Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
0 answers
25 views

Is there a need for mutual Authentication in the following use case? if so why?

I came across this use case where mobile devices operating in a pull architecture (connecting to an AWS cloud service endpoint) based on some device triggers will request to be unlocked via a TLS ...
5 votes
3 answers
5k views

HTTPS client certificates for server-to-server

Say you have two servers with certificates proving their domains (e.g. for use with HTTPS). Can one of these servers use their certificate as a client certificate when talking to the other, so that ...
0 votes
1 answer
108 views

What is different between SVO logic versus BAN logic?

While reading about authentication protocols, I saw on Wikipedia on Burrows-Abadi-Needham logic: In some cases a protocol was reasoned as secure by the BAN analysis but were in fact insecure.[3] This ...
2 votes
1 answer
263 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
1 vote
1 answer
50 views

Why does channel binding prevent MITM attacks?

I have read RFC 5056, RFC 5929, and RFC 5802. They say channel binding can prevent MITM attacks in an insecure environment where the client does not or cannot verify the authenticity of the server. If ...
28 votes
4 answers
17k views

What protects a JWT from being hijacked and used to pose as the original user?

Sorry for this possibly silly question, I'm just learning about JWT so please bear with me... I read the JWT docs extensively but I don't understand what prevents a hacker from hijacking the JWT and ...
0 votes
0 answers
30 views

Why not prompt for password and TOTP simultaneously? [duplicate]

In most common web applications that support multi-factor authentication the user is first prompted for their username and password, and only after a successful first authentication the user is ...
1 vote
2 answers
294 views

Are there still ways that OTP is safer than FIDO?

From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
0 votes
1 answer
397 views

What will happen if I accept this "Change your search setting to: smartwebfinder.com"?

When I want to install Ultrasurf extension it gives me this message: So I do not understand what this "Change your search setting to: smartwebfinder.com" wants to do. When I go to this ...
0 votes
1 answer
37 views

Is SMS a secure authentication method? [duplicate]

I’ve seen many HN comments bashing on SMS being insecure. But WhatsApp and signal both use it as their primary authentication method so it can’t be that bad? Why is it bad? What attacks are it ...
1 vote
1 answer
140 views

How can we ensure non-repudiation without a personal certificate (eg. using ID authentication)

I need a help to understand some specific points about non-repudiation, nonetheless I implemented some authentication methods: Digital Signature Authentication; CHAP (Challenge Authentication ...
1 vote
1 answer
281 views

Hashing sessions and retrieving them using cookie(s) with session "id" and "token"

I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed). OWASP and ...
0 votes
1 answer
176 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
1 vote
1 answer
478 views

OpenID Connect Web Message Response Mode and XSS

When using the web message response mode spec with OpenID Connect for silent authentication, what prevents an attacker leveraging an XSS attack from registering a "message" listener and ...
0 votes
1 answer
174 views

Does split knowledge always require an implementation of dual control?

Maybe I'm misunderstanding something here. Dual Control: Actions taken by different operators to affect a change. Split Knowledge: Information needed to affect a change is split between ...
3 votes
2 answers
3k views

SSL/TLS client authentication - practical client cert validation

How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do ...
0 votes
1 answer
211 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
1 vote
1 answer
1k views

how wifi web authentication works?

Some wifi are open networks, but when we connect, it redirects to a web page for authentication. How does this work? how the future packets will be authenticated? Does it bind IP and MAC address (...
2 votes
1 answer
84 views

Would there be any security downside to text-message "verification codes" saying what they're for?

When I log into some web services, I need to send back a verification code contained in a text message that starts out with something to the effect of "You or someone claiming to be you is trying ...
0 votes
1 answer
23 views

How to bypass XMLRPC lockout policy?

I'm trying to pentest a Wordpress box that has the XMLRPC endpoint enabled, but it seems to have additional security measures in place that institute IP-based lockout for 24 hours after one failed ...
5 votes
2 answers
10k views

If PAP is insecure why is it commonly the only authentication protocol available for Radius?

In configuring Radius authentication on multiple devices from a vendor, I discovered that PAP is the only supported protocol. I was initially surprised but discovered that even an f5 BigIP only ...
0 votes
0 answers
43 views

Why is OIDC more secure than oauth2?

If oauth2 is used with the state parameter (I know it's not required by the standard), wouldn't this ensure freshness, i.e. that authentication just happened? What additional security can OIDC bring?
3 votes
1 answer
104 views

Is FIDO2 authentication vulnerable to a social engineering replay attack?

I'm starting to learn about the FIDO2 standard, and I'm wondering if this scenario is possible... Victim visits a credential harvesting page and enters their credentials Credential harvesting backend ...
1 vote
1 answer
2k views

Why is it recommended to use GCP service accounts vs user accounts?

I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
5 votes
2 answers
9k views

How to store user credentials in browser securely?

