Skip to main content

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
0 answers
13 views

Why whatsapp only let you create 1 passkey?

Whatsapp is rolling out passkeys. I don't think backing up passkeys in a password manager is a good idea. I'd like to have device bound passkeys but they only allow me to create one. How should I be ...
Gatonito's user avatar
  • 363
1 vote
1 answer
34 views

Login with roles without internet

Disclaimer: question orignally posted here but i was encouraged to ask it in this stack instead. Introduction part I'm writing an application that requires authentication to be used, specifically the ...
Nifil's user avatar
  • 111
0 votes
0 answers
22 views

Should I validate json web tokens on my app backend or login backend?

I wrote a login backend with express.js to provide authentication (through LDAP) and authorization (through a database of authorized users for each app on mysql). This backend generates jwt and sends ...
Harry Z. Huang's user avatar
0 votes
0 answers
23 views

If I'm rolling out MFA to users, should I provide TOTP, SMS or both? [duplicate]

My site's users currently do not have any MFA options, but we're planning to release this feature in the near future. We've already built support for TOTP and have it working internally, but some on ...
Ben Johnson's user avatar
11 votes
6 answers
4k views

Is it impossible to protect an API from data redistribution?

Say there is a frontend mobile app and a backend server (let's call this service MyApp) which hosts an API for the mobile app to connect to. The backend server makes any needed requests to third party ...
Jiehfeng's user avatar
  • 213
0 votes
0 answers
48 views

How should I respond to an unrequested Facbook recovery code followed by an unexpected logout from the associated email account? [closed]

Cybersecurity layperson here. I recently got an email from Facebook giving me an account recovery code that I didn't request. I assume this means that someone else did request it, either because they ...
mjc's user avatar
  • 101
0 votes
1 answer
57 views

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

I have a reported finding saying that hostname verification is disabled. This can be deduced from this line of code: final HttpClientBuilder httpClientBuilder = HttpClientBuilder.create(); ...
anonymous's user avatar
0 votes
0 answers
31 views

Does GUIX provide cryptographic authentication and integrity validation?

Does the GNU GUIX package manager in require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get packages must be ...
Michael Altfield's user avatar
1 vote
0 answers
38 views

Why can't a user who is accessing the service on their own behalf find the "long term" keys to decrypt the service ticket and have to use U2U?

I started to study how the U2U mechanism works and got confused. The gist is as follows. When we use U2U the service ticket will be encrypted with the session key KDC of the user-"server". ...
Deoni Deon's user avatar
0 votes
2 answers
95 views

Alternatives for password where at least one secret is not know by the server, with similar transparency

Some service like Bitwarden use the password to encrypt part of your personal data, so that nobody except you can access it, and they archive this because the server only gets your password's hash ...
Delfin's user avatar
  • 103
0 votes
1 answer
57 views

How are Sentry's public key protected when the token is in front end code?

In Sentry's documentation they explain that you can use a public token to use their API; <script src="https://js.sentry-cdn.com/examplePublicKey.min.js" crossorigin="anonymous&...
Alexis Benoist's user avatar
0 votes
2 answers
134 views

Is it possible to send data from an open-source program but make it impossible for a user with source code to do the same?

If I want to store a global scoreboard for a game running locally on the user's computer and I want to make sure that all the requests coming to the server are really generated by the game and not ...
Reverent Lapwing's user avatar
0 votes
0 answers
72 views

Hydra says different passwords with are correct each run, but only one works

I am doing CTF 'Skynet' from THM and came across this problem. Enumerating SMB, I gathered credentials 'milesdyson' and a list of passwords 'log1.txt'. I figured that I could try to brute force ...
Juan Vega Seco's user avatar
0 votes
1 answer
112 views

Will sky fall if I don't verify `AuthenticatorAttestationResponse`?

Through reading the WebAuthn spec and related MDN docs, I understand that unlike "certificate signing requests", FIDO/Passkey can have various different attestation formats and verification ...
DannyNiu's user avatar
  • 374
0 votes
1 answer
73 views

OAuth2: Storing temp values in session vs database

I have implemented OAuth2 for a web app. Everything is stored in the session, and I am switching this to a database. This makes sense for the subject and roles, but it also includes the temporary ...
Ryan's user avatar
  • 101
0 votes
0 answers
63 views

One time password as passwordless authentication [duplicate]

When logging in to azure the login process emails me a short one time code to use and doesn't require a password. I am assuming it is a well trusted process in order to be used on such critical ...
Sabrina Gelbart's user avatar
0 votes
0 answers
65 views

Single JWT as authentication and refresh token

I'm implementing an authentication mechanism using JWT tokens and exploring best practices for securely storing these tokens on the client side. My JWT includes a jti claim populated with random bytes ...
OhGodWhy's user avatar
0 votes
0 answers
70 views

Why does IPsec use tunnel-mode for an external laptop? Could transport-mode be used? Why can't a gateway control access in transport-mode?

