Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
1
vote
5answers
45 views

Is revealing the phone number during OTP verification process considered a vulnerability?

One of the common way of implementing 2FA is using phone number Text message or Call with OTP. As I can see, usually web services show something like "OTP was sent to the number +*********34"...
4
votes
1answer
551 views

Hardening NFC tags for authentication

So I have a small electronics project where I am using common Mifare Classic 1K NFC tags as a means of authentication. (Mifare DesiFire is just too expensive) I know these aren't very secure so here ...
0
votes
2answers
72 views

Best practice for authenticating resend email requests

I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database. In my service, upon signing up/resetting a password, the user will be redirected to ...
0
votes
2answers
33 views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
1
vote
1answer
115 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
1
vote
2answers
62 views

What are Security Considerations of Using File Upload/Comparison as Simplified Second Factor?

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...
1
vote
1answer
785 views

Why is it recommended to use GCP service accounts vs user accounts?

I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
2
votes
1answer
138 views

How to securely share only some information with a middle-man site

Scenario: you run an app OurApp which deals with users' sensitive data, some of which you are allowed to share with third parties (with the user's consent, of course) and some of which you are not ...
-1
votes
1answer
49 views

Social Engineering or Broken Authentication

If I go to a cybercafe and use one of the shared computers, and use a social media application, which deletes session IDs when the browser is closed. A clever person comes, who knows about the ...
7
votes
2answers
2k views

If hashing should occur server-side, how do you protect the plaintext in transit?

I've been working on a full stack project recently for my own amusement and would like to add authentication services to this project, but want to make sure I'm doing it the right way. And before ...
12
votes
3answers
816 views

Verifying server software integrity?

I'm trying to brainstorm a security scheme for the problem of verifying server software integrity. The domain of this problem is Game Servers built on Valve's Source Dedicated Servers. These servers ...
23
votes
3answers
3k views
+50

Passwordless login over email - security considerations

I'm proposing the use of a login system that sends a one-time login token (with high entropy) via email to the user. After using the token, the user receives another token via email and the previous ...
2
votes
1answer
126 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
0
votes
2answers
77 views

My passwordless authentication approach

I implemented a passwordless authentication with a good UX in mind. But I am not a security expert so I am asking for your advice. This is the authentication flow: User types in email address client ...
1
vote
3answers
78 views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
31
votes
7answers
7k views

How can we eliminate passwords given the problems with biometric authentication?

I've read articles suggesting that passwords will eventually go the way of the dinosaur only to be replaced by biometrics, PINs, and other methods of authentication. This piece claims that Microsoft, ...
1
vote
2answers
69 views

How to log admin in as regular user?

I'm using JWTs for authentication. It would be good as a means of double checking the user's experience if an admin user could log in as a regular user. One way I thought to implement this could be ...
2
votes
0answers
75 views

The Other Side of CAPTCHA [closed]

CAPTCHA stands for "Completely Automated Public Turing Test to Tell Computers and Humans Apart", but we only consider one half of it i.e. a test to separate genuine humans from bots. Can a ...
0
votes
0answers
30 views

Registration process by OAuth2

I have been analyzing the security process in 3gpp specs (pg 11) and the registration process in the spec explained with that flow. The flow represents the registration of a client to the server.. I ...
10
votes
7answers
3k views

Does client side hashing reduce insider risk?

One of the companies I worked for used client-side hashing to minimize risk when logging the password in the server logs. Can this be a good reason to implement client-side hashing?
15
votes
2answers
9k views

How does a server validate the Certificate Verify message in SSL/TLS?

Client authentication may be used in a SSL/TLS negotiation. For this, the client will send a CertificateVerify after the server requested it. The CertificateVerify message contains the client ...
1
vote
1answer
1k views

Why is CertificateVerify message necessary? (Why isn't client authentication done through the KeyExchange)

Why is client authentication not done through the KeyExchange like with the server, but through a CertificateVerify message? When using RSA key exchange the client encrypts the key material with the ...
-1
votes
0answers
32 views

Error 403 Permission Denied [closed]

I'm trying to hide a page in a website, so I made every request to this specific page return "403 Permission Denied". How can someone pass this defense?
0
votes
0answers
47 views

Why Api_Key and Api_Secret based auth for bots? [closed]

While user accounts are still username and password-based, why are Twitter/Discord bots authenticated using only api key and secret, which is based on private key signature-based authentication?
25
votes
2answers
9k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
1
vote
1answer
76 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
4
votes
1answer
206 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
36
votes
6answers
5k views

What is the suggested best practice for changing a user's email address?

