Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

Can backend verify mobile client using OpenID Connect?

Objective My goal is to implement a generic mobile client and backend authentication flow, just for practice. Imagine that I am building a note app that stores user notes on the backend. Instead of ...
0
votes
1answer
78 views

Yahoo! Mail logging in with 2FA code only

I came across a serious issue with Yahoo! Mail that I hope someone would help to fix or raise awareness for. I wanted to create an account on Yahoo! Mail. I entered my phone number to the Yahoo! ...
1
vote
3answers
122 views

Downsides of allowing multiple emails per user?

There's lots of information on using one email for multiple accounts, but how about the other way around? I'm building a service and considering allowing users to log in with any of their registered ...
0
votes
0answers
21 views

Any book/resource on ssl, client auth using cert, server auth pgp, keys, etc [closed]

Is there any book which can cover security from certs point of view in detail. I want topics like SSL certs for webservers/ sites Security certs for authenticating clients rather username/password ...
0
votes
0answers
40 views

One-time-use methods alternatives?

Luckily, I’ve never faced an issue like this, but it came to my mind. Let’s consider tokens or QR access tickets. Do I have any option rather than banning the ID on the server? If I have a one-time-...
0
votes
2answers
71 views

Angular (2+) code visibility to users

I'm looking into Angular and read that typescript is compiled to javascript. Is everything viewable/visible to users that I write using typescript? With PHP I know you run code that's only visible to ...
0
votes
0answers
36 views

USB token for Java Desktop Application

I would like to integrate the use of a USB token in a JavaFX application that my customers use on a computer I send them. This JavaFX application interacts with a Java/Spring back end. (client-id/...
0
votes
3answers
79 views

Sending static registration links via email

In our mobile application, users need to register first before they can use it. After successful registration, they an now login and use features of the app. Now we will have a feature in our ...
0
votes
1answer
55 views

API Key via Basic Auth: Send it as a username or as a password?

In APIs that authenticates with a single API key (eg a long random string) via Basic Auth, I have seen that most (eg Stripe, Unbounce) sends the API key as the username, leaving the password field ...
0
votes
0answers
41 views

“Something you have” on a multi-user device - what is the opinion regarding the NIST AAL3 definition?

The NIST AAL3 specification requires In order to authenticate at AAL3, claimants SHALL prove possession and control of two distinct authentication factors through secure authentication ...
1
vote
0answers
57 views

Purpose of Secure Element

What is the purpose of embedding a Secure Element to enhance the security - especially the storage of keys- if a key is required to connect with it in order to get its secrets? For example: Let's ...
1
vote
0answers
54 views

Does this two-token scheme work?

Security noob here. I've been trying to figure out how to secure my web app from both CSRF and XSS. It's a single-page app that talks to a JSON API on the server side. I'm trying not to do a roll-...
0
votes
1answer
29 views

Is Cross-Domain IP tracking a security feature?

We're using a cloud based web security (proxy) service which basically takes our web requests, scans them and NATs these requests to their public IP addresses. NAT is being done on a per-session basis,...
1
vote
1answer
95 views

Why do we need security measure likes control flow integrity and buffer overflow guard if we have good access control protocol in place?

Reading into information security, I noticed two branches. Access control when communication with external device by using some type of cryptographic authentication and encryption mechanism and things ...
1
vote
1answer
44 views

What is the proper way to sign up a user with a REST API?

I'm building a desktop application with electron/react, which allows the users to sign up/login, but only if they have a specific email domain (user@example.com). I have a working API written in ...
0
votes
1answer
63 views

Token and cookie based mechanisms: stateful or stateless, session or nonsession based?

Sorry for being still confused. I hope someone could share how they understand the following questions and also Is session/cookie based authentication stateful or stateless?. There might be some ...
1
vote
1answer
65 views

Is session/cookie based authentication stateful or stateless?

Flask Web Development says The current login functionality implemented with the help of Flask-Login stores data in the user session, which Flask stores by default in a client-side cookie, so the ...
0
votes
1answer
58 views

How to prove to a 3rd party that some user logged in?

Forgive me any mistakes as I am not very knowledgeable in cryptography. I would like to prove to any 3rd party that a user, with email $x$, accessed my server/database. Only method I can think of is ...
0
votes
2answers
37 views

How to log admin in as regular user? [webdev]

I'm using JWTs for authentication. It would be good as a means of double checking the user's experience if an admin user could log in as a regular user. One way I thought to implement this could be ...
0
votes
1answer
85 views

How does a HTTP client authenticate itself with a HTTP server?

Is it correct that there are various ways that a HTTP client can authenticate itself with a HTTP server? Are the following such ways? authorization header: for various authorization protocols (e.g. ...
0
votes
0answers
26 views

Regular and social sign in reauthentication for sensitive features

I've got a question regarding best practice in given scenario. Lets say that a web aplication has option to register user normally with email and password as credentials. It also has option with ...
0
votes
1answer
25 views

Server certificate authenticity validation process [duplicate]

I was reading this article about how the Server Authentication is being done During SSL Handshake https://docs.oracle.com/cd/E19693-01/819-0997/aakhc/index.html I do understand everything but I have ...
5
votes
1answer
182 views

Functional Google 2FA code (via SMS) received from a random (but in use) mobile phone number

tl;dr for those who are misunderstanding my post: imagine your friend who uses GMail suddenly tells you they have 2FA enabled, and logged in to their account, and that the 2FA code (SMS) they received ...
0
votes
1answer
72 views

Allowing clients to authenticate by generating their own JWT

I am trying to achieve an authentication system that: Has short-lived passwords/tokens (unlike Basic Auth or Api key), Won't expose users credentials if my users table is leaked (unlike HMAC), Every ...
0
votes
0answers
47 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
0
votes
1answer
77 views

