Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
0answers
40 views

Multiple authentication servers providing authorization to resource server

What I want to achieve? To authorize people to single resource server over multiple different Authentication servers. Clients want to login via their own Domain credentials and have credentials only ...
-1
votes
1answer
102 views

How does this Session work (web)

It is difficult for me to fully understand this whole process. I am using express.js and express-session.js with Node. Now if someone logs in, a session is stored in the session store(server side) ...
0
votes
0answers
57 views

How to create an anonymous user account like the app Day-One does?

A new iOS app should be able to connect to a web service to sync data across devices. I like the way the diary app Day One solved this by offering "real" user accounts and automatically generated "...
0
votes
1answer
30 views

Authentication of AP with hidden SSID

In this post it is stated that the supplicant (entity who wants to connect) identifies the Access point by its SSID as it would do for any wireless network. This post says that a de-auth can be sent ...
2
votes
1answer
239 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
2
votes
2answers
221 views

Why does WebAuthn use only one factor?

One of the main things that surprises me about the new WebAuthn standard is the fact that these biometrics or U2F keys replace passwords instead of complementing them. Why is this done, and is it ...
1
vote
1answer
293 views

Why should I use jwt in Refresh Token? [duplicate]

I use Refresh Token to handling expired Access Token, and in log out, I can remove Refresh Token from the database. Refresh Token must never expire (not sure) because the user can check "remember me". ...
2
votes
1answer
139 views

Penetration testing - how to fix a vulnerability?

Welcome, I always wanted to ask this, how you fix/patch a vulnerability by yourself? /maybe possible duplicate, but I have not find the same, or I search the wrong way.. (sorry) / I know a bit how to ...
0
votes
1answer
99 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
2
votes
2answers
64 views

Can attackers intercept my credentials on an insecure site if I log in through a 3rd party service?

I recently visited a forum using non-secure protocol (HTTP) - Chrome flagged a warning at the top saying I shouldn't enter any passwords or personal information onto the site, as they could be ...
0
votes
0answers
294 views

How to safely store JWT using React App

Currently I'm working on a React-Laravel stack application. Having already built an SPA using React and a backend in Laravel, the plan is to use the backend as a REST API to make requests from the ...
0
votes
0answers
76 views

What is the right way to share the digital assets to the will executor and eventually detect the person's death?

These days I brainstormed about how does one give their passwords/pin codes/etc to their will executor so that the executor can do what the person wanted after their death? For instance, how would a ...
-1
votes
1answer
287 views

Why don't CAs sell certificates as files, instead of hardware or as a service?

I'm trying to purchase multiple certificates, some just signing, some just encrypting, and some a combination of the two. I wanted to purchase one signed by a CA, rather than using a self-signed one. ...
1
vote
1answer
109 views

Authorization over Internet without storing user details

We have a requirement where we are creating an user generation page over internet for various vendors. This was earlier done by our operations team on intranet. For each vendor to create a unique ID ...
0
votes
0answers
41 views

Google's recommendation of server-side authentication over client-side [duplicate]

I'm currently building an Android application that utilises some Google APIs. I have also created a back-end using Flask, to which my Android application makes calls to. One main problem I ...
0
votes
1answer
364 views

Is telegram SMS login secure?

TL;DR: Can 1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or 2) A "telegram ...
0
votes
1answer
52 views

Authentication System Usernames [duplicate]

For a reason I can't fathom, people seem to subscribe to the opinion that a secret username isn't more secure than a public one. I find this opinion completely ludicrous and would like to know why ...
0
votes
0answers
63 views

Why does Instagram let me to login without confirming my email

I am designing a website with a login/signup feature. I was testing some websites to see how they handle this correctly. I confronted Instagram and see it lets me login without confirming my email ...
3
votes
1answer
51 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
0
votes
2answers
145 views

Could Someone Use a Stolen Cookie Session ID to Bypass Htaccess Login?

I'm doing some pen testing for my place of employment. I was able to grab the session id from the browser cookies, but i still cannot get past the htaccess login. I initially thought that by setting ...
296
votes
9answers
168k views

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?
2
votes
1answer
1k views

HTTP Basic Auth is enough?

I have WebSVN, Gitlab and phpMyAdmin hosted on my dev server. Now, all of it, I password protect the pages (not their individual login) using HTTP Basic Auth, is this the best practice that I can do?
0
votes
2answers
83 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
2
votes
1answer
233 views

Is there any flaw in my API-to-API authentication concept I missed?

