Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

4
votes
2answers
118 views

Deal with API Webhooks that refuses authenticating itself

I'm currently in the process of writing a connector to an API. It's for an automated shipping system and I'm required to listen to events from that given API, sent via Webhooks. The API owner does ...
1
vote
2answers
71 views

How to authenticate using RSA avoiding MITM attacks

During my lessons of information security the professor told as that Alice can authenticate to Bob in the following way using RSA: Bob generates and sends a Nonce to Alice Alice signs this Nonce with ...
0
votes
0answers
201 views

Storing JWT in cookies vs Authorization: Bearer?

I don't want to store my JWT in localStorage due to XSS, so i want to know the difference between storing JWT in Cookies vs Auth Header
4
votes
2answers
352 views

Why we store session id instead of user id inside cookies?

Would not it be better to store user id instead of session id so that we only lookup database once for extracting other user info instead of twice extracting user id from session db then user db?
0
votes
1answer
100 views

How to implement machine tagging when allowing a user to “remember me” on web application? [duplicate]

The remember me cookie should identify the machine as well. So by implementing machine tagging, we will avoid a situation when an attacker tries to login with the user cookie from another machine. ...
2
votes
3answers
56 views

Is using a username and smart card two-factor authentication?

Is username counted as one-factor, something you know? A smart card (which contains the username and user information inside the card) is something you have. What if the smart card doesn't contain ...
1
vote
1answer
75 views

How do I act as a go-between for two parties that do not trust each other?

I am speculating on the design of a system that allows trusted information exchange between two parties. Party A: Is a large corporation. Wants to offer access to their employees via a single-sign-...
0
votes
3answers
116 views

Anything particularly wrong with putting an auth code in marketing emails?

I've been working on my first project, and my initial registered users haven't been particularly sticky. I'd like to send them an email with some news and information and have them be instantly logged ...
0
votes
0answers
77 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
34
votes
5answers
5k views

Bypassing the command/script specified in /etc/passwd

Consider the following line from /etc/passwd: sadeq:x:1000:1000:Mohammad Sadeq Dousti,,,:/home/sadeq:/bin/custom-script.sh The last part, /bin/custom-script.sh, shows the command/script to be run ...
2
votes
2answers
84 views

Is RSA key-like browser authentication feasible?

I see that password based authentication is out of favor today, and Internet is moving toward RSA keys-based authentication. Coming from that fact, I am wondering if there would be a real benefit to ...
-1
votes
1answer
116 views

Auto-Fill Windows Security Credentials

I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing) If I don't do that I will have no internet connection on my laptop ...
0
votes
0answers
45 views

How does Github authentication work (command line, api)?

I'm currently working on a project in which I have a tiny server which I am giving a friend root access to. I'm not worried about this, the server is disposable, if something goes wrong it can wipe ...
6
votes
2answers
163 views

What are the circumstances in which it's not foolhardy to have access to your primary email address through your smartphone?

Most web sites I use allow a password reset through email; a few require two-factor authentication with a phone call or SMS. It would perhaps only be banking or major commerce sites that would require ...
0
votes
0answers
12 views

Can API Consumer be SAML token provider?

I am a newbie to SAML based authentication. In a typical B2B enterprise setup, I need to consume an API provided by another organization. API provider has two factor authentication enabled, mutual TLS ...
1
vote
1answer
81 views

AEAD and nonces explained in layman's terms (Symmetric encryption example using Libsodium)

After almost 4 days of work, I've finally gotten Libsodium crypto_aead_xchacha20poly1305_ietf_encrypt to work and produce the same result in JavaScript and PHP. But I'm confused. The PHPDoc ...
226
votes
3answers
33k views

Why did I have to wave my hand in front of my ID card?

I recently had to authenticate myself online to use an internet-based service. The authentication process was done via video call with me holding my ID card in front of my laptop camera beside my face....
3
votes
1answer
80 views

Certificate based authentication

Can certificate-based authentication systems be bypassed in a MITM attack over WiFi ? I was just looking at a service called REMME and was wondering how secure it actually is.
6
votes
1answer
141 views

How can companies verify that a national security letter is real? [closed]

It looks like that US national security letters are a prefect way of social engineering: they request confidential data from you and includes a gag order forcing you no to tell anyone about it. There ...
0
votes
0answers
38 views

WPA2 IV all zero in EAPOL message of 1,2 and 4

While we know that in the best practice in any AES communication is to not use a constant or all zero IV. However, when I capture my authentication progress between my STA and AP. I found out that ...
2
votes
4answers
89 views

Are there any reasons to add payload signature to a rest API with mutual TLS?

We have a B2B Rest API with Client Certificate authentication. Are there any reasons to add also a payload signature check to this API? I'm seeing many service providers which add a digital signature ...
1
vote
2answers
659 views

Combining a fingerprint scan and password for 2-factor-authentication [closed]

UPDATE: I found the answer to the "How To?" part of my question on superuser: Require Fingerprint AND Password/Pin for Windows Logon Is it possible to require a TOTP on Windows Login using existing ...
0
votes
0answers
38 views

How to pass user/pass from user to api in automated fashion

I was unsure whether to ask this on StackOverflow or here, but decided that it is more appropriate here. I'm creating a fully-automated local script that will run on a schedule. Once set up, the ...
0
votes
1answer
72 views

Does authentication provider have access to site? [duplicate]

If I use Facebook or Google as authentication providers, do they gain access to the data in my website? Can they scrape it with a bot? Can I prevent them from gaining this access?
2
votes
1answer
244 views

Are Authy's tokens insecure?

