Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
4
votes
3answers
234 views

As a website admin I could see encrypted passwords. Is this ok?

I am building a website that requires the users to login through username and password. I have the passwords encrypted in my database with bcrypt. On the back end, I receive the usernme and password ...
0
votes
0answers
3 views

RPC: How to authenticate the server towards the client(s)

I've implemented a client-server-model that runs locally on a linux machine. I've used the (old) ONC RPC / Oracle RPC based on an UNIX domain socket. There are some ways to authenticate the client, ...
0
votes
0answers
18 views

Identity confirmation using PIN to decrypt previously issued token

I am building an app (for web and mobile) that requires a user pass two stages of authentication/authorisation in order to access a server-side API and subsequently use the app. First, they must ...
8
votes
2answers
3k views

Definition of “passive” and “active” authentication?

I came across the concepts of passive authentication and active authentication in my work related to SAML 2.0 single-sign-on integration. I tried very hard to find a clear, generic definition and a ...
1
vote
1answer
135 views

Why is there a redirect to the native app in PKCE?

Why even have a redirect or even use the browser? Wouldn't just a normal TLS/HTTPS request/response in the app protect the requests and token? The one argument I have heard against solely relying on ...
509
votes
3answers
83k views

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
9
votes
2answers
4k views
+50

How to implement cross-domain, auto-login SSO without browser redirects for unlogged users?

I need to implement an SSO solution with the following requirements: Cross-domain: Let's assume I have a.com, b.com and sso.com. If I become logged in through a.com, I shouldn't need to login when I ...
1
vote
1answer
44 views

What protocols are authenticated by Active Directory?

Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?
2
votes
1answer
60 views

Double submit cookie: CSRF token doesn't need be a random value?

Note: I have read the answer to this question, but found it unsatisfactory, probably because I don't understand enough about security. I'm referring to a frontend server-side rendered SPA + a backend ...
1
vote
5answers
172 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
0
votes
1answer
59 views

Authentication without sending password over network

I was reading this question about ssh authentication and there's a good discussion about authentication schemes. First, there's the answer that yes, ssh sends the full password to the server (but ...
2
votes
0answers
91 views

Failure analysis to avoid locking permanently online accounts [closed]

(I reposted here a question I previously asked in SuperUser, I think this section is more appropriate) Back in the days defining a path leading to loss of data or loss of online accounts was easy: ...
2
votes
0answers
51 views

What is the rationale behind two staged credential input these days? [duplicate]

I have begun to notice some apps and websites (particularly ones made by Apple) which present user login in two steps. In the initial state, only the username/email field is shown. Once you enter a ...
0
votes
1answer
35 views

What are the alternatives for a bearer token mechanism?

Who gets a bearer token, will have all the privileges of the actual owner of the token. Is there any tokening mechanism which is not suffering from this issue?
5
votes
3answers
7k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
2
votes
3answers
74 views

Doesn't Authentication logically imply Non-repudiation? [duplicate]

If it is confirmed that Alice is the source of a message (authentication), then shouldn't she be unable to deny that the message is from her (non-repudiation)? Is there an example where ...
7
votes
1answer
4k views

Facebook login with profile picture?

When I use Facebook, after I log out, I can see my profile picture on the login screen of Facebook. With great curiosity, I click on the profile picture (while I am still logged out) and Facebook logs ...
19
votes
3answers
18k views

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
1
vote
2answers
123 views

What happens when you lose access to the second factor? [duplicate]

Imagine you use your phone number as a second factor to access your e-Mails (e.g. through SMS). What happens if I change phone numbers and then no longer have access to that second factor? Can one ...
-2
votes
0answers
54 views

Fido2 -security and pros and cons [closed]

While 'see fido2 is relatively new to other authentication schemes addressing phishing and mim what are some a) potential vulnerabilities/threats (even theoretical threat models) b) pros and cons of ...
0
votes
1answer
81 views

Permissions API [closed]

We are about to develop an integration with an old system which is still live . Due to technical issues it is not possible to augment the data from the old system using the browser so we are going to ...
2
votes
1answer
65 views

How does the browser know windows logged in user id or Kerberos TGT?

