Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
26 views

Protect admin page using proxy

I want to protect my admin page not only with a login and password, but also with IP filtering as described here: https://security.stackexchange.com/a/30649/68841 But I have two questions: Can I use ...
0
votes
1answer
29 views

Using OAuth2 with JWT, should a client pass along unused refresh tokens on a logout call?

I have a system with an OAuth2 authorization server. It hands out JWT access tokens and refresh tokens (the latter only to the mobile app client). We don't persist access tokens (as is normal with ...
1
vote
2answers
51 views

How can SubtleCrypto help in the process of sending a password via HTTPS?

I heard from someone that SubtleCrypto should be used in client-server communications to login and register, then he told me it would be useful even if someone took control in the middle of the HTTPS ...
2
votes
1answer
72 views

Is this schema between a Desktop App and an API secure?

From my previous question: How secure is this schema between a Desktop App (c++) and an API (php). Introduction I made a paid Desktop-app that required constant internet connection (because of its ...
0
votes
0answers
37 views

Windows 10 invalidated PIN for three accounts out of four

I have a Windows 10 Pro 1903 with four accounts: two are for adult users and two for children one adult account is admin account, three remaining are standard users accounts, all four are Microsoft ...
1
vote
1answer
83 views

How secure is this schema between a Desktop App (c++) and an API (php)

as title says I'm writing a paid Desktop App that automates some process, it indirectly requires internet connection because MY app automates another Desktop app that requires internet connection. ...
0
votes
1answer
67 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
0
votes
0answers
19 views

RPC: How to authenticate the server towards the client(s)

I've implemented a client-server-model that runs locally on a linux machine. I've used the (old) ONC RPC / Oracle RPC based on an UNIX domain socket. There are some ways to authenticate the client, ...
0
votes
0answers
23 views

Identity confirmation using PIN to decrypt previously issued token

I am building an app (for web and mobile) that requires a user pass two stages of authentication/authorisation in order to access a server-side API and subsequently use the app. First, they must ...
4
votes
3answers
334 views

As a website admin I could see encrypted passwords. Is this ok?

I am building a website that requires the users to login through username and password. I have the passwords encrypted in my database with bcrypt. On the back end, I receive the usernme and password ...
1
vote
1answer
46 views

What protocols are authenticated by Active Directory?

Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?
2
votes
1answer
61 views

Double submit cookie: CSRF token doesn't need be a random value?

Note: I have read the answer to this question, but found it unsatisfactory, probably because I don't understand enough about security. I'm referring to a frontend server-side rendered SPA + a backend ...
0
votes
1answer
61 views

Authentication without sending password over network

I was reading this question about ssh authentication and there's a good discussion about authentication schemes. First, there's the answer that yes, ssh sends the full password to the server (but ...
2
votes
0answers
51 views

What is the rationale behind two staged credential input these days? [duplicate]

I have begun to notice some apps and websites (particularly ones made by Apple) which present user login in two steps. In the initial state, only the username/email field is shown. Once you enter a ...
1
vote
5answers
176 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
0
votes
1answer
38 views

What are the alternatives for a bearer token mechanism?

Who gets a bearer token, will have all the privileges of the actual owner of the token. Is there any tokening mechanism which is not suffering from this issue?
2
votes
3answers
75 views

Doesn't Authentication logically imply Non-repudiation? [duplicate]

If it is confirmed that Alice is the source of a message (authentication), then shouldn't she be unable to deny that the message is from her (non-repudiation)? Is there an example where ...
1
vote
2answers
124 views

What happens when you lose access to the second factor? [duplicate]

Imagine you use your phone number as a second factor to access your e-Mails (e.g. through SMS). What happens if I change phone numbers and then no longer have access to that second factor? Can one ...
0
votes
1answer
81 views

Permissions API [closed]

We are about to develop an integration with an old system which is still live . Due to technical issues it is not possible to augment the data from the old system using the browser so we are going to ...
2
votes
1answer
66 views

How does the browser know windows logged in user id or Kerberos TGT?

My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
0
votes
1answer
56 views

Having a JWT that doesn't expire

I'm trying to understand why having a JWT access token that doesn't expire is bad for my application. The way I have written my backend, when the JWT comes in, I verify it and extract the subject ...
0
votes
0answers
42 views

Learning how to audit a linux system, what does it mean to configure password & system auth?

