Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
179
votes
4answers
317k views

What is the difference between authorized_keys and known_hosts file for SSH?

I am learning the basics of SSH protocol. I am confused between the contents of the following 2 files: ~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
1
vote
1answer
52 views

Reasonable security measures for unvalidated “login”

Sorry, kind of a long question. I am hoping that someone smarter about InfoSec than I am will read what I'm doing and give me guidance... Background My website allows psychiatrists to track their ...
1
vote
1answer
307 views

Remember me feature: do we need a server side token if the cookie is signed by the server?

Every resource I find (I, II, III) about how to implement in a secure way the typical "remember me" login feature, recommends storing a user identifier and an associated unique token in the cookie, ...
0
votes
3answers
283 views

Is it safe to help a stranger login to gmail using my phone number?

I was assisting a man at the public library who was unable to login to his gmail account. He typed in his password and was prompted for a phone number, presumably so a code to be sent which would then ...
1
vote
3answers
1k views

Why does ssh `known_hosts` file need server name?

When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server and asks if I want to trust and add it to known_hosts. Apparently this is because GitHub has ...
0
votes
1answer
64 views

authentication file sharing with qr code

I want to share a file for viewing purposes to customers. The qr code will be imprinted on the product, so the customer will be the only one with access to it. The file should not be accessible to ...
2
votes
3answers
365 views

Secure preshared key 2 way authentication

I have the following setup: A server and a client will be connected over tcp. The server and client both have access to the preshared secret key. When the client connects to the server, the client and ...
2
votes
2answers
129 views

Authentication using a digital signiture

I'm new to the world of digital signatures and encryption and I'm trying to learn more. I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital ...
6
votes
2answers
253 views

Non Confidential OAuth2 flow

I've been going through some documents regarding OAuth2 confidential and non-confidential authorisation flows, namely this and the RFC. From my understanding, the non-confidential flow does not ...
-9
votes
1answer
195 views

Does word store my passwords in plaintext? [closed]

I have a document which I wrote my passwords in and saved it to my disk, and I have been hearing a lot about programs storing passwords in plaintext Did word store my password I saved in plaintext??? ...
2
votes
1answer
138 views

Malicious Google Drive Links

Curious about a new form of spam I've noticed in my inbox. Someone seems to be using my email address to fill-out forms on sites, so that I receive the bounce back message. In this message there is a ...
29
votes
7answers
7k views

Why do we ask for a user's existing password when changing their password?

In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
35
votes
7answers
16k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems ...
1
vote
1answer
192 views

Kerberos composite authentication that reflects user's origin

I'm experimenting with Kerberos and was wondering if some sort of composite authentication that identifies both a user and the origin of the users request was a) possible and b) implemented anywhere....
0
votes
0answers
105 views

OAuth access token/API key patterns for large web sites

First off, let me preface this post by saying I'm not a security expert. I'm trying to build regular expressions to find OAuth 2.0 access tokens and API Keys for common web sites such as Google, ...
1
vote
0answers
53 views

Is there any privacy- or security-relevant difference between FIDO2 and SQRL

I just learned about FIDO2 (WebAuthn) and try to make a comparison to the lesser-known novel SQRL authentication scheme. Both seem to use the same key elements: a private, user-resident "master key" ...
0
votes
2answers
77 views

Is a web app vulnerable if it only uses session token in cookie to authenticate a user

I am new to bug hunting and i came across this website, so i came across this bug or atleast what i think is a bug so help me understand and tell me if i should consider it a vulnerability. The ...
0
votes
0answers
43 views

Is it possible to crack a CRC value for short text validation when someone tries to change a readable text?

I'd like to validate message texts with CRC-8/16/32 but I'm afraid that they could be changed to another one (for example, adding a "No" at the beginning). There will be no special characters besides ...
8
votes
2answers
6k views

How does a server validate the Certificate Verify message in SSL/TLS?

Client authentication may be used in a SSL/TLS negotiation. For this, the client will send a Certificate Verify Message after the server requested it. The Certificate Verify Message contains the ...
1
vote
2answers
986 views

When is it okay not to use anti-forgery token in login page?

In this post, there is a paragraph that mentions a scenario where there is no need to validate anti-forgery token in login page: When is it OK to leave off the anti-forgery token? In general, if ...
0
votes
2answers
62 views

How to authorize user between each step in Multi-Factor-Authentication?

Assume an authentication process that has multiple stages ( eg: username/password then OTP) How you can authorize and identify user between each steps? If JWT tokens are used, is it an option to use ...
0
votes
1answer
73 views

SSO authentication & authorization architecture/implemenation

We got a bunch of different services (SPAs + API GW, legacy JavaEE apps, etc.). Each of those is usually ran in multiple instances (customer specific instances). The plan is to federate them under a ...
0
votes
1answer
69 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
1
vote
1answer
116 views

Is there any system that can authenticate my device to open only select apps on it?

