provides API to do some operations with bank accounts. To perform a request to all endpoints of this service I, first of all, need to get auth token via grand_type=...
1
vote
0answers
50 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
9
votes
4answers
4k views

Does IMAP/POP3/ASP undermine Two-Factor Auth?

When I log in to hotmail or Google or posteo I can only log in using the 2FA that I have set up. However, each provider seems to have an alternative for apps that do not auth via a web client. ...
0
votes
0answers
25 views

Tomcat OIDC Authenticated Realm

I am currently using a tomcat authenticator implementation (https://github.com/boylesoftware/tomcat-oidcauth). The authenticator is implemented as a tomcat valve. This implementation still requires a ...
1
vote
1answer
2k views

OWASP ZAP bruteforce by password not username

I want to bruteforce a login page using OWASP ZAP, using two separate passwords (90 lines) and username (200 lines) files, with the bruteforce POST requests to be ordered by password like: user001:...
59
votes
5answers
8k views

What are the risks of just clearing cookies instead of logging off?

A typical web authentication workflow looks like this: User provides their credentials. Server validates credentials. If credentials are valid Server generates a token. Server keeps this token. ...
1
vote
2answers
78 views

Authentication using a digital signiture

I'm new to the world of digital signatures and encryption and I'm trying to learn more. I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital ...
2
votes
2answers
77 views

Attacker models of long-term logins: how should sensitive server endpoints require re-authentication?

Let's see the following scenario: "GutHib" is a fictional hosting service in the form of an online webapp for the fictional DVCS software "Gut". Alice logged in to GutHib with her password and 2FA, ...
0
votes
1answer
46 views

Does split knowledge always require an implementation of dual control?

Maybe I'm misunderstanding something here. Dual Control: Actions taken by different operators to affect a change. Split Knowledge: Information needed to affect a change is split between ...
0
votes
1answer
57 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
0
votes
0answers
23 views

Why AEAD on TLS 1.3 still need a MAC like SHA256? [duplicate]

TLS 1.3 mandatory cipher suites use either AES+GCM or ChaCha20+Poly1305, which are AEAD that should provide both authentication and encryption. Why there is need for a MAC hash algorithm if the data ...
23
votes
8answers
10k views

On two-step login forms, why is it the login name and not the password that's asked first?

There are several login forms (e.g. Google's) on the internet where you first enter your login name and then, once that's submitted, you get to enter your password. One of the advantages of this is, ...
6
votes
2answers
1k views

Why is FIDO U2F an entirely different standard from FIDO UAF instead of just a subset?

As you may already be aware, the Universal 2nd Factor (U2F) standard is a standard for 2nd-factor authentication which allows users to authenticate to web applications using a USB hardware token. ...
3
votes
0answers
48 views

Are the default Azure AD Authentication Certificates global?

When authenticating against an AzureAD instance (using WS-Federation and SAML 2 tokens) the relying/authenticating application requests authentication metadata from a fixed URL on the auth servers, ...
0
votes
1answer
36 views

Ipsec: Is it possible to use both pre-shared keys and pubkeys auth methods at the same time?

So if we have a server configuration with local auth pubkeys and remove psk and at the same time for a client(initiator) a local auth psk and remote pubkey. Something like this. Server - local { ...
1
vote
1answer
96 views

Are there any security risks associated with having static files on the server be publicly available?

I am going to frame this question using ASP.NET Core in mind since that is what I'm using, though my question is applicable to any scenario in which you have a client that makes requests to a server ...
3
votes
1answer
110 views

Is there a security benefit to requiring a login before and after a captcha test?

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha. I've been trying to ...
9
votes
4answers
4k views

Do keyfiles actually add any meaningful security in the presence of strong passwords?

In the context of protecting access to local encrypted files or devices against a determined (and competent) adversary, is there any reason to believe that the use of a key file actually presents a ...
6
votes
1answer
2k views

Can I know who tried to login to my Google account?

I recevied a notification that someone tried to access my Google account and it was denied, so i quickly changed the password. Google tells me the IP number in the notification and a location. I ...
2
votes
4answers
140 views

Do mail servers follow links in emails as part of a security scan before inbox delivery?

I've implemented a passwordless login using a magic link and email. The link can be used only once. One customer is complaining that once they click the link, the page reports that the link is already ...
12
votes
4answers
7k views

What protects a JWT from being hijacked and used to pose as the original user?

Sorry for this possibly silly question, I'm just learning about JWT so please bear with me... I read the JWT docs extensively but I don't understand what prevents a hacker from hijacking the JWT and ...
0
votes
2answers
79 views

How client-side OAuth is secure?

I want to make a static webpage, but secure it with a login. In order to do this, I looked at this link. Basically, I want users to log in their Google account to be able to view the webpage. But I ...
0
votes
1answer
67 views

Should I send login id on email?

I have a very common use case where an admin is creating an account of the user and then I need to send the login id generated by my system to the user. And the user will need to set a password on the ...
0
votes
0answers
55 views

Why is it wise, from a security POV to have sessions expire? [duplicate]

It is a common practice to have sessions expire for users when they are logged in for a long period, especially if they are inactive. I've seen this particularly employed in systems where sensitive ...
1
vote
0answers
45 views

Reason for iOS and Android fingerprint behaviour

Both iOS and Android allow using a fingerprint sensor for logging in, and allow applications to store secrets that can only be unlocked using the fingerprint. Both allow one or more fingerprints to be ...
19
votes
4answers
3k views

What are the security implications of using TOTP for single factor authentication?

(Note: I am not actually planning to do this. This question is strictly theoretical.) TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
4
votes
2answers
6k views

Certificate validation with 802.1x PEAP

I recently learned about how WPA-PSK works. If I understand correctly, the 4-way handshake enables the protocol to ensure mutual possession of the PMK (and therefor, the PSK) without sending the PMK/...
1
vote
2answers
130 views

How are UUIDs assigned in P2P protocols

I am learning about P2P in general (mainly blockchain). I know many P2P protocols uses a distributed hash table for node lookup (kademlia) that maps UUIDs of nodes to their addresses. I am curious ...
0
votes
1answer
65 views

Is detecting if an email has an account considered a vulnerability with AWS cognito?

Am doing a pen test on a client system using AWS Cognito and userpools for authentication using the client side SDK provided by AWS. during the forget password flow, I noticed that Cognito request ...
2
votes
0answers
89 views

Can I sign with two Code Signing certs to build reputation on the newer one?

I recently acquired a Microsoft Authenticode Code-signing certificate as a new certificate using an identical name to another one which will expire soon. Obviously, the new certificate has no ...
0
votes
0answers
29 views

OIDC SPA Keycloack refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
0
votes
0answers
42 views

Using Mutual TLS to create api keys

I would just like a sanity check on my plan to implement API authentication/authorization. Authorized URLs are placed in a secure DB The client server places a GET request to api-key service with ...
2
votes
0answers
46 views

PCI 8.6.1 - Minimum attempted login window?

PCI 8.6.1 says: Limit repeated access attempts by locking out the user ID after not more than six attempts. But says nothing about a minimum duration between the first failed login attempt and the ...
1
vote
0answers
94 views

How does cartridge protection distinguish an original vs fake cartridge? [closed]

Based on what is explained in How to disable HP Cartridge Protection, genuine ink cartridges may come with cartridge protection embedded in their chip. Once an ink cartridge is installed, printer will ...