Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

0
votes
1answer
545 views

Hardening a asymmetric key based authentication process

The process involves two interested parties A (client) and B (server) and the attacker M. M is capable of intercepting all the communication between A and B (Man in the Middle) and even modify it. ...
1
vote
1answer
117 views

Is this the correct way to use AWS Cognito?

I am doing the following in my React/Node App: Using the User Pools for a Cognito App that I have created Calling the /login endpoint with response_type=token in my React App Once I receive the JWT ...
61
votes
6answers
10k views

What should a verification email consist of?

Right now I'm generating a 25 character string stored in the database that can only have a 1 time use and expires 30 minutes after user registration. http://example.com/security/activate/...
2
votes
4answers
144 views

Is an authenticated server seeing the plaintext password a serious problem?

Typically a server ends up observing the plaintext password sent by a user at some points (correct me if it is not). Assuming that there is a secure channel established and the data are confidential, ...
0
votes
1answer
63 views

Verify the requesting domain

I have a both a http and websocket server written in nodejs (for now) and it will be receiving requests from many different domains. The request is made from the client using JS. I need to verify 100%...
0
votes
1answer
47 views

How can I make my Windows Server accessible from another Windows PC over the internet safely, without using VPN?

First, some backrgound context as follows: I have a Windows Server 2008 running for my company. It contains an ERP, which is accessible by other computers/clients on LAN. During the client setup, the ...
1
vote
0answers
17 views

Root CA and Intermediate CA security [duplicate]

I'm confused how intermediate CA's adds to the security of the PKI. I realize the compromise of root CA key is catastrophic as it would've to be consequently purged from the trust store of every ...
1
vote
2answers
95 views

What is the point of 2FA if the recovery code (which is only one factor) can be used to access the account anyway?

I think the title says it all, but to elaborate: If, say, someone were to find my recovery code, could they not then gain access to my account? Similarly, could then someone not just hack my recovery ...
1
vote
1answer
52 views

What are the disadvantages of using Shamir's Secret Sharing to implement a Partial Password scheme?

Suppose I want to implement a partial password scheme, where the user authenticates by using two passwords: one a normal password, the other is partial, where he only needs to type the selected three ...
2
votes
1answer
50 views

What is the proper flow for authentication?

I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific ...
4
votes
1answer
63 views

Generating QR code from seed in browser - possible security issue?

I need to implement 2FA in my web app. I'm doing this the standard way: the newly created user's seed is retrieved from the server(I use speakeasy) and the QR code is generated. The thing is, it's ...
5
votes
1answer
73 views

Can I use `lsof` to reliably determine which local process has connected to my open port?

Say I'm running a server application on 127.0.0.1:7646 and a local process (possibly owned by a different user) connects to it, I can run lsof -Fp -i TCP@127.0.0.1:7646 -i TCP@127.0.0.1:<...
1
vote
1answer
129 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
1
vote
2answers
82 views

Why digital signatures needs different algorithm

Why digital signatures uses algorithms such as DSA, ECDSA or RSA-PSS, and not just the RSA algorithm to encrypt the message hash with the private key? Is the choice more security or performance ...
2
votes
4answers
177 views

How can I maintain my two factor authentication when my phone is in for repairs?

I recently got a new phone that has various hardware issues with it. As such, before the warranty expires, I need to send it back for repairs. Unfortunately, I already have Google Authenticator ...
1
vote
1answer
34 views

What's the point in a proxy server authorizing/authenticating clients?

I've implemented a SOCKS5 proxy library, but I just don't get the point of authenticating (or encrypting) connections, which the RFC (1928) seemed pretty adamant about. Isn't anonymity the whole idea ...
0
votes
1answer
31 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
1
vote
1answer
49 views

How to authenticate a specific client program? [duplicate]

I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
0
votes
1answer
44 views

Multiple contributor security for blog

I currently develop a big blog website with Firebase as my backend just for information. Right now (not released/published the page yet), I give my authors accounts special rights to access pages ...
70
votes
3answers
28k views

CVE-2018-10933 - Bypass SSH Authentication - libssh vulnerability

Looks like CVE-2018-10933 was just released today and you can find a summary here from libssh here Summary: libssh versions 0.6 and above have an authentication bypass vulnerability in the server ...
9
votes
3answers
361 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
0
votes
2answers
62 views

How can I secure a REST service intended to be used by my customers' customers via their public website?

I am developing a service with an associated REST API for customers (companies which have their own websites) to use. In other words, one of my customers would typically make the REST call directly ...
2
votes
1answer
97 views

Allowing unauthenticated user access web page information

Our web application should allow unregistered users to browse certain information. This information is returned by apis Currently we are using hardcoded guest login to achieve this The mere ...
1
vote
1answer
144 views

OAuth 2 Implicit grant type for first party SPA - Most secure and sensible way

My aim is to secure my stateless API and only allow the registered first-party clients (SPA) to consume my resources. There is not going to be any third party clients in my scenario. I know Oauth 2 ...
0
votes
1answer
37 views

How does Authenticator gets the PMK which is used to calculate PTK?

