Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
3answers
90 views

Why is passing a token for each API request more secure than passing a username and secret for each API request?

I guess this could also be phrased as JWT vs. Basic Auth, similar idea? Passing a token for each API request seems to be the more common and recommended approach, and I have the gut feeling that it ...
1
vote
1answer
120 views

how wifi web authentication works?

Some wifi are open networks, but when we connect, it redirects to a web page for authentication. How does this work? how the future packets will be authenticated? Does it bind IP and MAC address (...
0
votes
1answer
574 views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
0
votes
1answer
40 views

Safe to consider webapp user's email as implicitly confirmed after a password reset?

In my system, a new user must confirm his email. But there is an edge case: he registers does not confirm forgets password, performs password reset (which involves a mail loop) At that point I know ...
21
votes
2answers
8k views

Why is it always `HASH( salt + password )` that we recommend?

Browsing over this site, many forums, online articles, there's always one specific way we're suggesting to store a password hash: function (salt, pass) { return ( StrongHash(salt + pass) ) } But ...
5
votes
3answers
3k views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
-1
votes
2answers
101 views

is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?

My new workplace laptop is configured so that after I log off and log on, rather than the last-logged-in user being selected by default, I have to hit ctrl-alt-del and then enter my username and ...
1
vote
1answer
67 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
2
votes
1answer
116 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
0
votes
1answer
55 views

Preventing account enumeration with 2FA

What are some methods for preventing account enumeration on login when accounts have optional two factor authentication? Without two factor authentication we would just return the same response for ...
0
votes
0answers
34 views

EAP-TLS : implementation and testing of a communication between two processes

I'm trying to make a simple EAP-TLS communication between two processes and capture it with Wireshark. Is there any library that can be used? (like mbedtls in the TLS case). I have found a lot of ...
5
votes
1answer
299 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
2
votes
1answer
217 views

Websocket Authentication at Opening Handshake Sufficient?

Suppose TLS is used and a session ID was negotiated using standard HTTP mechanisms. With the websocket opening handshake, this session ID is also transferred in the HTTP header. Suppose the websocket ...
0
votes
2answers
64 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
1
vote
1answer
107 views

Is it possible to prevent man-in-the-middle attacks in token-based authenticated online games without packets encryption?

I'm creating a home made MMO server (as a hobby / way to learn something new). I've decided to use a token based authentication for game traffic. Many people say that you shouldn't use any kind of ...
1
vote
1answer
354 views

In what cases is it ok keep a user logged in or provide auto login if an app starts?

I am wondering what the difference is between WhatsApp and my Bank application, and what considerations determine what is the right approach to handle user authentication. WhatsApp: I create my ...
0
votes
0answers
30 views

In Kerberos authentication protocol, why is the TGT encrypted using the user's key Ka?

When the user first logs in, he fetches his TGT from the KDC along with the session key. I get why Sa (session key) is encrypted with Ka (user's key). But why is TGT also encrypted with Ka. TGT is ...
4
votes
1answer
151 views

Authorize transitive communication between applications on behalf of the user

I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below. There is one main application with which the user ...
0
votes
0answers
40 views

what would be the best approach to generate JWT token for server to server communications?

I am planning to develop an authentication service which generates and validates the JWT token for incoming requests. What would be the best challenge mechanism which could be employed to generate the ...
0
votes
1answer
46 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
2answers
365 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
3
votes
1answer
216 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
2
votes
1answer
88 views

How to properly deal with different user-facing login mechanisms?

I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier. For example, the user can have access using OpenId, OAuth or token. But how can we "help" the ...
1
vote
1answer
79 views

Setting passwords for domain users, not expiring them, and not allowing them to be changed by users

We are in a mid-sized enterprise environment and are looking at forcing specific passwords for all users. I've found nothing recent or relevant about this. Justification: The main reason is to ...
1
vote
1answer
207 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
0
votes
0answers
40 views

Keycloak's Angular quickstart : XSS vulnerable?

We are using Keycloak for the authentication of our server-side rendered applications (Java/Spring/Thymeleaf), and now we want to use it for our Angular applications. Using the Angular quickstart, ...
0
votes
1answer
250 views

Is stealing the HTTP Basic Authenication header possible via CSRF?