I'm currently using Linux Red Hat OS, and I need to configure it accordingly to /etc/pam.d/password-auth and /etc/pam.d/system-auth under CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0-1. What page ...
0
votes
1answer
43 views

BitFinex unauthorized login [closed]

A few minutes ago i got an email from the real Bitfinex, saying that a unauthorized login attempt was approved by Bitfinix. Is this the work of a new breach? The IP is located somewhere in Japan.
1
vote
1answer
77 views

How to store user credentials in browser securely?

I need help to authenticate User with user credentials. We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
0
votes
0answers
25 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
0
votes
0answers
34 views

What is the difference between using an auth header and the request body to send credentials?

I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I ...
1
vote
0answers
49 views

How do I login silently to multiple web applications without user being interrupted to keep their sessions active [migrated]

We need to login to 20 - 30 different web applications and enter credentials to keep user active throughout the day. This needs to happen in the background on user's machine without user being ...
2
votes
1answer
36 views

Known methods/techniques for thwarting credential phising attacks

Is the solution to preventing credential phising attacks is really only 'educating' people about it? For the sake of this question, let us assume that I have a web application that takes a username ...
0
votes
1answer
46 views

Is it secure to use a single pair of RSA keys to achieve mutual authentication?

I saw this design recently in an infotainment product. The goal is mutual authentication between two ECUs, E1 and E2. They only care about each other. The basic idea is to keep both keys secret and ...
2
votes
0answers
63 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
1
vote
2answers
78 views

What are the guarantees that TLS provides without using a certificate in the scenario?

Assume a scenario where we have a modular system including: an Authentication Module (AM) which gets username and password of an internet user and issues a token for the user. User<-->AM ...
2
votes
0answers
83 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
0
votes
0answers
43 views

How to stop the user from intercepting their own credentials in mobile apps? [duplicate]

We are experiencing fraud with our open API, so we're turning it private. Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API. Request: App -> Credentials -> Auth ...
0
votes
0answers
81 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
1
vote
0answers
43 views

JWT scheme with different signing algorithms

I'm planning to implement a (slightly non-standard?) JWT authentication scheme with refresh and access tokens, in which refresh and access tokens use different signing algorithms: refresh token uses ...
1
vote
1answer
53 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
0answers
27 views

One-Time Password (Email or SMS) as the Only Authentication Information [duplicate]

I was wondering about the implications (mainly in terms of security) of using a random, one-time use, password sent by email or sms to authenticate users to a web application. The application would ...
0
votes
0answers
52 views

Google SMS verification codes broken on a loop - should I be concerned?

So this is a little out of the ordinary. Not sure what to make of it. I've enable 2-Step Verification on a Google account. When opening mail or other G-related services, it sends an SMS(text message) ...
1
vote
1answer
49 views

Authenticate Static Public Keys

How can a static ECC public key be authenticated when being shared between the client (who has just created the static ECC public key) and the CA (Certification Authority) - who will sign and send the ...
2
votes
1answer
119 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
1
vote
1answer
55 views

Kerberos over http documentation

The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a Where is the Kerberos over HTTP official ...
0
votes
0answers
30 views

IAM to IAM federation vs IAM to application federation

Considering two different scenarios: Federating our IAM with individual applications, for example a single SaaS or in house development Federating our IAM with another IAM instance, for example when ...
2
votes
1answer
52 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
3
votes
1answer
81 views

Does Nextcloud installation gives passwordless access to all files by default?

I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
0
votes
1answer
94 views

Website online assistant asked for my password

Sorry if this isn't the right place for this.. I recently joined an online gambling website and clicked on live assist. To verify my identity they asked for my username and password. I did not give ...
0
votes
0answers
30 views

Security implications of client side authentication with a remote database

I'm developing a desktop app for use internal to my company. The app's installation file is located on our company server and therefore is only accessible to authenticated employees (under the ...
0
votes
0answers
30 views

How to integrate an Oauth2 based application into a Wordpress plugin?

I'm working on a Wordpress plugin that integrates an external service. This service has an API that authenticates using OAuth 2.0. The plugin is public and can be used by anyone who has an account at ...
1
vote
0answers
44 views

Is there any advantage in using Google's IAM on Android?

We are building a few corporate apps for field workers / front office. In most cases each user will have their own device, but there are some shared devices (for example reception). The devices are ...
3
votes
2answers
232 views

2-step authorization (using SMS) less secure than being without 2FA at all?

I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become ...
0
votes
0answers
34 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...