I need help to authenticate users with user credentials. We are using Angular 5 as a front-end & need to store the user's email and password if the user checks on Remember Me. Then autofill user ...
0 votes
2 answers
195 views

Is it bad practice or major security risk to cache decoded auth tokens in my backend?

I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
11 votes
2 answers
755 views

Is this cross-site password model secure?

I'm looking for a way of securely having passwords for different pages. Say I generate this password: ild23rfsfdfg%*#fArg34t34657%537@asd7oak2094^*q2k2k@Kk3j4tn453Q5# Then, for each site, I change a ...
0 votes
1 answer
212 views

Biometric authentication against server

I'm working on an iOS app whose login system does not seem entirely secure but I don't know enough to be sure. Skipping account creation, the first time the user logs in they send their user and ...
0 votes
0 answers
34 views

Authenticating with unencrypted POST credentials - is it safe? [duplicate]

If a webpage is served over https and to authenticate it receives both login and password as unencrypted POST parameters (free text) is it considered unsafe?
6 votes
2 answers
967 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
4 votes
1 answer
661 views

SSH Man in the middle attacks - how to detect if the victim is allowed to login on a remote server and which method is used

There are some man in the middle tools for ssh, which can be used to intercept ssh sessions: SSH-MITM project OpenSSH fork with implemented mitm capabilities The OpenSSH fork has some problems with ...
1 vote
0 answers
404 views

Does Diffie-Hellman (DH) key exchange protocol lower Off-The-Record protocol (OTR) security level?

Off-the-Record protocol employes Diffie-Hellman key exchange protocol (DH). DH protocol does not provide authentication of the communicating parties and, according to many sources, is vulnerable to ...
0 votes
2 answers
159 views

Can cookies with a complicated secret be manipulated?

Im currently working on a personal full stack application using cookies with the express-session middleware. Theyre secured with some sort of secret. Im not really too sure how that works but I think ...
0 votes
1 answer
32 views

Downside of resource owner password flow for native mobile apps?

I have seen some similar questions a few years old and I am not sure if there are any new changing views on this. I see that this flow is not recommended for mobile native apps. What are the practical ...
0 votes
2 answers
34 views

Altering requests after authenticating

In a web mvc application I have the user login and then he is navigated to a View which presents some data fetched from the database based on a unique Id of the user. He can continue to other views to ...
1 vote
1 answer
5k views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
1 vote
1 answer
388 views

What is a trans-cipher?

While discussing archive authenticity/integrity for long term and the problem of potentially re-keying in case of compromise, someone came up with the term "trans-cipher" (or "trans-ciphering"). I ...
1 vote
1 answer
102 views

Is OTP an acceptable alternative to a password in single-factor authentication?

I recently discovered that when I have two-step verification disabled on my Amazon account, Amazon will allow me to sign in to my account using only my phone number and an OTP code sent via SMS. I am ...
1 vote
1 answer
152 views

Is username + password functionally equivalent to a single login string of the same length?

My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database? I can see that in the case of a single login string, ...
1 vote
1 answer
226 views

Authenticate Static Public Keys

How can a static ECC public key be authenticated when being shared between the client (who has just created the static ECC public key) and the CA (Certification Authority) - who will sign and send the ...
0 votes
1 answer
36 views

AWS Service-To-Service authentication via Identity document

In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
1 vote
1 answer
202 views

Should login/refresh authentication routes return new tokens if an existing, valid token is present?

My server sets cookies with the JWT and refresh tokens on login, and likewise when the refresh route is hit. If a valid JWT cookie is found in the request for these routes, should a new one be issued? ...
0 votes
1 answer
352 views

security concerns when configuring Windows 10 to automatically log into a Microsoft account-linked user account

I have just configured my Windows 10 desktop PC at home to automatically log into my Windows 10 user account that my Microsoft account is linked to on startup. My desktop is in my bedroom upstairs and ...
2 votes
1 answer
247 views

HSM best practice for access

I've been building a product using AWS CloudHSM and things are working well in the POC. Now I want move to production, I've realised that there will be a need to authenticate with the HSM in order to ...
5 votes
3 answers
11k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
1 vote
1 answer
71 views

How message authentication code (MAC) works?

Let's suppose I'm uploading some website to website example.com, and I'm signing every single file with MAC which is shared by users of my website to verify that me (the admin) uploaded that file. It'...
5 votes
4 answers
468 views

Is a "magic link" a kind of authentication?

From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system. Can this ...
1 vote
1 answer
194 views

Is 2FA based on Google Authenticator Real?

I was reading this response on SE about 2FA: Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of ...
107 votes
8 answers
145k views

Certificate based authentication vs Username and Password authentication

What are the advantages and drawbacks of the certificate based authentication over username and password authentication? I know some, but I would appreciate a structured and detailed answer. UPDATE ...
0 votes
1 answer
53 views

Does Google Authenticator share device information to website?

I wonder about Google Authenticator privacy. I wonder if the app shares any information to the website owner about devices that we use to add a new key. I mean information like IP address and device ...

1
2 3 4 5
87