Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

412 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9
votes
2answers
768 views

wireless security - Authentication and Association

I am trying to learn wireless security a bit more technically but resources out there on the net are so confusing. Here is my understanding. There are two types of Authentication: 1) Open System ...
7
votes
1answer
223 views

Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number

tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received ...
6
votes
1answer
189 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should only be ...
5
votes
1answer
367 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
5
votes
3answers
9k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
5
votes
0answers
816 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
4
votes
1answer
218 views

Is it safe to create a session from an auth token?

My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
4
votes
1answer
186 views

Which user authentication measures are used nowadays?

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, ...
4
votes
0answers
2k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
4
votes
0answers
381 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, …?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
4
votes
0answers
2k views

Authenticate JWT over websocket

I post here to know if my authentication mechanism over websocket is sound. My app API works over websocket instead of the standard HTTP rest. Each time a path that is secured is accessed over ...
4
votes
1answer
475 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue. We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
4
votes
0answers
1k views

NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?

I saw a few threads about NFC NTAG against cloning and NTAG Desfire, I just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
4
votes
0answers
136 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
0answers
1k views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
4
votes
0answers
83 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
3
votes
0answers
50 views

Best practices for storing long-term access credentials locally in a desktop application?

I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this: Prompt the user for a ...
3
votes
0answers
50 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
3
votes
0answers
73 views

Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]

I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description). User signs in over ...
3
votes
0answers
110 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
3
votes
0answers
75 views

Comprehensive list of mechanisms that automatically send authentication information in browsers

I'm trying to come up with a list of built-in mechanisms that either automatically send authentication information or automatically prompt the user to provide them in browsers. So far I have ...
3
votes
0answers
78 views

Are the default Azure AD Authentication Certificates global?

When authenticating against an AzureAD instance (using WS-Federation and SAML 2 tokens) the relying/authenticating application requests authentication metadata from a fixed URL on the auth servers, ...
3
votes
0answers
184 views

Using asymmetric keys for two factor authentication

Here's what I'm trying to do: Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
3
votes
1answer
150 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
3
votes
2answers
352 views

Rest API Authentication with JWT

This is my first time working with JWTs so I decided to ask here on Information Security as I'm very unsure about my approach towards JWT Authentication. I'm currently working on an API that will ...
3
votes
0answers
295 views

What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?

In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in ASP.NET MVC for being vulnerable to trivial attacks: The ASP.NET team doesn’t support using mixed-mode authentication in ...
3
votes
0answers
415 views

Is passing claims about the user in an access token “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
3
votes
0answers
81 views

Could this authentication/authorization flow be attacked without compromising the Authority Server?

I am trying to come up with (at this time) server-to-server distributed authorization/authentication that would have (near) the same advantages as OAuth2 but without it's drawbacks. Is there any ...
3
votes
0answers
42 views

Temp Blocking Login without IP or Cookie

What is the best way to temporary block login attempts while not blocking the IP because this will be on networks with many people using the same IP and not reliant on a cookie since that can be ...
3
votes
1answer
136 views

Is there a security benefit to requiring a login before and after a captcha test?

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha. I've been trying to ...
3
votes
0answers
186 views

Can a non-root process (MySQL) authenticate to RADIUS via PAM?

I've run across a dilemma with PAM RADIUS authentication for the database layer. In our environment, the OS login authenticates via PAM to a RADIUS server which accepts a token code and authenticates ...
3
votes
0answers
34 views

Is there an use-case for checking the signature of an id_token using a js-app or a native-app

Let's say I am developing an client-based application for android/ios or a javascript application for any browser. To identify a user, I'll use OpenIdConnect with the implicit flow. The IDP will ...
3
votes
0answers
73 views

Do iPhones contain a cryptographically secure authentication mechanism?

Firstly is it true that iPhones have a trusted execution environment that can be used to protect asymmetric key pairs for which the private portion of the key cannot be exported by any means other ...
3
votes
0answers
58 views

How do I obtain linux user authentication information securely?

For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
3
votes
0answers
933 views

Can a service provider communicate directly with an identity provider?

I'm making an authentication server that will act as an identity provider for my service. Looking at the typical SAML use case, the service provider will redirect the principal to the identity ...
3
votes
0answers
591 views

Can the device seed be recovered from the iPhone/Android RSA SecurID app?

The Windows RSA SecurID app allows the device seed to be determined and cloned from one machine to another (see this blog post). Do either the iPhone or Android RSA SecurID apps suffer from the same ...
2
votes
0answers
70 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
2
votes
1answer
44 views

A couple of questions about ASP.Net Core default implementation for login security

By default, ASP.Net Core configures the login exercise with a couple of things that seem strange to me. I'd like someone who knows more about infosec than I to comment on these please. First, it ...
2
votes
0answers
87 views

Does my app need authentication in addition to Spotify authorization?

I have an app that revolves entirely around Spotify. I have followed the authorization guide from Spotify and am using the Authorization Code Flow so the access token can be refreshed. My thinking was ...
2
votes
1answer
55 views

How to send cookie to API on seperate domain in safari

So basically with my app, I keep users access tokens in memory for the duration page load (e.g. once they refresh the token dissapears). To prevent them from having to sign in again, I have my auth ...
2
votes
0answers
34 views

Authentication and authorization of a subrequest

A user sends a request to a system A. The request is signed with a digital signature, so the system A can authenticate and authorize the user. Then the system A creates a series of sub-requests to ...
2
votes
1answer
165 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
2
votes
1answer
260 views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
2
votes
0answers
104 views

Admin able to set new plaintext user password - security problem?

I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
2
votes
0answers
59 views

Benefit of authentication with a gateway

Given... a public web service with enabled SSL/TLS the web service enforces authentication using JSON Web Tokens a client on a LAN without an Internet connection a proxy on the LAN that grants point-...
2
votes
0answers
51 views

How to mirror user access between Windows 2016 Servers

I'm setting up an intranet web server that will handle requests coming from multiple different types of employees. One of the requests that my server will need to handle is to query data from a ...
2
votes
0answers
59 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
2
votes
1answer
81 views

IKEv2 Using Different PSKs

We're setting up some new tunnels and have been told to use IKEv2. I understand that IKEv2 allows different authentication methods, e.g. one side using PSK and the other using a certificate. We don't ...
2
votes
2answers
209 views

Man-in-the-middle attack (ACME / Let's Encrypt) on Authorization Key?

By looking at https://letsencrypt.org/how-it-works/, I got the feeling that a man-in-the-middle attack might be possible in the 'Domain Validation' phase. During that phase, the admin is asked to e....
2
votes
3answers
227 views

Do integrity and authentication always come together?

I cannot come up with a case where there is only one of them. When there is integrity, a random person cannot modify the message without being noticed. That is, an unauthenticated user cannot modify ...

1
2 3 4 5
9