Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
2
votes
0answers
23 views

Pros/Cons for showing a user how many failed login attempts they have remaining before getting blocked?

For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this? Something like:
0
votes
0answers
32 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
0
votes
1answer
43 views

Is it good idea to re-authenticate a user to access sensitive actions and data?

In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
2
votes
1answer
73 views

Is it safe to store data of small company in MySQL database on webhost?

A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at ...
1
vote
1answer
43 views

Verifying client certificate by passing client cert in the header

I'm implementing client certificate authentication. My server is behind a proxy to which I have no control of. And also I don't have any control over the client side communication. During every ...
0
votes
0answers
21 views

App-to-app or service-to-service authentication using federated login

I have an application Foo that exposes a web-based portal as well as a REST API service via HTTPS. When a human user connects to the app Foo to use its web-based portal, the human user is first ...
0
votes
2answers
84 views

Replace hashing function with asymmetric cryptography when password authentication

I would like to know if the following ideas are feasible: Hash function is one-way function. Generate public key from private key is irreversible(asymmetric cryptography). User password entry -> ...
0
votes
0answers
50 views

Which are vulnerabilities in JWT authentication? [closed]

Which are vulnerabilities in JWT authentication in Node.js? I use this npm package I think the big vulnerability is in refresh token and algorithm of encryption, right?
1
vote
2answers
59 views

What is the name of the crypto system used by ICANN's DNS recovery system?

I once heard about a type of crypto system that behaves in the following way: I have x secret keys that work together to decrypt messages encrypted with a public key d. If I get at least n of the x ...
0
votes
1answer
53 views

Is it safe to use a JWT as an Authorization Code?

I'm implementing an OAuth 2.0 Authorization Code grant type flow and considering to use a very short-lived JWT as the authorization code so this step doesn't require a database. I understand that this ...
0
votes
0answers
24 views

Offline authentication seems really difficult [closed]

I'm building an "offline first" CRM. The main reason it's offline first is because the user will be adding new contacts, updating contacts, adding notes, etc. in an environment where there's ...
0
votes
0answers
17 views

How to create a “purpose-built attribute/secret” to recognize people over the phone?

Imagine you're talking to someone over the phone who needs to check something before he can call you back. In order to ensure that you will be talking to this very person later, you have to create ...
0
votes
0answers
46 views

Mutli user/mutli service authentication + HSM as a key signing/encrypting key?

I'm looking to implement a multi user authentication environment for a small (11) but growing team, to a reasonable number (currently 500+) of managed devices/services (routers, firewalls, linux cloud ...
2
votes
1answer
93 views

How to authenticate an Add-In on interprocess communication?

We are considering to build a Windows application that is split in 2 parts: one Windows service some Add-Ins for Microsoft Office, Microsoft Management Console (MMC) and PowerShell. Additional info: ...
5
votes
1answer
196 views

There seems like a wide gaping hole in the process for checking integrity of e.g. linux distro releases

Many Linux distributions (e.g. Fedora) recommend using downloaded signing keys to verify the integrity of downloaded checksums. This seems utterly ridiculous to me, since the downloaded keys are just ...
0
votes
0answers
56 views

Client application that will only talk to an authenticated server using tls

I use Transport Layer Security (TLS) and I am building a prototype for a client application that will only talk to an authenticated server.Even if I wind up using certificates to authenticate the ...
0
votes
0answers
54 views

Bank account is being targeted since adding my significant other as a joint holder

In the last week, I have gotten an alarming number of text messages from my banks 2FA system sending me verification codes. I believe this indicates my password has been compromised. I've had my ...
0
votes
0answers
40 views

What is the difference between the certificate containers in Windows?

I’ve always wondered. When you import a PKI certificate on a Windows system, you have several choices of where to store it: Personal Trusted Root Certification Authorities Enterprise Trust ...
0
votes
0answers
54 views

Proof of provenance

Say Alice produces a bit of intellectual property, let's call it X. Alice is all for the freedom of information, so publishes X, without charge, electronically (e.g., on her website), asserting her ...
0
votes
1answer
73 views

Do we need to guard against federated identity servers lying about who signed in?

Having successfully integrated my old web forms app with an ADFS server I got to thinking about how the process works as a whole. The old app passes the user to the remote ADFS, then eventually the ...
1
vote
1answer
46 views

Should I validate client and application token on my REST API?

I am dealing with this problem. I have created a REST API with some resources. Some are app to app based and therefore I expect to get only the Authentication header with my token (client_credentials ...
1
vote
2answers
79 views

How do I make sure access token comes from authenticated user?

My problem boils down to the use of Okta's access tokens to secure api endpoint. I followed this okta guide to set up a react single-page application with their wiget. When I log into the site I get a ...
0
votes
0answers
55 views

Simplest secure way to create session cookies

Background: I've been using a simple session cookie design for my web app. I have a users table, and a sessions table that basically looks like this: id | user_id | visited_at -----+---------+-------...
1
vote
1answer
66 views

Are FaceID/passcode logins secure over public WiFi/hotspots?