I recently jumped onto the hypetrain for an unnamed email service and am currently on my way to update all my accounts on various websites to get most of my (future) data off Google's Gmail. During ...
2
votes
2answers
111 views

Is autologin dangerous? (Debian/Linux)

If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin: /etc/lightdm/lightdm.conf [Seat:*] autologin-...
1
vote
0answers
57 views

How to implement a web login using a public/private key pair?

I am trying to create a web form, where the user can login without creating/entering a password. Assume the following pre-requisites are met: The user and server have pre-generated a public/private ...
0
votes
0answers
25 views

Choosing oauth flow-type for on-prem installations

So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
2
votes
1answer
77 views

Why don't fingerprint authentication systems don't store 'hashes'? [duplicate]

Usual password authentication systems do not store passwords directly on the server, but only hashes of those passwords. Why do fingerprint authentication systems not offer this possibility?
0
votes
0answers
32 views

Authenticating Adobe .pdf electronic signatures

Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
0
votes
1answer
29 views

Does a password-derived public key authentication improve security over pure password-based authentication?

Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of ...
0
votes
1answer
96 views

Allowing clients to authenticate by generating their own JWT

I am trying to achieve an authentication system that: Has short-lived passwords/tokens (unlike Basic Auth or Api key), Won't expose users credentials if my users table is leaked (unlike HMAC), Every ...
0
votes
1answer
89 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
0
votes
1answer
98 views

Does split knowledge always require an implementation of dual control?

Maybe I'm misunderstanding something here. Dual Control: Actions taken by different operators to affect a change. Split Knowledge: Information needed to affect a change is split between ...
4
votes
1answer
8k views

how to get cookies from aspx site to use it with hydra

I've been playing around with Hydra and .aspx site and I've hit a bit of a snag - Hydra responds letting me know that the first 16 passwords in my password list are correct when none of them are. ...
8
votes
3answers
209 views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
2
votes
1answer
181 views

OpenID Connect Web Message Response Mode and XSS

When using the web message response mode spec with OpenID Connect for silent authentication, what prevents an attacker leveraging an XSS attack from registering a "message" listener and intercepting ...
1
vote
1answer
61 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
2
votes
1answer
33 views

How to design a single-request, non-CA-based custom server-to-server authentication method?

We have a series of services exposed as web servers. Potentially, every web app could contact and be contacted by any other one. I want to secure the communications between the applications, which ...
0
votes
1answer
85 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
2
votes
1answer
99 views

Authenticate limited client devices from server without login process

I have limited client devices and one server. I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or ...
1
vote
5answers
1k views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
9
votes
4answers
3k views

How does LastPass' grid multi-factor authentication work behind the scenes?

I understand how to use the Grid multi-factor authentication as a user but how does it work technically? Specifically how can just a few letters from the grid be enough to decrypt any secret defined ...
0
votes
1answer
336 views

Ipsec: Is it possible to use both pre-shared keys and pubkeys auth methods at the same time?

So if we have a server configuration with local auth pubkeys and remove psk and at the same time for a client(initiator) a local auth psk and remote pubkey. Something like this. Server - local { ...
0
votes
0answers
24 views

NFC Ultralight C - design an authentication system (can it be clone protected?)

I am trying to design an authentication system that will be based on NFC Ultralight C cards. Key concept in my system is that the card identifies a specific person, but this concept can be easily ...
0
votes
1answer
237 views

Why does the JWT Wordpress plugin recommend storing the token in a cookie/localstorage?

Reading about JWT I've come with a very interesting topic, which is the jwt tokens vulnerability if they're not properly secured when using with wordpress. So, the thing is that storing the token in ...
0
votes
0answers
37 views

Understanding TS 133 501 (5G) Step 2 of EAP-AKA'

I got a question dealing with the EAP-AKA' used in 5G to authenticate clients coming from a 3GPP-Network. I read the latest specification on ETSI. The problem which I have is based on Step 2 on Page ...

1
2 3 4 5
79