Skip to main content

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
1 vote
4 answers
3k views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
11 votes
6 answers
4k views

Is it impossible to protect an API from data redistribution?

Say there is a frontend mobile app and a backend server (let's call this service MyApp) which hosts an API for the mobile app to connect to. The backend server makes any needed requests to third party ...
0 votes
0 answers
13 views

Why whatsapp only let you create 1 passkey?

Whatsapp is rolling out passkeys. I don't think backing up passkeys in a password manager is a good idea. I'd like to have device bound passkeys but they only allow me to create one. How should I be ...
1 vote
2 answers
284 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
1 vote
1 answer
34 views

Login with roles without internet

Disclaimer: question orignally posted here but i was encouraged to ask it in this stack instead. Introduction part I'm writing an application that requires authentication to be used, specifically the ...
1 vote
2 answers
306 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
0 votes
0 answers
22 views

Should I validate json web tokens on my app backend or login backend?

I wrote a login backend with express.js to provide authentication (through LDAP) and authorization (through a database of authorized users for each app on mysql). This backend generates jwt and sends ...
0 votes
1 answer
3k views

How can a Microsoft "unsuccessful sign-in" trigger a 2FA request?

I was certain I'd find a question asking this, but a search didn't return any results. I have 2FA enabled on my Microsoft account, which requires me to approve all sign-ins using the Microsoft ...
23 votes
6 answers
9k views

Is tokenless (specifically SMS) 2FA a security compromise over OTP tokens?

I've been looking into the various pros/cons of tokenless (particularly SMS based) and traditional token based two-factor authentication (think RSA SecurID). After doing some research, I think I have ...
0 votes
0 answers
23 views

If I'm rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on ...
0 votes
0 answers
48 views

How should I respond to an unrequested Facbook recovery code followed by an unexpected logout from the associated email account? [closed]

Cybersecurity layperson here. I recently got an email from Facebook giving me an account recovery code that I didn't request. I assume this means that someone else did request it, either because they ...
0 votes
1 answer
1k views

OIDC + Authentik: Which token to give to user for authentication?

I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head ...
3 votes
1 answer
825 views

Is passing claims about the user in an access token "abusing" OpenID Connect?

First, let me assure you that I have read a number of posts on the topic before asking this question, but I am still confused and would appreciate more insights. So, here's the premise: There is a ...
1 vote
1 answer
179 views

Risks associated with a compromised external Security token server

Consider the following architecture: An on premise Web API 2 [Written in C# hosted in IIS] which uses OAuth 2 authentication [ Implicit Flow ] to secure itself. This API acts as the data source by ...
0 votes
1 answer
57 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
4 votes
3 answers
324 views

Why do TOTP two-factor authenticators use shared keys?

From what I understand, mobile phone-based two-factor authenticators like Google Authenticator implement TOTP which uses a shared secret key between the phone and the authenticating server. Why did ...
0 votes
1 answer
716 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
2 votes
1 answer
403 views

Account switcher in browser implementation and secure design

I am trying to understand how websites implement in-browser account switcher. e.g you can login to twitter using multiple accounts. On the bottom left when you click your currently logged in account, ...
1 vote
1 answer
263 views

How to prevent the device from connecting to the original AP?

I'm running an Evil Twin attack with airgeddon. Point is that after deauth the account is going, automatically, to get reconnected to the orginal AP and not the fake one. The aireplay is likes so: ...
0 votes
4 answers
686 views

Is it bad practice to exclusively use phone numbers for both the sign-up and login process?

I am creating an app. Users need to both login and sign-up. I want to simplify the form for this process as much as possible. This got me thinking. Instead of doing the traditional email, confirm ...
6 votes
2 answers
3k views

Are JWT refresh tokens in browser really that bad?

Note: I fully acknowledge there may be something I'm missing in the picture, which is part of my reason for posting. I'd like to get the opinion of people more experienced than I am on authN/Z related ...
4 votes
1 answer
622 views

Is it safe to create a session from an auth token?

My server is using Django Rest Framework. My mobile app logs in using token authentication. However, I also have a webview in the mobile app where I need to log in. I can't inject the auth token on ...
0 votes
2 answers
233 views

Is there a type of login security that is keylog and screen capture proof that doesnt require a 2nd device?

I am looking for a login security measure where it is keylog and screen capture proof. Is there some type of login security like a 2FA without the need of a second device, but remembering a pattern or ...
0 votes
2 answers
470 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
10 votes
1 answer
61k views

Understanding NTLM Authentication Step by Step

I was reading this link on ASP.Net Authentication and Authorization and these 5 steps were there explaining NTLM authentication. Client sends the username and password to the server. Server ...
1 vote
2 answers
639 views

Do we really need refresh tokens?