In an IPsec Secure gateway setup, why is tunnel-mode used when an external laptop wants to access an internal service protected by a firewall? Is tunnel-mode necessary or could transport-mode be used ...
Allexj's user avatar
  • 137
2 votes
0 answers
501 views

Repeated passwordless login links from linkedin

In the past few weeks I've seen periodic attempts of someone logging in to my linkedin accounts. They appear to use some sort of one time login link feature that linkedin has, which allows ...
Ccm's user avatar
  • 153
2 votes
0 answers
92 views

Why does Bluetooth Low Energy Secure Connections with Passkey Entry check the Passkey bit by bit?

If we want to enable an authenticated connection via BLE the passkey method seems like a good idea. A 6-digit PIN is generated randomly on one device and has to be entered on the other - these 20 Bit ...
jusaca's user avatar
  • 71
0 votes
1 answer
90 views

How is the authenticity and integrity of the various chips inside laptops and mobile phones ensured by their vendors?

Modern laptops and mobile phone platforms are built around a main, beefy SoC, which generally supports Secure Boot for its firmware and also has a unique hardware identity that is used to attest to a ...
Silviu's user avatar
  • 56
30 votes
2 answers
5k views

What is the point of entering numbers in the two-factor authentication app?

Nowadays, 2FA apps usually require you to insert a number which you are presented with when trying to authenticate. For example, the following screenshot is from Microsoft Authenticator: This is ...
hb20007's user avatar
  • 407
1 vote
2 answers
111 views

Authenticating a device for remote motor control

I'm looking for a standard solution to the following problem. I've been unable to find how something like this is normally accomplished. Even a key word that points me in the right direction would be ...
Joseph Rappaport's user avatar
1 vote
0 answers
75 views

Is this openvpn auth script secure or am I'm just being too naive?

I'd like to setup an openvpn server so that clients either use a certificate to authenticate or send username & password. In certain situations I don't want to issue a certificate for clients and ...
Pablo's user avatar
  • 111
8 votes
2 answers
2k views

Doubts about Bluetooth Secure Authentication

I'm reading "Guide to Bluetooth Security" by NIST (available here). At page 22 (page 33 of the PDF), they describe the Secure Authentication scheme. From what I can understand, both the ...
StefanoTrv's user avatar
1 vote
2 answers
639 views

Do we really need refresh tokens?

I have read a number of posts of many people expressing their confusion around the extra security gained from using an access token and a refresh token to control access to a resource API. Picking up ...
ASP's user avatar
  • 119
0 votes
0 answers
63 views

What is the correct way to implement a change-of-email request flow?

I am currently implementing a change-of-email request flow for a web service without MFA. My initial approach is to consult the current OWASP Guide for such a flow. In reading the document, I've ...
peteredm's user avatar
0 votes
0 answers
55 views

What are the best practices for a scheduled program to store credentials to access a secure resource?

If I have a program that runs on a regular basis, such as a cron job or systemd timer and it needs to access a secure resource like a hsm or encrypted database, what are the best practices to store/...
user962460's user avatar
0 votes
0 answers
42 views

Does Node.js's npm provide cryptographic authentication and integrity validation?

Does Node.js's npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
Michael Altfield's user avatar
0 votes
0 answers
94 views

How 2FA with Biometrics improve security?

Where I work, this is the passwordless registration/login flow for our Mobile App A user registers with a username and a phone number. An SMS OTP is sent to the phone number to verify it. Initial ...
Sentenzalb's user avatar
0 votes
0 answers
60 views

Secure Passwordless MFA authentication on mobile app

I want to secure my mobile app with a passwordless MFA mechanism. The registration/login flow would be: You register you account online with a username and a mobile phone (an OTP will be sent to ...
PinkWhaleRider's user avatar
0 votes
1 answer
62 views

cURL not returning status 302 after correct login for Hack the Box Machine 'Crocodile'

cURL is returning a 200 status code after correct login. The common response code after user login should be 302. Why am I not receiving this status code? All information is provided below. #!/usr/bin/...
Michael Sodeke's user avatar
-1 votes
1 answer
73 views

Digital Signatures as an Alternative to TOTP Backup Codes

It seems pretty common for websites to issue a bunch of backup codes for MFA that the user saves somewhere. Instead, why don't they provide the user with the private key for a digital signature and ...
SameOldNick's user avatar
0 votes
0 answers
127 views

Is this a safe setup to prevent email account hack?