Unfortunately, I find myself serving a 14d COVID-19 self-isolation period in a hotel which only offers unsecured public WiFi. This has me wondering if all the financial apps on my iPhone with FaceID-...
0
votes
1answer
75 views

How to secure my PHP url endpoints

I have a backend that I developed on PHP/MySql which will provide some URL endpoints in order to get data or post data. I am using those URL endpoints in my application (WebGL application). Now, the ...
1
vote
1answer
100 views

How can we limit access to a single computer?

We would like to limit access to our web servers (and eventually other services on the computer) to individuals that have been authorized access. Of course we don't trust passwords so we think ...
4
votes
0answers
150 views

Deauthorization Bug in messenger application - How serious is this?

My question refers to a behavior on a production system with more than 100 million chat users. Some time ago I changed my account password and removed all devices connected to my account. The next day ...
0
votes
1answer
110 views

Massive operational security hole

Everything is based on phones now. If I have someone's phone I can reset their Salesforce password, access any SAS services etc. Assume this Hacker finds someone's phone number Hacker buys (or works ...
2
votes
1answer
93 views

How secure is (permanent) cookie-only authentication?

I'm making an webapp which have to maintain some user specific data, so authentication is needed. My app is not anything mission critical. As this is the case, I thought of removing the whole sign-up/...
-1
votes
0answers
54 views

Cookie expiration time : Is it really necessary? [duplicate]

Why not cookies be just there forever? Why expiry time is needed? Unless the app is very security critical (like banking) I don't find a reason to expire the session. Why irritate user frequently with ...
30
votes
6answers
6k views

Is revealing the phone number during OTP verification process considered a vulnerability?

One of the common way of implementing 2FA is using phone number Text message or Call with OTP. As I can see, usually web services show something like: OTP was sent to the number +*********34 Is it ...
1
vote
2answers
57 views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
5
votes
1answer
660 views

Hardening NFC tags for authentication

So I have a small electronics project where I am using common Mifare Classic 1K NFC tags as a means of authentication. (Mifare DesiFire is just too expensive) I know these aren't very secure so here ...
-1
votes
1answer
52 views

Social Engineering or Broken Authentication

If I go to a cybercafe and use one of the shared computers, and use a social media application, which deletes session IDs when the browser is closed. A clever person comes, who knows about the ...
7
votes
2answers
2k views

If hashing should occur server-side, how do you protect the plaintext in transit?

I've been working on a full stack project recently for my own amusement and would like to add authentication services to this project, but want to make sure I'm doing it the right way. And before ...
0
votes
2answers
87 views

Best practice for authenticating resend email requests

I have a Node.js/Express 4/JWT user authentication service using Passport.js, with Sequelize and MySQL for database. In my service, upon signing up/resetting a password, the user will be redirected to ...
1
vote
3answers
101 views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
0
votes
2answers
82 views

My passwordless authentication approach

I implemented a passwordless authentication with a good UX in mind. But I am not a security expert so I am asking for your advice. This is the authentication flow: User types in email address client ...
2
votes
0answers
75 views

The Other Side of CAPTCHA [closed]

CAPTCHA stands for "Completely Automated Public Turing Test to Tell Computers and Humans Apart", but we only consider one half of it i.e. a test to separate genuine humans from bots. Can a ...
0
votes
0answers
31 views

Registration process by OAuth2

I have been analyzing the security process in 3gpp specs (pg 11) and the registration process in the spec explained with that flow. The flow represents the registration of a client to the server.. I ...
10
votes
7answers
3k views

Does client side hashing reduce insider risk?

One of the companies I worked for used client-side hashing to minimize risk when logging the password in the server logs. Can this be a good reason to implement client-side hashing?
53
votes
8answers
10k views

How can we eliminate passwords given the problems with biometric authentication?

I've read articles suggesting that passwords will eventually go the way of the dinosaur only to be replaced by biometrics, PINs, and other methods of authentication. This piece claims that Microsoft, ...
2
votes
2answers
121 views

Is autologin dangerous? (Debian/Linux)

If I use only a computer, can I disable the password when I log in? That is, the user account has a password, but in the settings I turn on autologin: /etc/lightdm/lightdm.conf [Seat:*] autologin-...
0
votes
0answers
28 views

Choosing oauth flow-type for on-prem installations

So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
1
vote
0answers
58 views

How to implement a web login using a public/private key pair?

I am trying to create a web form, where the user can login without creating/entering a password. Assume the following pre-requisites are met: The user and server have pre-generated a public/private ...
2
votes
1answer
80 views

Why don't fingerprint authentication systems don't store 'hashes'? [duplicate]

Usual password authentication systems do not store passwords directly on the server, but only hashes of those passwords. Why do fingerprint authentication systems not offer this possibility?
0
votes
0answers
32 views

Authenticating Adobe .pdf electronic signatures

Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
0
votes
1answer
30 views

Does a password-derived public key authentication improve security over pure password-based authentication?

Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of ...
69
votes
8answers
10k views

What is the suggested best practice for changing a user's email address?

I recently jumped onto the hypetrain for an unnamed email service and am currently on my way to update all my accounts on various websites to get most of my (future) data off Google's Gmail. During ...
2
votes
1answer
40 views

How to design a single-request, non-CA-based custom server-to-server authentication method?

We have a series of services exposed as web servers. Potentially, every web app could contact and be contacted by any other one. I want to secure the communications between the applications, which ...

1
2 3 4 5
79