I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP ...
3
votes
1answer
241 views

SMS based 2FA intercepts

Reddit just revealed that they experienced a security breach as a result of an intercepted SMS based 2FA. Another post on SMS 2FA refers to flaw in the telecom’s ss7 protocol that was used to perform ...
-1
votes
1answer
321 views

OpenVPN using google authenticator

I'm a little new to OpenVPN. I'm trying to get google authenticator to work with OpenVPN but I'm having a little trouble. Currently I'm tring to setup a radius server to run the authentication then ...
1
vote
3answers
272 views

Who should issue the client certificate for client certificate authentication?

In case of client certificate authentication, who should issue the client certificate? The service provider which exposes the API or the client consumer which consumes the API? In my experience, I ...
0
votes
1answer
58 views

Login key in email

I use a service for improving my English which includes authentication for users, it has a feature for sending emails for some types of new exercises. I was surprised when I saw the URL for emails: ...
0
votes
0answers
29 views

Automatic write from web server to git production repository using passwordless SSH key: is it secure?

I have a WordPress website which has 4 different environments: Development Preview Staging Production These all are connected to 4 remote Git repositories: development, preview, staging and ...
7
votes
1answer
171 views

Why use one-time codes for two-factor authentication backups?

I am building an web application that uses two-factor authentication. While implementing the recovery feature, I see that most companies (eg Apple, Facebook, Github) provide a set of ~15 backup codes,...
0
votes
0answers
10 views

Application not able to use authentication when connecting to certain repositories

For development, I got the issue that clients often need to connect to different software repositories and the application itself is not able to use authentication. This does not only concern a ...
2
votes
1answer
559 views

Is it secure to use UUID as authentication? [duplicate]

I have an application which uses UUID as an authentication. The UUID is stored as KeyChain inside my iOS application. When I post the UUID, I use https. Is there any way to obtain the password, unless ...
0
votes
0answers
45 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
0
votes
1answer
77 views

Why should I trust the OAuth Providers? [duplicate]

I am trying to understand how OAuth really works. So far I understood the workflow of the authentication process, but I don't get why it is that safe to use a third party OAuth provider. I mean they ...
1
vote
0answers
52 views

Is it more secure to mutual authenticate in a single protocol? [closed]

I would like to know if, in a communication between two peer users A and B with no central authority, it is more secure to mutual authenticate both A to B and B to A applying a single protocol, rather ...
2
votes
1answer
45 views

Does EAP exist as an independent authentication protocol, or just as a framework?

Does EAP exist as an authentication protocol itself, or will it only be found implemented as one of its methods (EAP-TLS, EAP-TTLS, etc)? If EAP is only a framework, what additional detail do its ...
0
votes
0answers
59 views

MSK/PMK generation on Authenticator & Supplicant from EAP-TLS Handshake

How the MSK and PMK keys are different on the client and Server? According to my understanding Authentication server provides the PMK to the Authenticator via secured channel. But, how supplicant ...
1
vote
1answer
89 views

Is there any system that can authenticate my device to open only select apps on it?

I am looking to have an authentication system with which I can link a device to an employee, and then put in place certain privileges so that the employee is only able to open select apps on only that ...
0
votes
1answer
232 views

Multiple devices authorization with refresh tokens

I don't really understand at all the protection scenario when a refresh token is stolen. Please explain. Let's say there is this situation: the user is authorized in a mobile app and this app ...
1
vote
1answer
104 views

How secure are free proxy and VPN?

Preamble: I live in Russia where some web sites (linkedin e. g.) are blocked by government (Roskomnadzor). So I and many citizens use popular free browser-extensions (and mobile apps from same brands) ...
0
votes
2answers
179 views

Can I throw away a private key and use the public key like a hash function?

Yes yes I know "don't invent your own protocols unless you're an expert". No need to yell at me I just want to know if there's a flaw in this idea and if not has anyone done it before. The motivation ...
2
votes
3answers
178 views

If I typed username and password, but wrongly clicked another button to go to another page instead of the login button, is there any security risk?

For example, suppose I already typed username and password at this Facebook page: https://m.facebook.com But I wrongly clicked 'Create New Account' instead of Log In. My question is, does it ...
0
votes
0answers
33 views

Are 2-page website logins more secure than 1-page logins? [duplicate]

Over the last couple of years, some websites have switched to 2-page logins: on the first page the user enters their username, and on the second page the user enters their password. Is this actually ...
0
votes
1answer
152 views

can a token be used for sql injection

I have a token that is restricted to read only access. If someone obtains that token, can they use it to do a sql injection attack? Given that the token is permissioned for read only, can someone ...
0
votes
3answers
102 views

What are the Pros and Cons of allowing users to stay logged in to a web application?

To become a more well-rounded developer, having a better understanding of security concerns and best practices will help me endeavor to build web-apps that are both user-friendly as well as secure. I'...
0
votes
1answer
27 views

elearning pin authentication

I work on a health and safety website which provides an online course with certification. We have recently strengthened security by hashing admin passwords. The question relates to the user's access ...
0
votes
1answer
312 views

Import Wireshark Cookies into Firefox?

I'm trying to copy session cookies (collected using Wireshark) into a different Firefox sessions. But can't seem to find a method or working add-on to manage the cookies. Greasemonkey and ...
0
votes
1answer
156 views

Trustworthiness of Let’s Encrypt and ZeroSSL within browsers and OS [duplicate]

With regard to Are there technical disadvantages in using free ssl certificates? it has been highlighted by some that StartSSL is not a trustworthy CA, and I was wondering if Let’s Encrypt is the same....
0
votes
1answer
180 views

How could this SSO implementation possibly work without browser cookies?

Our corporate Windows 7 desktop setup is now using SSO with our Confluence instance (browser-based wiki-type website) but the strangest thing is that even after logging out AND clearing the browser ...