Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
1 answer
19 views

Can the services inside the VPC be authentication less?

We have a micro-services architecture, where many microservers need to talk to each other for data. These services are inside a VPC. I need to understand if the HTTP APIs of these microservices need ...
user avatar
0 votes
0 answers
66 views

My Google account with 2FA got hacked. But How? [closed]

I always kept my credentials in safety. My account is protected with two-factor authentication (2FA). Any user who wants to sign in must do one of the following steps: Press "Ok" on the ...
user avatar
0 votes
0 answers
13 views

Is a TOTP with RFC 6238 and a password in a manager 2FA? [duplicate]

For example Microsoft Outlook web based email service can be configured to require both a username/password combination and a time-based one-time password (TOTP) generated by the algorithm described ...
user avatar
  • 101
1 vote
1 answer
57 views

What are the security best practices to implement offline login of android apps?

My client has an android application requirement. The users of the application are workers who might have to work at places where internet connectivity is unavailable. So an offline login feature is ...
user avatar
0 votes
0 answers
21 views

Any studies on the hardware costs of server-side password hashing? [closed]

I am researching the state of the art in password security on the web and the general consensus seems to be that server-side hashing with a slow hashing algorithm (Argon2id, bcrypt, scrypt etc) is the ...
user avatar
0 votes
0 answers
16 views

Storing strings in a Database that are only visible to their owner who stored them when they were logged in

In my application, logged-in users create some strings, and those strings are stored in the Postgres database. But, because they are in plaintext, their values are visible to me, as I have access to ...
user avatar
0 votes
1 answer
46 views

Would storing the users IP address in a session token be more secure?

In a web app, would storing a users IP address in a session be more secure then storing it without it? I think that if I store a JWT in their cookies that includes their IP address for session ...
user avatar
0 votes
1 answer
33 views

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
user avatar
2 votes
2 answers
70 views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
user avatar
  • 205
17 votes
4 answers
3k views

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
user avatar
  • 181
0 votes
0 answers
32 views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
user avatar
  • 1
-1 votes
1 answer
77 views

Using certificates for authentication in a web site

Today i faced a web site related to government that showed me all of my certificates in a combobox for authentication on that web site. What were those certificates? How can i show them in a asp.net ...
user avatar
1 vote
0 answers
16 views

SIM hardware protection of master and long lived keys

4G and 5G authentication procedures includes master keys or long term keys which are shared between subscribers and Home Networks, for 4G they are called Ki. A case was reported here in which NSA ...
user avatar
0 votes
0 answers
66 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
user avatar
0 votes
0 answers
18 views

How does the SAML based SSO differ for Internal (employees) and External users (external resources)?

We are trying to set up(I am not part of the setting up process) an SSO based login for an ITSM application. Our organisation has some users working for us although they use their own organisation ...
user avatar
  • 101
0 votes
1 answer
29 views

Can third-party authentication yield a static user-specific encryption key?

I'm writing a REST server + frontend with two goals that seem to conflict: Signing in yields a static, user-specific key (K1) to decrypt a document (D) stored encrypted on the server. The key should ...
user avatar
0 votes
1 answer
43 views

Creating secure website-based login for a desktop app

This question relates to this post I made on StackOverflow recently, which I'll recap here briefly. I have a desktop app that I would like to authenticate through a website, using the process outlined ...
user avatar
  • 103
0 votes
1 answer
21 views

AWS Service-To-Service authentication via Identity document

In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
user avatar
  • 1
0 votes
0 answers
14 views

Is my perception of improved security by restricting access to an MS365 tenant/associated apps on per-device basis misguided? Why?

Receiving guidance from a contractor that restricting unknown devices (regardless of MFA, location, etc.) to an Azure tenant does not improve security in any meaningful way, and just creates a ...
user avatar
0 votes
1 answer
55 views

What security concerns can arise from using HTTP Basic-Authentication? [duplicate]

During an engagement, i have been asked by a client to explain (with the use of one or more examples) why they must update their website authentication mechanism, as they are currently using HTTP ...
user avatar
0 votes
0 answers
51 views

What are the risks of using wildcard in context path of OIDC/OAuth redirect_uri?

