Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
1answer
17 views

Which party stores the link between user and device in WebAuthn?

Looking at the online resources regarding WebAuthn, I still haven't been able to figure out which of the involved components (or parties) that store the link between the user and his/her authenticator ...
1
vote
2answers
60 views

How to provide personal User Page after User already signed up without Password?

I created a small website where participants can sign up with some data (name, email, birthdate, ...) but they don't have to set username and password. After a while it would be useful to provide ...
3
votes
1answer
46 views

PCI DSS minimum password strength equivalent in passphrase

The PCI DSS requirement 8.2.3 says: Passwords/passphrases must meet the following: Require a minimum length of at least seven characters. Contain both numeric and alphabetic characters. ...
0
votes
1answer
36 views

How does using an auth server for mobile app and not storing API keys on client add security?

I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
4
votes
1answer
334 views

Is a security question you just have to 'remember' a good idea?

I was setting my eBay security questions and one of the choices were: Now I've seen sites that allow you to "type your own question" and "type your own answer" but unless they forgot a text field, ...
7
votes
3answers
270 views

Is PuttyGen secure?

I'm using PuttyGen to generate ssh keys for various windows computers. It requires a lot of manual user input, specifically in the form of swirling the mouse around in the window pane. I understand ...
1
vote
3answers
4k views

ASP.NET Web Forms is not generating a new session ID if a user logs out and logs back in

ASP.NET Web Forms is not generating a new session ID if a user logs out and logs back in. Is this a major security risk? We're using SSL.
2
votes
1answer
38 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
0answers
24 views

Can attackers intercept my credentials on an insecure site if I log in through a 3rd party service?

I recently visited a forum using non-secure protocol (HTTP) - Chrome flagged a warning at the top saying I shouldn't enter any passwords or personal information onto the site, as they could be ...
42
votes
3answers
9k views

Is there any advantage to splitting a password?

I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm. The LM hash is computed as follows: The user’s ASCII password is converted to uppercase. This ...
2
votes
1answer
657 views

Vulnerabilities of using a token based authentication such as this

I'm developing a backend REST API for one of my mobile apps. I'm looking to create a token-based authentication system that would allow for a persistent login and I'm wondering if there are any ...
0
votes
1answer
486 views

Break into WPA2-Enterprise RADIUS wifi network by stealing credentials

I need to ensure that no un-authorized DEVICE gains access to a wireless LAN network. Notice I said, "device". This means that I need to ensure that only authorized personnel can join the LAN and ...
9
votes
1answer
9k views

What are the differences between the RSA, DSA, and ECDSA keys that ssh uses?

In my /etc/ssh/ directory, I can see three that I have three different types of ssh keys: -rw------- 1 root root 607 Oct 4 22:43 ssh_host_dsa_key -rw-r--r-- 1 root root 623 Oct 4 22:43 ...
8
votes
4answers
14k views

Bypassing Windows 10 password with Utilman.exe trick - fixed?

Recently I run into a locked down laptop with Windows 10 OS (actually I guess it was updated from Windows 7 if that matters). My collegue was using this computer some time ago and lost his login and ...
64
votes
7answers
15k views

Is it unsafe to show message that username/account does not exist at login? [duplicate]

According to the OWASP Auth Guidelines, "An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to ...
0
votes
0answers
63 views

What prevents a third party to use public API keys

In many cases, I have to add a public API key to my website (or application). For instance, in order to have an embedded map on a website, one could use google maps, and be required to provide an API ...
2
votes
0answers
35 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
4
votes
4answers
270 views

Public API security: authentication vs. rate limiting etc

We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
-1
votes
0answers
19 views

Security workflow for intranet web application

The applications I develop (mostly ASP.NET MVC) are internal applications that are going to be exclusively used in an intranet domain working under Active Directory. Since every employer has to log in ...
0
votes
1answer
212 views

Is telegram SMS login secure?

TL;DR: Can 1) A random hacker access my telegram account by entering my phone number on the official web.telegram.org authentication portal and hijhacking the SMS code they send? or 2) A "telegram ...
0
votes
0answers
16 views

Save SAML AuthnContextClassRef at login and use when signing?

I want to force reauthentication when a user signs a document using ForceAuthn and RequestedAuthnContext / AuthnContextClassRef (to bypass browser caching authentication) in the SAML request. Is it a ...
1
vote
0answers
30 views

Is it secure to start a NTLM handshake not knowing if the server supports it?

I am writing a program in Python using the requests-ntlm library. That library adds support for NTLM in regular requests: import requests from requests_ntlm import HttpNtlmAuth requests.get("http://...
0
votes
0answers
30 views

How to make use of httpd API function to bypass authentication?

This is my first question and I'm completely new to learning about information security. If I've violated any rules while asking this question please let me know, so I can improve it! I am trying to ...
0
votes
0answers
40 views

How do I protect my BE endpoints from FE?