I would like to protect a Gmail account from being hacked. Suppose I use the following approach for login/authentication: Username, Password 2FA via security stick the stick is in a place that is not ...
fkarger's user avatar
  • 21
0 votes
0 answers
104 views

Security on home system - ssh keys etc

I use two computers every day, my home server which is a desktop system and my laptop. Both systems run xubuntu and, being mostly a command line user, I use ssh to connect between the systems, to ...
Chris Green's user avatar
0 votes
1 answer
89 views

How to securely use service account credentials in an Android App

I have an Android application distributed to my users through an .apk file. That app collects some data, and my goal is to upload that data to a cloud service, like BigQuery. To achieve this, I am ...
Jorge's user avatar
  • 1
7 votes
3 answers
2k views

Is storing authentication tokens in local storage with a strong CSP safe?

Whenever the topic comes up, almost every source recommends to never store authentication tokens in a place where they can be accessed by client-side Javascript. The recommendation is almost always to ...
Mad Scientist's user avatar
0 votes
1 answer
170 views

What is the benefit of a passkey over using 2FA like Google Authenticator?

At the moment to log into (for example) Paypal I type a password then the code from Google Authenticator. If I understand correctly having a passkey installed on my phone eliminates the password. It ...
John Rennie's user avatar
11 votes
2 answers
1k views

Do passkeys allow an attacker to gain account access by accessing a single device?

Some companies such as Github suggest passkeys replace both passwords and 2FA: passkeys satisfy both password and 2FA requirements Github thus allows logging in with a passkey without any second ...
holocronweaver's user avatar
1 vote
1 answer
110 views

Is 3DS compatible with secure 2FA technologies? (TOTP, WebAuthn)

Is PSD2's Strong Customer Authentication requirement possible to satisfy with secure 2FA solutions, such as TOTP and WebAuthn? For the purposes of this question, I'm classifying all systems where an ...
Michael Altfield's user avatar
1 vote
1 answer
80 views

Replay of previously used cipher, IV and authentication tag in authenticated encryption

It is known that an authenticated encryption scheme is better than just encryption because, in the latter, an attacker can alter the ciphertext, which cannot be verified. In the former, altering the ...
Mohit Kumar Jangid's user avatar
2 votes
1 answer
444 views

Using Hydra on a NTLM authentication

I'm learning Active Directory attacks and in one of the labs we are given the example of gaining the initial foothold in an AD system via NetNTLM by performing a password spraying attack. For the ...
user2334659's user avatar
2 votes
1 answer
383 views

OIDC with JWT in HTTP-only cookie instead of HTTP Authorization bearer header

I'm exploring the possibility of implementing OpenID Connect (OIDC) with an HTTP-only cookie to keep my frontend code completely authentication-agnostic, instead of passing the Authorization header ...
Luke 10X's user avatar
  • 121
1 vote
0 answers
53 views

SPNEGO-based Kerberos authentication: Should I create a new security context using `gss_init_sec_context` for every request?

I'm implementing SPNEGO-based Kerberos authentication for a Linux client application for authenticating requests to a Windows IIS server. I've read RFC4559, which describes how authentication should ...
Shuzheng's user avatar
  • 1,237
1 vote
1 answer
132 views

Is FIDO authN vulnerable to relay attacks?

In this question: Is FIDO2 authentication vulnerable to a social engineering replay attack? it was answered that no, not vulnerable because "the keypair used to by the FIDO device to authenticate ...
Allexj's user avatar
  • 137
2 votes
1 answer
109 views

Does an OIDC ID Token need validation in authorization-code flow?

In the OpenID Connect "authorisation-code flow" what security vulnerability is exposed, if the application relies on claims in the ID Token without validating that token? For example, Google ...
benjimin's user avatar
  • 155
1 vote
2 answers
139 views

VPN vs Authentication Proxy to restrict access to internal network/application

A popular new idea at the company I am working for is to remove worldwide access of web applications and restrict them to the internal network only, allowing remote users to work with them through VPN ...
user2374435's user avatar
1 vote
1 answer
329 views

Is it secure to use session ID as authentication token received from an HTTP header?

I am writing a mobile application for an already existing web app. In the backend, I implemented the usual cookie-based session ID authentication. with a CSRF token generated on login and sent with ...
TommyGun's user avatar
1 vote
1 answer
86 views

Will these actions better secure my web app

I'm trying to figure out what else I should (not) do to reduce the possibility of my web app getting hacked. And like most development efforts, while it would be great to have a security expert on the ...
David Thielen's user avatar
0 votes
0 answers
89 views

Should I redirect user to login screen after validating email and first password?

I'm working on authentication on the backend of an application and I want to know which of the following methods is the best. After the user registers in the application an email is sent to the ...
DarkSide77's user avatar

1
2 3 4 5
91