I am looking to have an authentication system with which I can link a device to an employee, and then put in place certain privileges so that the employee is only able to open select apps on only that ...
0
votes
2answers
267 views

Trying to figure out the hashtype of this digest-auth htpasswd file

Simple question for y'all as i'm having some trouble identifying the hash type of this from a http digest file that I have setup for rutorrent on a apache2 server. Here's an example of what it looks ...
2
votes
2answers
77 views

Does TLS have any way of exposing only the URI in a SSL-SSL proxy, or BlueCoat style appliance?

I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data. Does any standard, or feature exist ...
1
vote
1answer
185 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
0
votes
3answers
3k views

Two-factor authentication Without Mobile Phone

Two-factor authentication is based on the notion of “something you know” and “something you have”. Is it absolutely necessary for having your mobile phone involved in two-factor authentication, which ...
1
vote
3answers
368 views

Two factor authentication(Mobile)

Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
55
votes
9answers
52k views

Two-Step vs. Two-Factor Authentication - Is there a difference?

These days, there's pretty much three forms of authentication in general use on the web: Single-factor authentication, e.g.: PIN or password. Two-factor authentication, e.g.: Single-factor plus a ...
4
votes
1answer
1k views

How many authentication factors are there?

The three classes that we all know and love: Something you know. Something you have. Something you are. I've also seen references to "somewhere you are". Is this really a fourth factor? How many ...
4
votes
1answer
1k views

what is a valid challenge for 2 factor authentication?

When designing a password reset process: Is an email address or an assigned username a valid piece of information (identifier) to ask for in two factor authentication? How does two factor ...
5
votes
3answers
2k views

Two-factor verification without a mobile phone?

Currently, some services use a second layer of veficiation if logging in from a new device: Gmail and Facebook send a text or call with a code Facebook generates a code in the mobile application ...
3
votes
4answers
901 views

Multi-Single-Factor vs. Multi-Factor Authentication

I was told at university that there exists a difference between the terms Multi Single Factor and Multi-Factor: Multiple single-factor-authenticator are presented to a verifier. Each of them will ...
30
votes
4answers
4k views

How is “something you have” typically defined for “two-factor” authentication?

A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
0
votes
0answers
67 views

SSH AUTH : sekey vs yubikey vs ssh-keygen

I've been pondering/hacking/experimenting/using/misusing and am torn/puzzled over this for the past month or so; Which of these methods should prove themselves more secure/least susceptible to be ...
2
votes
3answers
62 views

Is it advisable to tie different capabilities to different session tokens?

Let's say you're creating a banking web application with mobile apps. A bank user has permissions "transfer money" and "view balances." When a user logs in, we can create a session token (typical ...
0
votes
1answer
51 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
19
votes
3answers
14k views

Do readers for the “Mifare DESFire EV1” smartcard really need to know the card's secret key in order to authenticate the card?

I'm trying to understand the security of a contactless smartcard system, used for access control and payment. The card is a Mifare DESFire EV1 implementing ISO 14443 (see the this documentation ...
2
votes
1answer
79 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
0
votes
0answers
17 views

Password checking implementation: delay on unsuccessful attempts [duplicate]

What would be wrong with the username/password checker where the response is instantaneous for valid attempts but a pre-built time delay (say 1 sec) is used for unsuccessful ones? It would not slow ...
9
votes
3answers
815 views

What kind of factor is a physical signature?

I'm familiar with the basics of multi-factor authentication. Now I'm trying to understand how a physical signature, as written on, say, a check or a credit card receipt, would be classified: Is it a ...
1
vote
1answer
253 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
4
votes
1answer
462 views

SAML token and service calls

I am working on a tablet application and have come across an interesting issue. We have a domain joined tablet that runs a Windows Store Application. We already have user identity and we need to call ...
0
votes
0answers
214 views

Is server authentication in SSH secure enough?

Possible ways of SSH server authentication are: Server public key fingerprint verification Implicit authentication Explicit authentication In case of fingerprint verification everything runs on ...
0
votes
0answers
29 views

Secure access to MS SQL from web applications

MS SQL provides two primary authentication methods, Windows Authentication or SQL Server Authentication. Since local MS SQL accounts are problematic to maintain and monitor this option is not ...
0
votes
1answer
51 views

Can I rely on the CSRF cookie to check if a user is authenticated on the client-side?

I have a website that runs on example.com. The website makes AJAX calls to my backend API which sits at api.example.com. I employ a double-submit verification strategy. The backend has protected ...
20
votes
3answers
82k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
2
votes
1answer
248 views

OAuth 2.0 Resource Owner Password Grant - Handling of Access Token Upon Logging Out

I am new to OAuth 2.0. I used BShaffer's OAuth PHP Server on Authorization Code Grant, and I understand that the client application can have its OAuth token separate from its session authentication, ...
0
votes
1answer
169 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...