Is there any way to secure the endpoints from frontend? I have an API written in NodeJs and I have a frontend website written in AngularJS and app in ionic. I had jwt token from the backend to ...
2
votes
1answer
30 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
2
votes
1answer
65 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
0
votes
1answer
26 views

capture authorization code programmatically in OAuth 2.0

In a standard OAuth auth code Grant flow, user is redirected to authorization server page where he provides consent to allow the requesting app to perform some actions on his behalf, after which a ...
-2
votes
1answer
38 views

Security issues with 2-Step Verification Using SMS - Am I missing any vulnerabilities?

In order to increase security on sensitive data, I want to add 2-Step Authentication, using SMS. Note, this would be used on a website that should never have more than perhaps 30 users. I'm ...
2
votes
2answers
50 views

User login failure - valid error messages [duplicate]

I am currently working on a web portal which allows users to login via standard authentication credentials (username, password). However, I'm required to return appropriate error messages when the ...
1
vote
0answers
38 views

How can this Authentication/Authorization flow be improved?

I am currently building a full stack web app mainly as part of an exercice. This app is made up of a back end on a server (written in Go), and a front end written in Angular (so on a user's browser). ...
46
votes
2answers
26k views

I just send username and password over https. Is this ok?

When a user's logging in to my site, they send their username and password to me over https. Besides the ssl, there's no special obfuscation of the password - it lives in memory in the browser in the ...
0
votes
2answers
53 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
3
votes
1answer
3k views

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
1
vote
0answers
81 views

OAuth 2.0 + OpenID for authentication in mobile apps

Current Way We have a mobile application that uses SMS based OTP for logins. Till now, since the app was considered as trusted party, we had no authorization flow like in OAuth. Our flow was (similar ...
0
votes
0answers
28 views

Solutions for sharing a single web session among services in different languages

I have a system where I am running apps written a mix of Java and another language (TCL), and I am looking for there to be a single login session of the application. By single login session I mean ...
0
votes
0answers
27 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
0
votes
0answers
36 views

Is it okay to implement key files via HTTPS form?

I've been messing around in VeraCrypt and KeePassXC for a while now. And I'm trying to improve my privacy and security. I've been experimenting with different authentication methods. VeraCrypt and ...
3
votes
3answers
120 views

How do I use a smart phone as an authenticator in the new Web Authentication specification?

I have been learning about the new Web Authentication specification. I am a little confused as to how the following use case would work: A user wants to login to an enterprise web application on ...
1
vote
0answers
42 views

XSS and CSRF Protection in a SPA with session cookies and auth in sub-domain (confused)

The problem is, that the more I read about XSS and CSRF and the protection against these attacks for my website, the more I get confused what would be the right strategy. Setup: SPA (Reactjs and ...
2
votes
1answer
51 views

Where custom auth source code fits into the micro-segmentation, zero-trust architecture

So micro-segmentation seems a bit of a buzz-word, but it helps in painting the picture of how to better do security in a network. Basically from what I understand divide the network into a bunch of ...
2
votes
1answer
75 views

How to get user and verify password so that the usernames are kept private?

According to the OWASP guidelines: Authentication failure responses should not indicate which part of the authentication data was incorrect. For example, instead of "Invalid username" or "Invalid ...
7
votes
4answers
2k views

Adding “Email or Username” in login page, is it safe?

Let's suppose a website has a login page with "Email or Username", and shows the username publicly to every user on that site. Does that make it easy for an attacker to hack other people's account?
0
votes
0answers
27 views

Proving that a certain site had given page at certain time [duplicate]

Lets someone opens https://foo.com and saves the page using "save page as". Is there any way to prove later that the locally saved files have not been altered assuming that we trust the server public ...
0
votes
1answer
95 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
0
votes
1answer
44 views

Explanation of the authentication procedure when using signed certificates [duplicate]

I am using AWS IoT with X.509 self-signed certificates for authentication. To communicate with the cloud I use MQTT. On my device side, I have a device certificate ( deviceCert.crt ) and the device ...
0
votes
0answers
13 views

Communicating with things on AWS IoT without certificates problem

Is "IAM" access the only method to gain access AWS? I'm asking because I'm using AWS IoT. With AWS IoT we create things such as devices on AWS IoT Core. However, with IAM access, after creating a "...
0
votes
3answers
5k views

Identity and Access Management (IAM/IdAM) deployment guide

I'm working on a set of applications that require authentication and authorization. Can you point me in the right direction to some architecture design for this when I want to have multiple services ...
0
votes
1answer
83 views

Two-party symmetric key establishment protocol

Update: original problem description I am developing a client-server system for configuration updates. The system handles update tasks. An update task is initiated on a server; multiple clients then ...
1
vote
1answer
51 views

Where does last 4 bytes of hmac go in wpa2 mic?

The wpa2 mic is a 16 bytes array which is built by Hmac(sha1) ,But the Hmac(sha1) returns 20 bytes array. So where does that 4 bytes go?
0
votes
1answer
107 views

What is the protocol used for authentication/authorization of my internet access using account inside web browser?

Our university uses Microtik devices and a 3rd party application to manage our access to web and internet services. When I open browser in my desktop or connect to a wi-fi access point, it prompt that ...