My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
1
vote
2answers
104 views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
0
votes
1answer
55 views

Having a JWT that doesn't expire

I'm trying to understand why having a JWT access token that doesn't expire is bad for my application. The way I have written my backend, when the JWT comes in, I verify it and extract the subject ...
0
votes
0answers
40 views

Learning how to audit a linux system, what does it mean to configure password & system auth?

I'm currently using Linux Red Hat OS, and I need to configure it accordingly to /etc/pam.d/password-auth and /etc/pam.d/system-auth under CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0-1. What page ...
1
vote
4answers
313 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
0
votes
1answer
41 views

BitFinex unauthorized login [on hold]

A few minutes ago i got an email from the real Bitfinex, saying that a unauthorized login attempt was approved by Bitfinix. Is this the work of a new breach? The IP is located somewhere in Japan.
1
vote
1answer
74 views

How to store user credentials in browser securely?

I need help to authenticate User with user credentials. We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
0
votes
1answer
46 views

Is it secure to use a single pair of RSA keys to achieve mutual authentication?

I saw this design recently in an infotainment product. The goal is mutual authentication between two ECUs, E1 and E2. They only care about each other. The basic idea is to keep both keys secret and ...
0
votes
0answers
25 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
3
votes
1answer
121 views

Is there a security benefit to requiring a login before and after a captcha test?

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha. I've been trying to ...
0
votes
0answers
34 views

What is the difference between using an auth header and the request body to send credentials?

I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I ...
1
vote
0answers
49 views

How do I login silently to multiple web applications without user being interrupted to keep their sessions active [migrated]

We need to login to 20 - 30 different web applications and enter credentials to keep user active throughout the day. This needs to happen in the background on user's machine without user being ...
2
votes
1answer
36 views

Known methods/techniques for thwarting credential phising attacks

Is the solution to preventing credential phising attacks is really only 'educating' people about it? For the sake of this question, let us assume that I have a web application that takes a username ...
4
votes
2answers
276 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
2
votes
0answers
61 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
13
votes
6answers
3k views

Is it a security issue to allow nearly identical email addresses when registering?

Say you have a website where it is possible to create accounts for all of the following email addresses: 'test@test.com' 'test@test.com ' 'test@test.com;' 'test@test.com;test2@test.com' Should this ...
1
vote
2answers
78 views

What are the guarantees that TLS provides without using a certificate in the scenario?

Assume a scenario where we have a modular system including: an Authentication Module (AM) which gets username and password of an internet user and issues a token for the user. User<-->AM ...
0
votes
0answers
81 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
1
vote
0answers
73 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
2
votes
2answers
68 views

How do you know which site credentials are sent to when signing into Oauth site in native apps?

I sometimes use these features where I can use my Google account to sign in to different service providers. For example, the Postman app lets me sign in to it using either their own user store, or ...
0
votes
0answers
43 views

How to stop the user from intercepting their own credentials in mobile apps? [duplicate]

We are experiencing fraud with our open API, so we're turning it private. Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API. Request: App -> Credentials -> Auth ...
6
votes
3answers
22k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
0
votes
2answers
86 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
1
vote
0answers
43 views

JWT scheme with different signing algorithms

I'm planning to implement a (slightly non-standard?) JWT authentication scheme with refresh and access tokens, in which refresh and access tokens use different signing algorithms: refresh token uses ...
9
votes
4answers
22k views

Bypassing Windows 10 password with Utilman.exe trick - fixed?

Recently I run into a locked down laptop with Windows 10 OS (actually I guess it was updated from Windows 7 if that matters). My collegue was using this computer some time ago and lost his login and ...
1
vote
2answers
64 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
1
vote
1answer
51 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
0answers
27 views

One-Time Password (Email or SMS) as the Only Authentication Information [duplicate]

I was wondering about the implications (mainly in terms of security) of using a random, one-time use, password sent by email or sms to authenticate users to a web application. The application would ...
0
votes
0answers
52 views

Google SMS verification codes broken on a loop - should I be concerned?

So this is a little out of the ordinary. Not sure what to make of it. I've enable 2-Step Verification on a Google account. When opening mail or other G-related services, it sends an SMS(text message) ...