A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
1
vote
1answer
50 views

What protocols are authenticated by Active Directory?

Most of the new authentication solutions (IDaaS) are focused on HTTP (for example implementing SAML and OIDC). What protocols does Active Directory support, that are not normally supported by IDaaS?
2
votes
1answer
89 views

Double submit cookie: CSRF token doesn't need be a random value?

Note: I have read the answer to this question, but found it unsatisfactory, probably because I don't understand enough about security. I'm referring to a frontend server-side rendered SPA + a backend ...
1
vote
5answers
201 views

Can I use a cryptographic hash function to prove my authorship of an anonymous article?

From what I understand, hash functions are one-way functions. Let's say that I want to publish an opinion article anonymously, but there is a possibility that I later want to prove that I was the one ...
0
votes
1answer
73 views

Authentication without sending password over network

I was reading this question about ssh authentication and there's a good discussion about authentication schemes. First, there's the answer that yes, ssh sends the full password to the server (but ...
2
votes
0answers
91 views

Failure analysis to avoid locking permanently online accounts [closed]

(I reposted here a question I previously asked in SuperUser, I think this section is more appropriate) Back in the days defining a path leading to loss of data or loss of online accounts was easy: ...
2
votes
0answers
52 views

What is the rationale behind two staged credential input these days? [duplicate]

I have begun to notice some apps and websites (particularly ones made by Apple) which present user login in two steps. In the initial state, only the username/email field is shown. Once you enter a ...
5
votes
3answers
8k views

What is a AUTH-KEY in the security of the computers?

I'm studying security in computers and in particular the URL Spoofing. I understand that a form of URL spoofing is phishing. Then I read that a countermeasure against phishing is the authentication ...
2
votes
3answers
106 views

Doesn't Authentication logically imply Non-repudiation? [duplicate]

If it is confirmed that Alice is the source of a message (authentication), then shouldn't she be unable to deny that the message is from her (non-repudiation)? Is there an example where ...
7
votes
1answer
5k views

Facebook login with profile picture?

When I use Facebook, after I log out, I can see my profile picture on the login screen of Facebook. With great curiosity, I click on the profile picture (while I am still logged out) and Facebook logs ...
32
votes
3answers
27k views

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
1
vote
2answers
131 views

What happens when you lose access to the second factor? [duplicate]

Imagine you use your phone number as a second factor to access your e-Mails (e.g. through SMS). What happens if I change phone numbers and then no longer have access to that second factor? Can one ...
0
votes
1answer
82 views

Permissions API [closed]

We are about to develop an integration with an old system which is still live . Due to technical issues it is not possible to augment the data from the old system using the browser so we are going to ...
2
votes
1answer
74 views

How does the browser know windows logged in user id or Kerberos TGT?

My organization uses SSO for its applications i.e. Once a user logs into his Windows 10 workstation, he accesses his web application without login. I was informed that the web applications uses NetIQ ...
1
vote
2answers
216 views

Tracking Down Failed Logins

I've recently implemented a SIEM solution, and am now able to see a large amount of failed login attempts from legitimate users. In fact, it's such high volume that my SIEM is correlating them to be ...
0
votes
1answer
198 views

Having a JWT that doesn't expire

I'm trying to understand why having a JWT access token that doesn't expire is bad for my application. The way I have written my backend, when the JWT comes in, I verify it and extract the subject ...
0
votes
0answers
52 views

Learning how to audit a linux system, what does it mean to configure password & system auth?

I'm currently using Linux Red Hat OS, and I need to configure it accordingly to /etc/pam.d/password-auth and /etc/pam.d/system-auth under CIS Red Hat Enterprise Linux 8 Benchmark v1.0.0-1. What page ...
1
vote
4answers
566 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
0
votes
1answer
99 views

BitFinex unauthorized login [closed]

A few minutes ago i got an email from the real Bitfinex, saying that a unauthorized login attempt was approved by Bitfinix. Is this the work of a new breach? The IP is located somewhere in Japan.
1
vote
1answer
337 views

How to store user credentials in browser securely?

I need help to authenticate User with user credentials. We are using Angular 5 as a front-end & need to store user's email and password if user checks on remember Me. autofill user credentials ...
1
vote
0answers
28 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
3
votes
1answer
121 views

Is there a security benefit to requiring a login before and after a captcha test?

On Stack Exchange, if you login with your email address and password and then get captcha tested, you have to provide your credentials a second time after passing the captcha. I've been trying to ...
0
votes
0answers
61 views

What is the difference between using an auth header and the request body to send credentials?