Recently I've been trying to find a way to steal HTTP Basic Authentication credentials via CSRF. For example, if a site is using basic authentication is it possible for an attacker to grab the ...
5
votes
2answers
9k views

TLS-RSA vs TLS-ECDHE-RSA vs static DH

I understand there are a lot of articles explaining this subject and, before I post my question, this is my current understanding about it: ECDHE-RSA = The server randomly generates a DH-key pair ...
1
vote
0answers
59 views

Payment gateway API authentication

I've been tasked with building an API that interacts with a couple of payment gateways to create payments. The API has accounts with multiple users and the accounts have payments associated with them....
2
votes
3answers
346 views

Secure preshared key 2 way authentication

I have the following setup: A server and a client will be connected over tcp. The server and client both have access to the preshared secret key. When the client connects to the server, the client and ...
0
votes
1answer
106 views

SSH: Best practice for PublicKey Authentication from multiple Devices

I have a Server I want to access via ED2559 PublicKey Authentication. How would one do it so it is as safe as possible from multiple devices? Should I add multiple PublicKeys to my Server or should I ...
6
votes
1answer
604 views

Are Authy's tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
8
votes
2answers
263 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
6
votes
2answers
222 views

Non Confidential OAuth2 flow

I've been going through some documents regarding OAuth2 confidential and non-confidential authorisation flows, namely this and the RFC. From my understanding, the non-confidential flow does not ...
1
vote
1answer
111 views

Malicious Google Drive Links

Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
9
votes
1answer
458 views

PSD2 compliant two factor authentication

According to PSD2 the elements of the multi-factor authentication must be independent so the compromise of one element does not compromise the other. Here is the article from the directive: *...
1
vote
1answer
58 views

Multi Factor and order of authentication [duplicate]

I'm questionning the design and architecture around 2FA/MFA controls while authenticating to services and servers. On major platforms(*), the end-user is: first prompted for credentials (username/...
3
votes
0answers
96 views

Using asymmetric keys for two factor authentication

Here's what I'm trying to do: Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
109
votes
13answers
20k views

Secure way to log in to a website on someone else's computer

Suppose I am in a situation that I am forced to log in to my account using someone else's computer. Is there any secure way to do that so that I would be sure that my login details (i.e. password) are ...
1
vote
3answers
119 views

Locking the user account or returning the “Invalid username or password” [duplicate]

We have an application where we are using OS users for authentication and using native OS libraries for authentication of that user credential. We have implemented an account lockout functionality ...
1
vote
1answer
184 views

Kerberos composite authentication that reflects user's origin

I'm experimenting with Kerberos and was wondering if some sort of composite authentication that identifies both a user and the origin of the users request was a) possible and b) implemented anywhere....
0
votes
0answers
31 views

SQRC use to verify e-delivered certificate

I have a need to provide a means of validating a certificate that is e-delivered. My thought is to use an SQRC to enable that verification by linking to a secure site that contains the original ...
1
vote
1answer
142 views

Name of authentication where TV shows you code to enter on website?

I can't find any good resources about how this kind of authentication scheme works where you open an app on your TV (Plex, Youtube,...) and they show you a code (optional there's also a QR code) and ...
0
votes
1answer
166 views

Security issues with using JWT + cookies for session authentication?

Trying to get my head around not using traditional $_SESSIONS to keep user logged-in across pages. Are there security issues with storing JWT in cookies to authenticate a user session? Here's a bare ...
207
votes
4answers
118k views

How does Google Authenticator work?

Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent. It works without any connectivity; it even works on plane mode. This ...
0
votes
1answer
50 views

Security element that relate to breaking protocol

I am working on evaluating an unsecure protocol. I am trying to categorize the vulnerabilites according to some commonly accepted security elements like the ones specified in the CIA triad or the ...
0
votes
1answer
243 views

ACME protocol without LetsEncrypt, using dedicated CA [closed]

I have a question about the ACME protocol without using LetsEncrypt, and using our dedicated CA instead. Can anyone enlighten me what should I consider in my client-server application which ...
1
vote
0answers
48 views

Proper implementation of JWT authentication in mobile app

I'm building a mobile app that connects to a Python Flask API and backend. Currently, I am using JWTs for authentication. The expiration of the token is set to be 6 months in advance. The thing ...
3
votes
1answer
140 views

Why OWASP considers TouchID as insecure?

As could be reviewed in 1 under Am I Vulnerable... section, OWASP page states that If the mobile app uses a feature like TouchID, it suffers from insecure authentication. The reasons for this are ...
0
votes
4answers
162 views

Anything particularly wrong with putting an auth code in marketing emails?

I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...