Account lockout for inexistant accounts

I am starting to implement an exponential backoff system to lockout accounts after a certain amount of failed attempts (1min after 5 fails, 2min after 10 fails, etc.). However, as this source suggests,...
1
vote
0answers
41 views

Why have a password at all? [duplicate]

Consider the following common security scenario: I need to log in with an email and password. I can't remember my password so I click "forgot password" Website emails me a password reset link. I can ...
2
votes
0answers
105 views

What's the algorithm behind MySQL's sha256_password hashing scheme? [migrated]

MySQL's old mysql_native_password hashing scheme was the equivalent of this in PHP: sha1(sha1('password', true)); That's a hex-encoded SHA-1 hash of a binary SHA-1 hash of the password, without any ...
0
votes
1answer
73 views

Google approach to device security (BeyondCorp): managed devices and inference engine

I'm reading the BeyondCorp papers and trying to get a very high level idea of how it could be implemented by a small to medium organisation, rather than a behemoth like Google. What kind of software ...
0
votes
0answers
56 views

Security of a web app with AzureAD auth

The company I work for is about to publish a custom web app (hosted in AWS) that authenticates through AzureAD. That way, when someone goes to https://www.mywebap.com it is redirected to AzureAd and, ...
1
vote
0answers
41 views

Validating JWT in server-to-auth-server scenario

The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario? I am looking ...
1
vote
1answer
48 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
1
vote
1answer
47 views

Integrity Check on power on VS. Secure boot

Can we consider the Integrity Check on power-on and the secure boot equal from security point of view? Secure boot is about allowing only a trusted SW to boot on the processor. A chain of trust can ...
0
votes
1answer
98 views

What should I do during the Man in the middle attack? [closed]

I have a question about Man in the Middle attack. What should I do during the Man in the middle attack? In case I am already connected with a friend of mine on the net, but I suspect that there is ...
0
votes
1answer
82 views

Biometric authentication against server

I'm working on an iOS app whose login system does not seem entirely secure but I don't know enough to be sure. Skipping account creation, the first time the user logs in they send their user and ...
0
votes
0answers
39 views

Multi-user document encryption: access to user private keys

I am attempting to implement these solutions for multi-user document encryption: https://security.stackexchange.com/a/71915 https://owncloud.com/wp-content/uploads/2014/10/...
0
votes
0answers
46 views

Inverse of Third Party Authentication

Consider this scenario. I have a file hosted on AWS with private access. I want the file to be accessible to several authorized users of a web applicaton that I have built. As I am the one ...
3
votes
2answers
224 views

One way authentication vs two-way authentication

I'm studying for the Network+ exam and wanted to understand the difference between one-way authentication and two-way authentication. I've tried searching to no avail. It seems when I search for it ...
1
vote
1answer
52 views

I am signing (HMAC) outgoing webhooks to allow users to verify their source, should I also sign outgoing responses?

To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack: Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to ...
1
vote
1answer
63 views

Securing an API for 3rd party users

I'm having issues finding the right language to search for answers to my problem so hopefully I can explain it here. I am trying to create an API that will be accessed by a 3rd party. This 3rd party ...
1
vote
1answer
113 views

OAuth2: Where should I store my refresh token in a stateless application?

In my current architecture I have an authentication server which provides a JWT token via OpenID Connect to any web application that uses the code flow I implemented. I went to the hassle of ...
1
vote
4answers
191 views

Why is it (considered) more secure to enter a password in an authentication/identity service instead of custom app login?

I'm developing an app that will require users to authenticate via their Azure AD account. Customer would like a branded, custom UI, including the login screen. The current library for Azure AD ...
0
votes
0answers
23 views

OAuth native app without localhost redirect

Section 4.1 of RFC 8252 describes the OAuth authorization flow for native apps using the browser (i.e., external user-agent). In this flow, the native app receives the authorization code in step 4 by ...
1
vote
1answer
69 views

Can you restrict the services a certificate can access on the client side?

I have a verification certificate signed by my organisation’s CA, which I can use to authenticate my user account on intranet web services. Is there someway I can sign a new certificate which can ...
2
votes
1answer
167 views

What is the most unique data identifier for a phone user that cannot be repeated?

I'm currently developing an Android (and probably iOS in the future) application for my company. I was wondering what is the most unique data identifier to authenticate the users. A data that cannot ...
0
votes
0answers
42 views

How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API

As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's. The flow suggests a method of having a runtime level secret which generated ...
1
vote
1answer
61 views

Validating API keys in a back-end web-service with very few users

I have run into this scenario a couple of times now but am hoping to get either confirmation that I'm on the right track or a suggestion as to what else should be done. Situation I am building a ...
0
votes
1answer
54 views

security concerns when configuring Windows 10 to automatically log into a Microsoft account-linked user account

I have just configured my Windows 10 desktop PC at home to automatically log into my Windows 10 user account that my Microsoft account is linked to on startup. My desktop is in my bedroom upstairs and ...
0
votes
0answers
23 views

Is the vulnerability described in rfc6749 10.16 for implicit Flow is comparable to “man in the middle”?

I'm trying to understand if the vulnerability described in the specification for implicit flow : link is the same principle of a man in the middle attack. From what I understood, the malicious client ...
1
vote
2answers
97 views

EAP vs TLS authentication

I am having trouble understanding the point of EAP. EAP is an authentication framework, which defines several TLS based methods and encapsulations like EAP-TLS, EAP-TTLS and PEAP. These all require ...

1 2 3 4 5 76