Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

4
votes
1answer
97 views

How to Best Minimize Damage After Loss of Computer

Myself and the rest of my coworkers on my (former) employer’s dev team were all just laid off from our jobs, and the employer took our MacBook Pros without letting us clear of our personal information ...
0
votes
1answer
38 views

Json Web Tokens with anonymous login

I have inherited an app that allows users to buy a gift card, and then see the gift card details after they have bought it. There are 4 main API calls - one to buy the gift card, one to get gift card ...
3
votes
3answers
133 views

Login system using permanent “random” hashes in URLs

I am working with a company and have found the following: When a user registers, they make a "random" hash. This "random" hash often has collisions and has to be regenerated to keep the hash unique ...
2
votes
0answers
33 views

Using a GUID as an authentication token (and how it could be improved)

I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using ...
1
vote
1answer
76 views

Should I treat my SSH username like a secret?

I'm trying to automate the deployment of my blog. Most CI providers are using virtual machines/Docker containers with Linux, so I'm learning about shell scripts and SSH now, which is all new to me. ...
1
vote
0answers
76 views

Using Google Authentication with Lambda@Edge and S3 Static Sites

I am looking to set up authentication on an S3 hosted static site. The configuration is: S3 bucket configured to allow access via cloudfront AWS Cloudfront distribution with HTTPS configured and a ...
0
votes
0answers
33 views

Hybrid cloud access controls

In a hybrid cloud setup, where we have a cloud component which writes data into an on premise component, is it necessary to have separate access controls between the cloud and on premise? Our ...
2
votes
1answer
30 views

Providing access to Git repo behind a Firewall using Certs/Keys for Authentication

We have a Git repo sitting behind a firewall. As I see it, there are two ways of authenticating/accessing the Git repo: Add a Reverse HTTP Proxy in the DMZ that communicates with the Git repo. This ...
0
votes
0answers
96 views

Customer asking for a sign out that does not really sign out to obscure that the user is not signed out

I have a customer running my application with SAML SSO. This solution supports SLO (single logout). Due to their environment, a logout does not always sign the user out of the SAML IdP. This results ...
3
votes
2answers
223 views

Why not store password in cookie?

I've got a novice question - It is often said that you should not store plaintext passwords in a client-side cookie. (I'm imagining a web browser cookie, but I supposed this applies in general.) But ...
0
votes
0answers
43 views

Why is it recommended to use GCP service accounts vs user accounts?

I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
1
vote
1answer
51 views

Account identified only by name, surname and date of birth

I am working in QA field and we have a project about a famous booking website. I have discovered that if I create an account with the same name, surname and date of birth of an already registered ...
1
vote
1answer
56 views

Truly Disabling Session Tickets in Windows 10 Schannel

In windows 7, session tickets were disabled by disabling schannel cache, example: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL] "EventLogging"=dword:00000004 "...
1
vote
1answer
25 views

3rd party client authorization

Let's say I'm main.com and my service is used by website owners clienta.com clientb.com I need to verify the identity of users of client websites. (authenticate them) My plan is implementing a ...
2
votes
2answers
65 views

Why refresh token if I can reauthenticate?

So I have a backend service (batch service, no user access), everytime I make a request I need to call the token endpoint and send my username/password in the header then it returns an access token ...
2
votes
1answer
76 views

What does a Let's Encrypt (or other DV) certificate prove?

This is a follow-up to other questions like "What makes Let's Encrypt secure?". When I first run the Let's Encrypt (certbot) client on my server, it obtains a certificate by publishing a certain file ...
1
vote
1answer
53 views

Temporarily blocking too many login requests for only the targeted accounts

When temporarily blocking a client by IP address making to many login attempts, what are the security implications of only restricting them from attempting the same login email/username again for a ...
0
votes
1answer
47 views

Mobile apps that use OAuth2 to offload authentication to a 3rd party: are they misusing OAuth2?

I have been tasked with building a mobile app that requires users to login to a 3rd party service via OAuth2 to obtain some data about them. This mobile app also requires its own backend database ...
0
votes
0answers
17 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
0answers
24 views

Are there alternatives to SASL?

Are there any alternatives to SASL? Is there another standard authentication framework that abstracts the authentication mechanism from the protocol in the way that SASL does? To be more specific ...
0
votes
3answers
93 views

Shared terminal security hole

I want to ask you about what I think is a pretty obvious security hole and what can be done about it. Suppose my library has a room containing network-connected workstations serving Linux. You log on ...
4
votes
1answer
66 views

Can password strength be enforced with PAKE protocols?

Can a password strength policy i.e.: must contain at-least 8 chars must contain one uppercase letter must contain one lowercase letter must contain one number Be enforced if a PAKE protocol is used, ...
0
votes
1answer
33 views

Why does thw JWT wordpress plugin recommend storing the token in a cookie/localstorage?

Reading about JWT I've come with a very interesting topic, which is the jwt tokens vulnerability if they're not properly secured when using with wordpress. So, the thing is that storing the token in ...
1
vote
2answers
125 views

When you enable 2FA, why is your second factor required to reset password?

In a conversation with a coworker the other day, I had trouble successfully defending why, when you enable 2FA on a service, you're required to enter a second factor before changing your password (in, ...
0
votes
0answers
33 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
0
votes
1answer
80 views

How to intercept ntlm authentication based application?

