Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

6
votes
0answers
1k views

Should Javascript & IFrames be used to refresh sessions when Master Cookie Domains are used?

Suppose I have 3 sites that I want to have SSO in, site1.com, site2.com, and auth.com. SSL is always required. According to how SiteMinder cookies are described here, one of those domains would ...
4
votes
0answers
1k views

NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?

Hi i saw a few threads about NFC NTAG against cloning and NTAG Desfire , i just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
4
votes
0answers
127 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
4
votes
0answers
794 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
4
votes
0answers
1k views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
4
votes
0answers
80 views

What's The Easiest Way To Maintain Remote Users Access to a Webapp

Here is a real world case: A chain of high schools (several hundreds) has many websites (~ 3x number of Schools) that are content driven by users (the students). Every school maintains about 2-4 ...
3
votes
0answers
76 views

Using asymmetric keys for two factor authentication

Here's what I'm trying to do: Multiple users with different devices will share the same copy of a file which is encrypted on server-side using AES with a randomly generated passphrase, the passphrase ...
3
votes
0answers
2k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
3
votes
0answers
286 views

Is passing claims about the user in an access token “abusing” OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
3
votes
0answers
79 views

Could this authentication/authorization flow be attacked without compromising the Authority Server?

I am trying to come up with (at this time) server-to-server distributed authorization/authentication that would have (near) the same advantages as OAuth2 but without it's drawbacks. Is there any ...
3
votes
0answers
38 views

Temp Blocking Login without IP or Cookie

What is the best way to temporary block login attempts while not blocking the IP because this will be on networks with many people using the same IP and not reliant on a cookie since that can be ...
3
votes
0answers
298 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, …?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
3
votes
0answers
97 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should only be ...
3
votes
0answers
151 views

Can a non-root process (MySQL) authenticate to RADIUS via PAM?

I've run across a dilemma with PAM RADIUS authentication for the database layer. In our environment, the OS login authenticates via PAM to a RADIUS server which accepts a token code and authenticates ...
3
votes
0answers
31 views

Is there an use-case for checking the signature of an id_token using a js-app or a native-app

Let's say I am developing an client-based application for android/ios or a javascript application for any browser. To identify a user, I'll use OpenIdConnect with the implicit flow. The IDP will ...
3
votes
0answers
67 views

Do iPhones contain a cryptographically secure authentication mechanism?

Firstly is it true that iPhones have a trusted execution environment that can be used to protect asymmetric key pairs for which the private portion of the key cannot be exported by any means other ...
3
votes
0answers
57 views

How do I obtain linux user authentication information securely?

For security purposes the application needs to know, securely who is logged in and what groups they are authorised for. This must be done securely so that a user application cannot perform a man in ...
3
votes
0answers
2k views

Authenticate JWT over websocket

I post here to know if my authentication mechanism over websocket is sound. My app API works over websocket instead of the standard HTTP rest. Each time a path that is secured is accessed over ...
3
votes
0answers
790 views

Can a service provider communicate directly with an identity provider?

I'm making an authentication server that will act as an identity provider for my service. Looking at the typical SAML use case, the service provider will redirect the principal to the identity ...
2
votes
0answers
48 views

Does not using CAS when it's availible encourage phishing?

My (U.S., R1) academic institution uses CAS (Central Authentication Service) to authenticate almost all our web services. However, they don't use CAS for our GitHub Enterprise instance. Instead they ...
2
votes
0answers
53 views

Extracted LM Hashes doesnt match actual password

I'm new to LM Hashing and Windows authentication, and I'm having problems with LM hashes. I've created 2 accounts with the password "123", and both of them have different hashes, and none of the ...
2
votes
0answers
42 views

'Fake SSO & self registration' access to a web api

I was asked to design and implement a solution that I have some security concerns about. The customer has a web application into which users log in using their credentials. The customer wants to add ...
2
votes
0answers
91 views

Using a GUID as an authentication token (and how it could be improved)

I'm implementing a Whatsapp Web-like feature for my Android application. User should be able to open an HTTPS web application that displays a QR code (a GUID generated by the server) and scan it using ...
2
votes
0answers
40 views

How to give end users access to accounts previously only administered by managers?

I have a question about how to handle a somewhat unique authentication situation. We have an existing system with lots of users that have never had direct access to their accounts before. They have ...
2
votes
0answers
61 views

How safe are cookies for payment application?

Recently we started working on a mobile payment app.We are not looking for a way to implement a "Remember me" function. We wondered if we should use session cookies, JWT or maybe other method of ...
2
votes
0answers
66 views

User has been authenticated. Now what?

I'm trying to create a user authentication system for an application. I can't use a built in library for that such as ASP.NET Identity, but I can use any simple methods in .net. Not wanting to ...
2
votes
0answers
109 views

Authentication mechanism without sending password on server-side

My customer is currently using Secure Remote Password (with SSL) for authentication. The reason is that he does not want to send the user password on the server-side, to prove no confidential user ...
2
votes
0answers
230 views

What trivial attacks is ASP.NET MVC mixed-mode auth vulnerable to?