I have read a number of posts of many people expressing their confusion around the extra security gained from using an access token and a refresh token to control access to a resource API. Picking up ...
3 votes
1 answer
287 views

Encrypting links between registered users and their sensitive data

I want to make it impractical to link the users to their sensitive data without their passwords – even with a full access to the database. Furthermore, if a user has multiple pieces of sensitive data, ...
4 votes
2 answers
29k views

How to check whether NTLM v2 or v1 is used for authentication?

Which tool should I use to check which NTLM authentication is used? Consider the fact that I am a user of the web application and not the owner. Are there any security concerns if a site uses NTLM ...
0 votes
0 answers
31 views

Does GUIX provide cryptographic authentication and integrity validation?

Does the GNU GUIX package manager in require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages must be ...
0 votes
1 answer
337 views

How can I have SSO with multiple login forms?

The most known SSO workflows require the Identity provider to provide the login page/form, for example Google's Authentication for its services. An example for that is the: Simple SAML SSO Workflow ...
1 vote
0 answers
38 views

Why can't a user who is accessing the service on their own behalf find the "long term" keys to decrypt the service ticket and have to use U2U?

I started to study how the U2U mechanism works and got confused. The gist is as follows. When we use U2U the service ticket will be encrypted with the session key KDC of the user-"server". ...
0 votes
2 answers
95 views

Alternatives for password where at least one secret is not know by the server, with similar transparency

Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password's hash ...
1 vote
1 answer
154 views

What is the easiest way to implement a "passthrough" to let a device bypass the header requirement of an API which we both own?

For starters, I don't have any prior knowledge of implementing security/authentication on backends and frontends because of various reasons. So please forgive my ignorance. So I implemented JWT token ...
1 vote
1 answer
160 views

Where to store tokens for analysis team members

As part of their day-to-day work, each member of our analysis team must handle a variety of sensitive information. For example: username and passwords for our internal databases, and tokens for ...
0 votes
1 answer
228 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
0 votes
2 answers
436 views

Most secure way to pass data from client to server?

I'm writing an authentication system and would like some suggestions on improving its security. Currently, I use RSA to communicate data between the client and the server. Here's the process: The ...
0 votes
1 answer
166 views

How does Android/Firefox authenticate the Android Pocket app, for example?

I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. ...
2 votes
1 answer
274 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
5 votes
1 answer
220 views

Protection of API from abuse (signup and carding attacks)

I have a backend (API) and mobile apps. Mobile apps user use same client_id (Oauth2). Now I see many Bots signing up, adding credit card for checking them (carding) I cannot throttle, limit them since ...
1 vote
1 answer
199 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
2 votes
1 answer
642 views

Did I get it right? OAuth2, OpenID and OpenID Connect

After a lot of research about authentication and authorization, I reached the following but not sure if what I reached is the correct thing so please help me out: Authentication is who you are. ...
1 vote
2 answers
420 views

Using one server and user database for multiple websites

Goal I'd like to have multiple independent websites with one shared authentication server. The auth server will have one database in which all users are stored (just username, email and password, so ...
0 votes
1 answer
489 views

Combining User Context in Machine-2-Machine OAuth2 Client Credential Flow

I have a REST API that is used by 2 separate application and is authenticating them by M2M OAuth2 Client Credential Flow. One of the two application is an automation service without user context. The ...
1 vote
1 answer
464 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
0 votes
1 answer
57 views

How are Sentry's public key protected when the token is in front end code?

In Sentry's documentation they explain that you can use a public token to use their API; <script src="https://js.sentry-cdn.com/examplePublicKey.min.js" crossorigin="anonymous&...
0 votes
1 answer
744 views

Can I safely expose a read-only RESTful API with no key or token?

As the title suggests, I would like to expose a couple of read-only endpoints without requiring a key or token. The endpoints will allow the user to request their data for the purposes of displaying ...
0 votes
1 answer
123 views

Query on best practice - using 2FA to self-authorise IP addresses in an allow-list

I want to know whether a solution I'm considering for a web app is particularly secure / in line with best practices etc. Scenario - a web application, it's a stock management app for small retailers. ...
4 votes
1 answer
588 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue. We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
2 votes
1 answer
387 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
2 votes
2 answers
663 views

OAuth2 public clients cant use client secret and still achieve a secure workflow, why is it used for confidential clients?

In an OAuth2 authorization flow, if I understand correctly the request made to receive a token with PCKE is almost identical between that of a public client and that of a confidential client. The only ...

1
2 3 4 5
91