I'm using Keycloak for my authentication needs. It allows me to use * as wildcard when whitelisting redirect_uris for OIDC clients. What are the risks of using * in context path of redirect_uri? For ...
user avatar
1 vote
1 answer
91 views

Is it possible to crack a 2FA/MFA secret key provided you know enough of the previous generated codes?

I have two accounts that won't show me the 2FA/MFA "Secret Key" used to generate the multifactor codes. Because of this, I am forced to use specific MFA apps rather than my preferred one. If ...
user avatar
  • 13
2 votes
2 answers
47 views

Mitigating the performance impact of strong hashes with Basic HTTP authentication

I am trying to decide which work factor to use for our hashed passwords, and I am facing the following dilemma. Let me elaborate for a moment. Basic HTTP authentication works as follows: The user ...
user avatar
  • 2,914
-1 votes
1 answer
56 views

Can using 2FA compromise me in any way if the website owner goes rogue?

Context This question concerns a website that has no commercial or business background, it is a purely personal project. This website is ran by 2 strangers from the internet, who lend access to ...
user avatar
  • 101
1 vote
3 answers
132 views

What account do you enter when using ' or '1'='1?

So I'm writing a paper on sql injection for my db class and one thing I don't understand is this. I assumed that one of the reasons a lot of sites don't allow duplicate usernames is that they use ...
user avatar
  • 13
0 votes
2 answers
148 views

Is this really two-factor-authentication?

In the country I live in, most authentication for online banking or authorities (such as tax) is based on an app. It has two operation modes: Enter personal number on website (the personal number is ...
user avatar
  • 163
0 votes
2 answers
56 views

How to check the authenticity of an outlook email attachment (.msg)?

let's say that someone sends me a business email on Microsoft outlook 365. I save the email as an attachment (email.msg) How a third person can make sure that the email attachment is not edited (...
user avatar
  • 109
0 votes
0 answers
26 views

Security implications of access and refresh tokens (JWT) with refresh token rotation and automatic reuse detection

In an effort to avoid having to deal with CSRF attacks, I'm trying to implement an auth flow that completely avoids using cookies. In most cases this makes one vulnerable to XSS attacks. However, ...
user avatar
  • 101
0 votes
1 answer
58 views

Voice input as security measures for system authentication

Can voice input as password could be a useful security measure aa a alternative for strong password (Keyboard characters complex), biometric (face, thumb, signature etc)? The voice inputted as a ...
user avatar
0 votes
0 answers
9 views

Best way to handle token authentication workflow on mobile apps

I'm working on a mobile application and I need to create a token-authentication workflow. So far I've pointed out main token: Token by reference, that are store in database, like (https://www.django-...
user avatar
1 vote
1 answer
62 views

how does fingerprint authentication work without trusting the client device?

There are lots of resources discussing the security of fingerprints but I haven't been able to find the answer to a very basic question. In the simplest possible password authentication scenario, the ...
user avatar
  • 251
-1 votes
1 answer
181 views

How to generate SSH keys inside yubikey?

How do I generate SSH keys inside my yubikey, on Ubuntu? There seems to be nowhere to look for this info.
user avatar
0 votes
0 answers
21 views

What is the 'domain name' in PKCE Auth flow for mobile apps?

I'm interested in building a mobile app that authenticates with a service using OAuth2 so that my app can use their API's. Documentation To apply for an application key, I need to enter my application'...
user avatar
0 votes
0 answers
36 views

Mitigating CSRF and XSS with JWT authentication: can someone tell me where my logic is wrong

I'm currently working on a personal project including a RESTful API and also trying to understand how to make it as secure as possible. I have read a bit about JWT, the possible vulnerabilities as ...
user avatar
0 votes
0 answers
39 views

How is a TLS certificate authenticated, down to a code level? [duplicate]

I am having trouble to understand how a TLS certificate is authenticated. From what I read, a server's leaf certificate contains: Server domain name Server public key Issuer (CA) domain name Issuer (...
user avatar
  • 101
0 votes
0 answers
10 views

Site-specific account vs "single sign-on" for personal accounts?