I am trying to setup a Supplicant- authenticator and AAA server to perform EAPOL mechanism. I am able to successfully completed the EAP authentication procedure but 4-way handshake was not initiated ...
2
votes
1answer
58 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
0
votes
0answers
24 views

Use local administrator and Domain Cached Credentials to obtain access to AD domain?

I have obtained local administrator privilege on a Windows machine connected to AD domain. Using Mimikatz I see the Domain Cached Credentials of a few Domain Admins. I know that, it is possible to ...
2
votes
1answer
53 views

Security implications of auto-submitting OTP?

So the question was originally asked as a part of the UX question here. My question is that, Are there any security risks involved when I auto-submit the OTP? Currently, I'm limiting the number of ...
0
votes
1answer
44 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
1
vote
1answer
79 views

Do hacks of mainstream web applications tend to happen more from random attackers brute forcing or from targeted heuristic attacks?

I'm writing up advice for selecting a master password for a password manager, and I'm wondering if there is available data about the likelihood of different attacks that result in a cracked password. ...
2
votes
0answers
44 views

Verifying the source of a request [duplicate]

I am currently writing a network multiplayer game that uses a lobby system to find available matches for players to join. The list of available matches is served and updated by a web application via a ...
2
votes
1answer
70 views

How to properly deal with different user-facing login mechanisms?

I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier. For example, the user can have access using OpenId, OAuth or token. But how can we "help" the ...
38
votes
8answers
13k views

Is brute force a probable threat even if you enable CAPTCHA and rate limit logins?

Let's assume CAPTCHA is enabled with account lock out control (after five continuous failed attempts, the account will be locked for 15 min) on a system. Is brute force still a probable threat?
3
votes
1answer
92 views

CVV credit card change [closed]

Is there a certain formula that the bank uses when changing the CVV (Card Verification Value), on a credit card. If I am trying to keep credit cards on file and they expire I know there is a form that ...
0
votes
1answer
35 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
1answer
77 views

Gmail sign-in with 2 step verification secure enough for money-generating YouTube channel [closed]

My goal is to find out if the sign-in process of a personal Gmail account with 2-step verification turned on, is enough from a security point of view, to serve as the sign-in process for a YouTube ...
3
votes
1answer
203 views

How does Google save authentication information in the browser? [duplicate]

When I open Gmail in the browser, I automatically log in. I believe this is because of the previously saved cookies. If I remove cookies I need to sign in again. It means Google saves some auth keys ...
1
vote
0answers
142 views

OWASP ZAP : How to perform authentication when API endpoint only accepts raw XML?

I'm currently working at testing an Angular 6 application using OWASP ZAP. I really enjoy this tool, but like many of us, I struggle with the authentication part, and without it the whole tool turns ...
1
vote
0answers
42 views

How does using an app rather than code card to authenticate improve security?

Our bank used to issue code cards, with 72 passwords printed on them. To login to net bank we used to need to know: Our bank account number (we have that written down) A password we've picked. We ...
4
votes
2answers
277 views

How can you access a Facebook account if you know the access token?

Facebook discovered a "security issue" affecting 50 million accounts. According to Facebook, This allowed them to steal Facebook access tokens which they could then use to take over people’s ...
1
vote
1answer
163 views

Are partial passwords a security improvement over full passwords?

With full password authentication, you need to enter the full password every time. With partial password authentication, you're asked for some subset of the password each time, and which characters ...
0
votes
1answer
59 views

Is using HOTP only authorization considered weak?

Migrated from ServerFault, as advised there. I have seen many experts advising usage of some kind of OTP as second step of 2FA schemes. I fully understand 2FA is more secure than Single ...
2
votes
2answers
433 views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
1
vote
0answers
80 views

What is the essence of Google Chrome’s new controversial sign-in feature?

What is the essence of Google Chrome’s new controversial sign-in feature? How does it work and how does it differ from what was it before? What is the danger of it? Is Chromium affected?
2
votes
1answer
122 views

How does server use session key after tls handshake?

After TLS handshake both server and client agreed about session key to use as symmetric key. So server must store several session keys which each one belongs to a specific client. How server ...
62
votes
5answers
14k views

Logged out of Facebook on all devices on a sudden. Should I be worried about being hacked?

A while ago, I was opening Facebook app on Android and then I got the message "Session expired. Please log in again.". I then tried logging in with my current password and was success to log in my ...
0
votes
1answer
58 views

Is it safe to receive (One Time Password) OTP to the Mobile where the online banking application is installed?

Assume a customer of a bank is using online banking facility and he is using an online banking application on mobile (android). There could be a possibility that particular mobile could be ...
-1
votes
1answer
78 views

Port knocking is authentication?

In computer networking, port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. Once a correct sequence of ...
0
votes
1answer
209 views

Empty password field in /etc/passwd

I am reversing a firmware update and found a empty password field in /etc/passwd root::0:0:root:/:/bin/sh otheruser:x:0:0:otheruser:/bin/false Do I need a password to login as root? I found out, ...
1
vote
1answer
37 views

Is Browser based flows required for most IdP based Authentication standards?

I'm going to apologize in advance for the rambling nature of this question, I've read a lot about SAML and OIDC and other standards, just trying to understand why browsers seem to be so essential for ...