There is an internal application which authenticates based on windows credentials (NTLM Authentication). It is not intercepting while in proxy with Burp Suite and is stuck in login pop-up even after ...
2
votes
2answers
73 views

Are there use cases where a mutually authenticated TLS is preferred?

I am trying to see if there are use cases where a mutually authenticated TLS is preferred over a one way authentication. Usually the authentication of the client/user is done over the TLS tunnel. ...
1
vote
0answers
18 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
1
vote
1answer
36 views

Active Directory Certificate authentication trust

When setting up Smart card authentication you publish that Intermediate/Sub CA to the NTAuthCertificates object in Active Directory and certificates from that CA will now be OK for certificate ...
0
votes
1answer
58 views

An authentication protocol to prevent phishing & solve the problem of password reuse?

When writing about best practices for authentication, I find that today's best practices still leave gaping holes in security, specifically not solving the problem of password reuse by users - ...
0
votes
2answers
31 views

Confused about GitHub's GPG key association and authenticity

I'm not sure I understand GPG, and something on GitHub has left me wondering. In git, a GPG private key can then be used to sign commits, which allows someone who is in possession of the public key ...
1
vote
2answers
139 views

How secure is this schema for Online Licensing System?

I'm trying to make a good licensing system without affecting user's experience and at the same to make it as secure as possible. I know it's impossible to make it 100% secure, but I would like to make ...
1
vote
0answers
31 views

Most used Linux terminal tools that take passwords as a parameter [closed]

I am writing a tools that basically searches scripts and configurations files for hard-coded passwords. My first approach is to identify the most commonly used Linux terminal applications that can be ...
2
votes
1answer
77 views

Problems with this 2 factor authentication implementation

I'm implementing my own 2 factor authentication using SMS. We have a gift card service and the users are sent a link to their gift card. Every time they click on their link, we are verifying it's ...
1
vote
3answers
130 views

How Secure is OAuth2 for Web Applications?

Let’s consider a single page client side application, developed using HTML and Javascript. In this case, even if the implicit or authentication code flow is being used to request Access Tokes, still ...
73
votes
8answers
14k views

Is displaying remaining password retry count a security risk?

Some websites display a remaining password retry count when I input wrong passwords more than twice. For example, displaying that there are 3 retries remaining until locking out my account. Is this ...
0
votes
1answer
72 views

How does Google Authenticator interact with apps on an iPhone?

I am clear on how Google Authenticator works when logging on to a website and I am clear on that. However, these days everyone is using apps for everything. The Twitter app, the Facebook app, the ...
1
vote
1answer
39 views

Is the CN field on an SSL cert a secure form of authentication?

I'm using TLS client authentication for a machine-to-machine connection. In addition to ensuring the client has a valid cert, I'd like to have access control to ensure the request is originating from ...
0
votes
2answers
51 views

How pincodes used as an authentication mechanism?

I'm designing a login system for my mobile app where users only need to provide a pincode to authenticate into the app after they sign-up. I'm more wondering how the backend would work in such a ...
1
vote
1answer
73 views

Is it a good idea to notify a user that they signed up with a social-login account?

Say my website provides three main ways to signup/signin: Google, Facebook and typical username/password. Is it a good idea to flash "Please login using your Google account" if a user tries to login ...
1
vote
2answers
162 views

Why would an attacker try SMTP login many times even though it is disabled?

I recently set up an SMTP server for myself to use, and I am getting some traffic from two IP addresses and none else (though for obvious reasons I will not state the addresses here). An example ...
1
vote
0answers
133 views

OpenID connect authentication with cookie authentication middleware [Asp.Net MVC ]

In my ASP.NET MVC based application I am using 'OpenID connect authentication' middleware with 'cookie authentication middleware' (session/transient cookie). While accessing the application I ...
1
vote
1answer
29 views

SOAP Web Service: Basic Auth. vs Password in xml

I am testing a SOAP web service and the service sends username and password in every request as part of the XML body over SSL. I wanted to object to that and offer Basic Auth. but could not find any ...
4
votes
3answers
145 views

Drivers license required for online purchases

Problem I tried to buy a few things from a particular industry, and the sellers are independently all asking for a copy of my drivers license to verify that it matches the details on the card because ...
2
votes
2answers
136 views

Is it possible to make a login safe without a TLS certificate?

I'm using free hosting and I would like to know if there is a way to have a safe login system without a TLS certificate. All I do with this server is: POST HTTP Request with username and hashed ...
1
vote
1answer
102 views

My boss installs software using domain admin. Should I show that this is bad?

At my workplace, users on most workstations (Win7 and 10 blend) do not have local admin rights. As a technical team we often need this for software installs, and so the director gets called around to ...
0
votes
1answer
77 views

How can I verify a company's identity?

I'm a web developer working on a project for a client. To keep it short, the project has company listings. These company listings are not provided by the companies themselves and instead it is just a ...
2
votes
1answer
149 views

Why are pins required on boot on devices with fingerprint readers? [duplicate]

Both my iPad and my android phone are configured to allow access via either a pin, or a fingerprint scan. However, immediately after a reboot, neither device allows a fingerprint for the first unlock; ...
1
vote
2answers
66 views

Can Asymmetric encryption be used instead of modern authentication strategy?

Assuming that I have a way to associate a combination of public private key encryption with real people/user. The private key is stored on the device of the user. User have to communicate with some ...
1
vote
0answers
24 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....