The title of this question is a bit hard to word concisely, partially due to my own lack of terminology. What I am trying to ask is, when signing up for a service in a personal capacity (say Airbnb) ...
user avatar
  • 101
1 vote
1 answer
59 views

MITM in Tor: Authentication when an Entry node is sending data back to the Client

Diagram: Server -> Exit Node -> Middle Node -> Entry Node -> Client In Entry Node -> Client, how does the entry node authenticate that the receiver is a real client but not a MITM?
user avatar
0 votes
0 answers
42 views

Is process-based authentication more secure than username and password?

My infosec officer is campaigning the use of client process-based authentication everywhere applicable for future and existing projects. For existing projects, especially for custom applications, this ...
user avatar
  • 111
3 votes
1 answer
122 views

Adding SSO to an existing website - should SSO login link to matching email address?

I am adding Single Sign-On (SSO) via Google and Microsoft identity providers to a web application where many thousands of user accounts already have existing credentials stored by username and ...
user avatar
0 votes
0 answers
72 views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
user avatar
-1 votes
1 answer
28 views

how to fully secure web/mobile/desktop application connected the same backend server [closed]

I have a React/Express application, I want to fully secure it. I'm looking for best practices for these features: data encryption/decryption end-to-end communication access control role management ...
user avatar
0 votes
2 answers
50 views

Revoke all refresh tokens when account locked?

Scenario: a user enters his password incorrectly x times, so his account is locked for y minutes. Should I revoke all his refresh tokens? Problems: user is logged out of all devices, not just the one ...
user avatar
  • 333
0 votes
1 answer
36 views

How can I have SSO with multiple login forms?

The most known SSO workflows require the Identity provider to provide the login page/form, for example Google's Authentication for its services. An example for that is the: Simple SAML SSO Workflow ...
user avatar
0 votes
0 answers
16 views

Downside of resource owner password flow for native mobile apps?

I have seen some similar questions a few years old and I am not sure if there are any new changing views on this. I see that this flow is not recommended for mobile native apps. What are the practical ...
user avatar
  • 101
0 votes
1 answer
90 views

3rd party mobile app access our service via our APIs

We have a microservice backend system & we expose APIs for our customers to use. We are now developing our Authentication system with our identity provider service. We have a customer(a company), ...
user avatar
0 votes
2 answers
67 views

Can someone clone my session Id cookie and login as me?

Because HTTP(s) is stateless, it doesn't remember a username/password combination used to authenticate and assign permissions to a user. I've read that, to overcome this limitation, many websites keep ...
user avatar
  • 137
0 votes
2 answers
43 views

Digital signature for API authentication feasible?

Could it be practical to authenticate API request through digital signature (based on headers and message body)? This would be asymmetric instead of something like HMAC which is not a signature. ...
user avatar
  • 101
1 vote
1 answer
82 views

Is authentication through mail clients safe when encryption is off?

When adding an account on a mail client, the SSL/TLS is usually turned off and the encryption method is 'none' (see Outlook example below). Is the password safely sent through the internet when ...
user avatar
1 vote
1 answer
62 views

What to tell the user if has been disabled?

My website allows medical professionals to sign up for an account. After they sign up and provide basic information about their credentials and their practice, we tell them that we need to manually ...
user avatar
2 votes
2 answers
166 views

Am I authenticating devices securely?

I'm building a IOT platform for my home as a hobby. Currently, I'm trying to implement device authentication. A device in my case could be a Raspberry Pi, Arduino, Jetson Nano. To authenticate devices ...
user avatar
  • 23

1
2 3 4 5
87