Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

-1
votes
1answer
52 views

What are the flaws in this security protocol between client and server? [closed]

Here is my security protocol for the use of a service provided by server. It utilises a symmetric key: Client requests to use a service Server sends back nonce Client sends back nonce encrypted with ...
0
votes
1answer
28 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
0
votes
0answers
42 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
1
vote
1answer
55 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
0
votes
1answer
80 views

Suspicious email! “Data removal request”

Please help me. I’m really scared about this and I don’t know what to do. I’ve never gotten this kind of email and I was stupid and replied.
1
vote
2answers
185 views

What's so hard about making a PHP login system?

Say that I have a user account system on my website. When I enter a username and password, it just checks it against a database using prepared statements. If the user tries to login more than once per ...
2
votes
3answers
122 views

Can I completely trust CA?

When a software company sends me 1 file and asks me to install it then I check the signature and it is valid under the Cert (issued by Thwate CA). So is installing that file sent by that company safe? ...
4
votes
1answer
79 views

How do I implement a Microsoft Login into my own website? [closed]

I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code. Obviously I need to ...
1
vote
2answers
53 views

Possible to get sshd (openssh) to log the public key of failed key based login attempts?

As I understand sshd (openssh in my case) typically does/may log the fingerprint/hash of the public key of incoming connections which are attempting to authenticate via key. What I'm looking for is ...
1
vote
2answers
61 views

How to implement secure user sessions using HttpOnly cookies?

I'm creating a web application, and want to allow users to log in (and stay logged in). My plan to support this in a secure way goes as follows: User logs in from a login form - when successful, the ...
2
votes
1answer
155 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
1
vote
2answers
138 views

Getting access and logging into employee's laptop - Can IT get access without the employee's own credentials?

If an employee's laptop is taken back from him/her for purposes of investigation, can the IT department/team that is in charge of issuing laptops etc. log into the employee's network account on this ...
2
votes
3answers
187 views

Why 2FA is not considered flawless when used to secure an account?

Often I see it being discussed that if configured and enabled, 2FA will increase the security of an account, it will add an additional security layer, however an attacker could still gain access to ...
2
votes
1answer
75 views

Does the CA have to be same for mutual authentication?

I'm trying to establish mutual authentication between my Tomcat server and my customer's firewall. The server certificate we have is from Digicert (Root CA) and RapidSSL (intermediate). The ...
1
vote
1answer
37 views

What are the pieces of information delivered in a user profile at the end of a OpenID Connect flow?

From what I understand about using OpenID Connect (over OAuth2), is that we end up with some JSON containing information about the user. That information is transported as a JSON Web Token. ➥ What ...
1
vote
3answers
100 views

Why is client certificate authentication not more common

In my understanding client certificate authentication is not especially complex to implement and have several benefits compared to password authentication The secret (private key) does not have to ...
0
votes
1answer
78 views

Not convinced on the security of a JWT Token + CSRF Token

Lets suppose I have a web application that uses JWT tokens and CSRF Tokens in its authentication scheme. As I understand it, it works like this: When a user logs in, the client sends a login request. ...
107
votes
13answers
19k views

Secure way to log in to a website on someone else's computer

Suppose I am in a situation that I am forced to log in to my account using someone else's computer. Is there any secure way to do that so that I would be sure that my login details (i.e. password) are ...
3
votes
1answer
92 views

Security of email (SMTP/POP) passwords

In my client mail app (ThunderBird) I chose (and my mail server accepted) SMTP with STARTTLS, the POP (or POP3) with SSL/TLS. I understand that this is for mail content from my client app to my ISP ...
1
vote
1answer
84 views

Malicious Google Drive Links

Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
3
votes
0answers
70 views

What is the most secure NFC Encryption system? [closed]

What are the best ways for NFC (Near-field communication) encryption with high level of security? Basically, I am interested in having an NFC which can only be read/authenticated with a mobile app/...
0
votes
1answer
44 views

Mutual Authentication using certifcates

How are digital certificates used to enable mutual authentication between two users? Suppose, at a bank, the employees are required to authenticate each other before transmitting sensitive data. How ...
0
votes
1answer
41 views

Implementing SRP without storing the salt anywhere

I am attempting to use SRP to verify clients when they authenticate with a webserver, so that the password is never sent over the wire. Looking at the SRP procedure, when a client registers with the ...
1
vote
0answers
59 views

How to bypass NTLM HTTP authentication?

Is there any way to bypass HTTP authentication rather than brute-forcing ?
-1
votes
0answers
45 views

Understanding facebook login token

I have a client-server rest-api application. I want use facebook login to authenticate user. When I logged in with facebook using fb api I obtain an access-token. Can I use this token to authenticate ...
3
votes
1answer
176 views

How do I make safe login-emails? (GET/POST) [duplicate]

Vision I envision a login/signup-system, where the user enters his/her email, and receives an email with a link to sign in. The user clicks the link, and is automatically signed in (confirming the ...
0
votes
1answer
35 views

Password hashing on both client and server : what are the risks concerning hash composition (collisions and reversing)?