I've been thinking lately about how all of the authentication methods used in API to API communications (RESTful API's) are mostly methods that have been designed to be human oriented first (tokens\...
3
votes
1answer
91 views

Is there any benefit using a two-step salted hash? [closed]

Commonly when implementing authentication mechanisms that accept passwords is to add salt when hashing the password. Reading the article here: https://engineering.gosquared.com/evolution-of-password-...
0
votes
1answer
84 views

How to do authentication when FE and BE are on different domains?

We're doing authentication by sending a JWT via an httpOnly cookie. (client sends credentials, server answers with a token cookie, client attaches it to all subsequent requests). Due to some ...
1
vote
0answers
73 views

Authentication: E-mailing security codes vs clickable links

I've noticed a trend in how big companies (Amazon, Skype, and a few others I don't remember in particular) handle e-mail authentication. Rather than e-mailing clickable links with some single-use ...
3
votes
2answers
241 views

Does client have to send the CA chain along with the client certificate after ServerHello?

During the MTLS handshake, after ServerHello is done client sends the client certificate back to the server, I need to know if the client should only send the client certificate or is it required to ...
0
votes
1answer
112 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
1
vote
0answers
47 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
6
votes
4answers
733 views

Possible to use *only* U2F authentication?

Using a U2F USB authentication key to login to services such as Google seems a good idea. However, these services often allow you to register a backup two-factor-authentication (2FA) method, which you ...
3
votes
1answer
79 views

SSO level of trust external identity providers

I'm wondering how much I should trust our clients and their SSO implementations. We have an identity provider set up for @our-domain.com and most users of that domain have a lot of rights in our ...
1
vote
3answers
149 views

Hash pepper in web application possible?

I have read a few articles and several question on here about hashing correctly. While hashing, adding salt and especially pepper is primarily a server side use case, I am interested in the ...
0
votes
1answer
51 views

Is there such a thing as an Authenticated Protocol?

I need two devices to communicate in plain sight and I want to know what to ask for. Nothing is secret so no need to encrypt. However, I need the source to be authenticated to prevent bad actors from ...
0
votes
1answer
80 views

Does FIDO2 token works as two-factor on password-less authentication?

As authentication factors, I know the following You are (e.g. Biometrics) You have (e.g. USB) You know (e.g. Password) If I use a FIDO2 certified fingerprint reader for password-less authentication ...
1
vote
3answers
111 views

Best practices to prevent logging of LDAP credentials by intermediate apps

I am working on transitioning our project management tool (PMT) to use LDAP authentication instead of native auth that's currently in use. We also have some internal web-based tools that interface ...
0
votes
1answer
74 views

Two message key agreement and mutual authentication protocol?

I am looking for, but not finding, a published protocol that does something similar to TLS 1.3 mutual authentication, but simplified by using assumptions to reduce the chattiness of TLS. If we assume ...
12
votes
2answers
16k views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
0
votes
1answer
80 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
10
votes
1answer
867 views

How to properly secure an ActiveMQ instance, and what are all of the different files for?

I'm trying to configure user based authentication for ActiveMQ, and I'm pretty confused about the many different files involved in this process. I've read ActiveMQ's security page, but I still have ...
2
votes
2answers
148 views

Does 2-Factor Authentication protect against malware?

My question has to do with whether 2-Factor Authentication protects against a compromised system (malware). There are a couple of scenarios in which I wonder whether it does: Every time you login to ...
1
vote
1answer
41 views

What's the correct way to handle a failure with Client Certificate Authentication

I'm adding Client Certificate Authentication to my application - what is the correct way to handle an invalid certificate, untrusted certificate or an un-mapped user ID?
6
votes
2answers
8k views

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
1
vote
0answers
22 views

How to intercept AD authentication attempts [closed]

My work Windows account keeps locking and the unlocking process is frustrating (you have to call the HelpDesk to request them account unlocking). They don't have any type of log and so they can't help ...
4
votes
1answer
386 views

when should i use HMAC-based JWT?

I read a number of blog posts and found that it is tough to keep the secret-key a secret and if using a symmetric algorithm for JWT creation, the generator has the power to create as well as validate ...
5
votes
2answers
4k views

What is the difference between API keys and API tokens usages?

From all the research that I have done, I have found that API keys are less secure than access tokens (under usage of oAuth), and should only be used for monitoring purposes. But from what I ...
0
votes
1answer
53 views

Which party stores the link between user and device in WebAuthn?

Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
2
votes
2answers
86 views

How to provide personal User Page after User already signed up without Password?

I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password. After a while it would be useful to provide ...
3
votes
1answer
142 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
3
votes
1answer
355 views

Is a security question you just have to 'remember' a good idea?

I was setting my eBay security questions and one of the choices were: Now I've seen sites that allow you to "type your own question" and "type your own answer" but unless they forgot a text field, ...