Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
1answer
54 views

BitFinex unauthorized login [closed]

A few minutes ago i got an email from the real Bitfinex, saying that a unauthorized login attempt was approved by Bitfinix. Is this the work of a new breach? The IP is located somewhere in Japan.
1
vote
1answer
123 views

How to store user credentials in browser securely?

I need help to authenticate User with user credentials. We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
1
vote
0answers
26 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
3
votes
1answer
121 views

Is there a security benefit to requiring a login before and after a captcha test?

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha. I've been trying to ...
0
votes
0answers
46 views

What is the difference between using an auth header and the request body to send credentials?

I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I ...
2
votes
1answer
36 views

Known methods/techniques for thwarting credential phising attacks

Is the solution to preventing credential phising attacks is really only 'educating' people about it? For the sake of this question, let us assume that I have a web application that takes a username ...
5
votes
2answers
282 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
2
votes
0answers
70 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
13
votes
6answers
3k views

Is it a security issue to allow nearly identical email addresses when registering?

Say you have a website where it is possible to create accounts for all of the following email addresses: 'test@test.com' 'test@test.com ' 'test@test.com;' 'test@test.com;test2@test.com' Should this ...
1
vote
2answers
79 views

What are the guarantees that TLS provides without using a certificate in the scenario?

Assume a scenario where we have a modular system including: an Authentication Module (AM) which gets username and password of an internet user and issues a token for the user. User<-->AM ...
0
votes
0answers
82 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
2
votes
0answers
139 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
2
votes
2answers
68 views

How do you know which site credentials are sent to when signing into Oauth site in native apps?

I sometimes use these features where I can use my Google account to sign in to different service providers. For example, the Postman app lets me sign in to it using either their own user store, or ...
0
votes
0answers
43 views

How to stop the user from intercepting their own credentials in mobile apps? [duplicate]

We are experiencing fraud with our open API, so we're turning it private. Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API. Request: App -> Credentials -> Auth ...
6
votes
3answers
22k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
0
votes
2answers
96 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
1
vote
0answers
43 views

JWT scheme with different signing algorithms

I'm planning to implement a (slightly non-standard?) JWT authentication scheme with refresh and access tokens, in which refresh and access tokens use different signing algorithms: refresh token uses ...
10
votes
4answers
24k views

Bypassing Windows 10 password with Utilman.exe trick - fixed?

Recently I run into a locked down laptop with Windows 10 OS (actually I guess it was updated from Windows 7 if that matters). My collegue was using this computer some time ago and lost his login and ...
1
vote
1answer
55 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
0answers
29 views

One-Time Password (Email or SMS) as the Only Authentication Information [duplicate]

I was wondering about the implications (mainly in terms of security) of using a random, one-time use, password sent by email or sms to authenticate users to a web application. The application would ...
0
votes
0answers
53 views

Google SMS verification codes broken on a loop - should I be concerned?

So this is a little out of the ordinary. Not sure what to make of it. I've enable 2-Step Verification on a Google account. When opening mail or other G-related services, it sends an SMS(text message) ...
1
vote
1answer
73 views

Who should create the keys?

I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard. Background information: There are three parts. Integrator the client which user uses it ...
2
votes
1answer
121 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
1
vote
1answer
56 views

Kerberos over http documentation

The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a Where is the Kerberos over HTTP official ...
0
votes
0answers
31 views

IAM to IAM federation vs IAM to application federation

Considering two different scenarios: Federating our IAM with individual applications, for example a single SaaS or in house development Federating our IAM with another IAM instance, for example when ...
2
votes
1answer
58 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
3
votes
1answer
158 views

Does Nextcloud installation gives passwordless access to all files by default?