There are plenty of question addressing the "client / server : where to hash ?", but i have not found anything about my particular question : considering a server_salted_hash(client_salted_hash(...
1
vote
0answers
23 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
1
vote
1answer
62 views

What are the risks of using OAuth for authentication when in control of both ends?

I recently discovered that the applications in our system used plain Oauth2 instead of OpenID Connect to authenticate users. The original use-case was to use OAuth to allow our users to authenticate ...
0
votes
0answers
36 views

Why does my bank show me a picture whenever I try to login? [duplicate]

When I want to login into my bank account, I have to enter three things: username, id, and password. After I fill the username, and before I get to the id field, the bank shows me a picture - the same ...
0
votes
1answer
40 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
-1
votes
0answers
20 views

Necessity of security for the components behind Amazon VPC

While discussing about the securing the components in Amazon VPC, I am having a question about the necessity of having TLS or authentication for the components behind Amazon VPC. In realtime, 'Yes! ...
3
votes
1answer
622 views

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
3
votes
3answers
91 views

What is a simple and secure method to transfer virtual assets?

Consider a MMORPG where users own virtual assets like magical swords or rings that can be used by the player. This system needs a safe method for transferring assets from Alice to Bob. One ...
5
votes
3answers
431 views

Is this password-less auth flow secure?

I'd like to implement a password-less auth flow for my mobile app that only requires a user clicking a link in their email to log in. Similar to how Slack handles auth. I'll be using node and jwt for ...
2
votes
2answers
52 views

Account lockout to protect from brute force: doesn't it open up vulnerabilities to DOS attacks? [duplicate]

AFAIK the recommended practice to mitigate brute force attacks is to lock an account down for, say, 15 min (perhaps escalating lockout time if the attack continues afterwards?) after, say, 5 failed ...
0
votes
1answer
45 views

SSH: Best practice for PublicKey Authentication from multiple Devices

I have a Server I want to access via ED2559 PublicKey Authentication. How would one do it so it is as safe as possible from multiple devices? Should I add multiple PublicKeys to my Server or should I ...
1
vote
1answer
44 views

Should I refresh access token

There is a case when a specific authorized user changes his password or email. As email or password is part of user authentication, I think that it is necessary to revoke all auth tokens But, how to ...
0
votes
1answer
54 views

Securely connecting a wifi client to an AP using a generated password

I have two embedded systems, one acting as an AP with WPA2 and the other as a client. The idea is for a user to connect their client to the AP without any setup, so the authentication will all be ...
0
votes
1answer
41 views

What is a good way to authorize a client at a time to perform an action through websockets?

I am working on a round based web game where only one client/player at a time can perform an action. Throughout the game every player will have a websocket connection to the server. The client will ...
0
votes
3answers
96 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
0
votes
2answers
65 views

How to monitor password protected web page

I want to use a website monitor to check that a web page is working but the web page requires that the user is authenticated. Is there a crafty way of achieving this that doesn't require storing an ...
2
votes
0answers
39 views

How to give end users access to accounts previously only administered by managers?

I have a question about how to handle a somewhat unique authentication situation. We have an existing system with lots of users that have never had direct access to their accounts before. They have ...
0
votes
1answer
122 views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
1
vote
0answers
330 views

SSL routines:ssl3_read_bytes:sslv3 alert bad certificate

Running the following command: curl -v --key client_key.key --cert client_cert.crt <some url> -u <username> I get the following response: * Trying XX.XXX.XXX.X... * TCP_NODELAY set * ...
2
votes
2answers
125 views

Why is it still necessary to block brute-force attacks when passwords hash verification requires significant work?

For authentication controls, Owasp gives advice to prevent brute-force attacks by locking out account, and I see this kind of advice in several places (blocking by source IP after failed logins, ...
1
vote
1answer
25 views

restoring logged out gmail session in running instance of chromium browser?

My situation is: +I have created a special purpose gmail account +I used a complicated password to protect the account. On purpose, I did not use any 2FA options are a "reset" email address or phone ...
4
votes
2answers
159 views

Telegram (or other messenger) message as second factor in 2FA

Is it safe to send code via messenger bot and use it as second factor in auth? The scheme looks like the same as SMS one. A user opens application or look at a push notification and use the code. Why ...
-1
votes
1answer
43 views

Logging in to a website using my gmail account gives away my location but I can access the trail content without logging in. How? [closed]

When I use a VPN (Tunnel Bear) to India from USA and access Hotstar.com it takes me to the Indian version of the website. I can access and watch the trail streams offered but when I log in to the ...
0
votes
1answer
61 views

My site is asking for authentication username and password [closed]

Myt site Hoodtrends is requesting for Authentication username and password. Please can someone help me out with this?