In a 2012 MSDN blog post, Microsoft discourages mixed-mode authentication in ASP.NET MVC for being vulnerable to trivial attacks: The ASP.NET team doesn’t support using mixed-mode authentication in ...
2
votes
0answers
87 views

Strategy regarding an (almost always) offline app

I'm currently in internship in a software/app development company, where I have to come up with an idea about how can we handle the fact that the user will mostly use an app offline. Basically, the ...
2
votes
0answers
198 views

How does biometric authentication work from a technical perspective?

Together with a colleague, we discussed the way of biometric authentication and how this works out. Both of us are only interested in security but far from being an expert on the technical side. ...
2
votes
0answers
157 views

HTTPS basic auth protected AJAX Token

I have a website (https) that has basic auth enabled for /token subdir I have websocket ws going through Nginx to become wss I want to create a bi-directional api on the websocket so that end users ...
2
votes
0answers
118 views

Wanted: Secure login/authentication strategy for website with AND without JavaScript in 2018

I am trying to figure out a strategy for secure authentication - without re-inventing the wheel, but also considering the specific constraints of my situation. The strategy should not be tied to a ...
2
votes
0answers
871 views

Protecting frontend code for SPA + Restful API with OIDC

I've got an Angular 1 SPA with a Restful API that I'd like to restrict access to. As I understand, typically the OIDC Implicit flow is designed just for this. However, I consider the frontend SPA code ...
2
votes
0answers
647 views

JWT as a nonce in sessionless backends

I'm creating an API server (a gateway) with two restrictions in mind: It has to be sessionless (no session id in a cookie or anywhere, no Redis or anything like that) I have to use an implicit grant ...
2
votes
0answers
63 views

How can I go about securing services that require SMS tokens as backups?

I use 2FA on all services that support it. I generate backup codes and store them in a secure encrypted location. Most services unfortunately require a SMS backup, which represents a security issue as ...
2
votes
0answers
164 views

Assymetric auth like AWS4-HMAC-SHA256

I wondered if there exists a defined mechanism similar to AWS4-HMAC-SHA256 (as a scheme in Authorization HTTP header), but using asymmetric algorithm, probably ed25519, and how secure it would be to ...
2
votes
0answers
48 views

Native Mobile App Finger Print Authentication and web service.

I have developed many web based applications and focused a lot on authentication LDAP, SAML and in application passwords. Now I am moving to building native mobile application and would like to take ...
2
votes
0answers
60 views

Kerberos Constrained Delegation

I have 4 machines, one machine with Domain Controller, one machine with Analysis Services, one machine with IIS Services, one machine with the Application The goal is to open the application and the ...
2
votes
0answers
494 views

In practice, are 3rd party cookies used in Authentication? If they are blocked, what is the UX?

I'm researching the authentication flow in the case that 3rd party cookies are used to authenticate to a website, and are blocked by policy, proxy, or browser settings. It's clear that CORS and ...
2
votes
0answers
249 views

What is the WhatsApp QR security model?

The WhatsApp QR auth for web.whatsapp.com interests me. Does anybody have any insight to the actual security model employed and any comments of possible attacks on it?
2
votes
0answers
180 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
2
votes
0answers
37 views

How does google send and receive android app signature securely for “sign-in-with-google-account” option?

For developing an android app that lets people sign in with their google account, we have to submit app package name and developer signature to google. Every time that someone tries to log in to my ...
2
votes
0answers
31 views

Secure userserver authentication with authserver

So, lets say we have Bob, Alice and Peter. Peter is trusted by Bob and Peter has an authserver. Bob hosts a userserver and Alice wants to connect to Bob over an insecure channel. But Bob needs to know ...
2
votes
0answers
65 views

What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?

The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include third party legacy services which need a login/...
2
votes
0answers
311 views

Algorithm to generate (and verify) string of 4 quad alpha numeric code

I am writing a system, for which I need to generate unique transaction numbers (which can be verified by myself). I want to use something similar to that used by credit cards, where a string of the ...
2
votes
0answers
168 views

Combining id_tokens and access_tokens for new auth spec

A common misuse of OAuth2 is as a strict authentication protocol. OpenID Connect addresses this by extending OAuth2 to include an id_token. Implementing clients for OAuth2 and OpenID Connect is a ...
2
votes
0answers
227 views

Authenticate with ADFS without Javascript?

I'm trying to allow a search engine that doesn't support javascript to crawl content protected by ADFS. Is there a way to allow clients that don't support javascript to authenticate to an ADFS ...
2
votes
0answers
496 views

Check if user is logged in on other ADFS authenticated site

I've been looking around for this specific situation, but so far no good.. We have multiple websites that use ADFS WSFederation, and we would like for a user to always pass through one, before being ...
2
votes
0answers
382 views

Token based authentication: Why invalidate the token after each request?

I use the gem devise_token_auth while developing an API for a mobile app. Authors claim that: Tokens should be invalidated after each request to the API. This behavior is enabled by default. Can ...
2
votes
0answers
146 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...