I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
0
votes
1answer
105 views

Authentication handshake between two independent apps

I need help on a solution for below scenario from a security perspective. Scenario: There are two independent web applications App1 and App2. User will log in to App1 by performing authentication ...
0
votes
1answer
94 views

Website online assistant asked for my password

Sorry if this isn't the right place for this.. I recently joined an online gambling website and clicked on live assist. To verify my identity they asked for my username and password. I did not give ...
0
votes
1answer
108 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
1answer
247 views

Two Factor Authentication Multiple Devices

Most websites (that I have seen) that implement two factor authentication don't support multiple two factor authentication devices linked to one account. The biggest reasons I can think of for that ...
0
votes
0answers
30 views

Security implications of client side authentication with a remote database

I'm developing a desktop app for use internal to my company. The app's installation file is located on our company server and therefore is only accessible to authenticated employees (under the ...
9
votes
2answers
1k views

Smartcard authentication SSH remote client

I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation: My desktop computer with smartcard has a ssh session to ...
0
votes
1answer
157 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
2
votes
1answer
232 views

Is using WebAuthn alone considered as two factor authentication?

Will using WebAuthn for an application make it two factor? I am specifically interested in using Ondevice biometrics and achieve passwordless authentication. For a true two factor authentication you ...
1
vote
0answers
44 views

Is there any advantage in using Google's IAM on Android?

We are building a few corporate apps for field workers / front office. In most cases each user will have their own device, but there are some shared devices (for example reception). The devices are ...
0
votes
0answers
30 views

How to integrate an Oauth2 based application into a Wordpress plugin?

I'm working on a Wordpress plugin that integrates an external service. This service has an API that authenticates using OAuth 2.0. The plugin is public and can be used by anyone who has an account at ...
2
votes
4answers
863 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...
0
votes
1answer
83 views

Deeplinks in email that autologin

I'm wondering if a deep link in an e-mail that automatically authenticate even though the session is expired is GDPR compliant. For instance if I send an e-mail to a user with links to the internal ...
0
votes
1answer
835 views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
3
votes
2answers
238 views

2-step authorization (using SMS) less secure than being without 2FA at all?

I've been thinking about a paradoxical but a theoretically possible event: Even though SMS-based 2-step authorization increases security generally, on the other hand, in some cases, it might become ...
1
vote
1answer
79 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
76
votes
3answers
15k views

Does correcting misspelled usernames create a security risk?

Does correcting a misspelled username and prompting the user with a valid username introduce a security risk? I recently tried logging into facebook and misspelled my email. They prompted me with ...
1
vote
1answer
197 views

What's the risk if I accidently type my password into a username field in a website? [duplicate]

On websites that separate the screens where username and password are entered, such as GMail, it is possible that the users type the password in the username field because the username is sometimes ...
2
votes
1answer
142 views

Smartphone fingerprint plus iris scanning for login

I have often thought about the fact that when intimate relationship partners live together they eventually tend to sneak over your shoulder and gain access to your password on either your mobile phone ...
0
votes
0answers
57 views

Potential Risks Using Reference Code Based Authentication For Web Based Application Form That Contains SSN [duplicate]

I'm currently building a web based membership application form that will require a user to enter an SSN and other identifiable information. Part of the requirements of the membership application is to ...
0
votes
0answers
34 views

Is this implementation of a bcrypt EtM flawed?

I know that you should never roll your own crypto, but I'm just implementing/combining(?) two highly trusted algorithms into Javascript First, I am using a bcrypt implementation that I did not code. ...
5
votes
1answer
334 views

​Multi-factor Out of Band Token authentication options suitable as per NIST recommendations 800-63B (published in June, 2017)

In our web application project we are required to establish MF authentication with combination of memorised secret token (password) and Out of Bound token. Earlier we were planning to implement SMS ...
1
vote
1answer
397 views

In what cases is it ok keep a user logged in or provide auto login if an app starts?

I am wondering what the difference is between WhatsApp and my Bank application, and what considerations determine what is the right approach to handle user authentication. WhatsApp: I create my ...
5
votes
1answer
176 views

Authorize transitive communication between applications on behalf of the user

I'm trying to wrap my head around to following web security question for a while now. Say we have a system set up as depicted in the picture below. There is one main application with which the user ...