I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I ...
2
votes
1answer
38 views

Known methods/techniques for thwarting credential phising attacks

Is the solution to preventing credential phising attacks is really only 'educating' people about it? For the sake of this question, let us assume that I have a web application that takes a username ...
5
votes
2answers
315 views

Using third party authentication like google/facebook to login to a site, is there any security risk when the site is hacked?

Sites like stackoverflow, quora, and many more offers sign in from Google/Facebook. In the event that there is a data breach or the site is hacked, is there any security risk to your Google/Facebook ...
2
votes
0answers
88 views

What is the best practice of CSRF/CORS for universal apps?

I am making an universal app using react-native and react-native-web. My graphql endpoint is open to public. I know CORS/CSRF do not apply to mobile apps. But I also run the same app on the browser ...
13
votes
6answers
3k views

Is it a security issue to allow nearly identical email addresses when registering?

Say you have a website where it is possible to create accounts for all of the following email addresses: 'test@test.com' 'test@test.com ' 'test@test.com;' 'test@test.com;test2@test.com' Should this ...
1
vote
2answers
85 views

What are the guarantees that TLS provides without using a certificate in the scenario?

Assume a scenario where we have a modular system including: an Authentication Module (AM) which gets username and password of an internet user and issues a token for the user. User<-->AM ...
0
votes
0answers
83 views

What authentication systems have been involved in data breaches?

Recently, a Federal Judge ordered Marriott to reveal the forensics report for its data breach. I know the Courts have sided with businesses in the past to keep the forensic details of breaches from ...
2
votes
0answers
259 views

Can an Android Phone be used as a Windows Hello Security Key?

Microsoft Windows 10 does support physical security keys since some time. Google recently announced that Android phones can be used as security keys as well (primarily for their own services). Is ...
2
votes
2answers
69 views

How do you know which site credentials are sent to when signing into Oauth site in native apps?

I sometimes use these features where I can use my Google account to sign in to different service providers. For example, the Postman app lets me sign in to it using either their own user store, or ...
0
votes
0answers
43 views

How to stop the user from intercepting their own credentials in mobile apps? [duplicate]

We are experiencing fraud with our open API, so we're turning it private. Let's suppose that I'm using OAuth and Bearer token to authorize who can access my API. Request: App -> Credentials -> Auth ...
6
votes
3answers
23k views

What do I need to do to secure log-in and registration for my website?

What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
0
votes
2answers
128 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
1
vote
0answers
44 views

JWT scheme with different signing algorithms

I'm planning to implement a (slightly non-standard?) JWT authentication scheme with refresh and access tokens, in which refresh and access tokens use different signing algorithms: refresh token uses ...
10
votes
4answers
28k views

Bypassing Windows 10 password with Utilman.exe trick - fixed?

Recently I run into a locked down laptop with Windows 10 OS (actually I guess it was updated from Windows 7 if that matters). My collegue was using this computer some time ago and lost his login and ...
1
vote
1answer
55 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
0answers
32 views

One-Time Password (Email or SMS) as the Only Authentication Information [duplicate]

I was wondering about the implications (mainly in terms of security) of using a random, one-time use, password sent by email or sms to authenticate users to a web application. The application would ...
0
votes
0answers
57 views

Google SMS verification codes broken on a loop - should I be concerned?

So this is a little out of the ordinary. Not sure what to make of it. I've enable 2-Step Verification on a Google account. When opening mail or other G-related services, it sends an SMS(text message) ...
1
vote
1answer
73 views

Who should create the keys?

I'm trying to implement a Software deployment & updating function which is part of AUTOSAR AP standard. Background information: There are three parts. Integrator the client which user uses it ...
2
votes
1answer
122 views

Is there a name for this (unconventional?) use of RSA for authentication?

I am writing an article about a late-1980s system that uses the RSA algorithm for the purpose of authentication. However, rather than the usual approach of encrypting a hash of the message using a ...
1
vote
1answer
57 views

Kerberos over http documentation

The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a Where is the Kerberos over HTTP official ...
0
votes
0answers
33 views

IAM to IAM federation vs IAM to application federation

Considering two different scenarios: Federating our IAM with individual applications, for example a single SaaS or in house development Federating our IAM with another IAM instance, for example when ...
3
votes
1answer
86 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
3
votes
1answer
183 views

Does Nextcloud installation gives passwordless access to all files by default?

I used this guide to install Nextcloud instance on a Raspberry Pi. The installation went smoothly and in the end I could open the Nextcloud login page which, once presented with the right password, ...
0
votes
1answer
94 views

Website online assistant asked for my password

Sorry if this isn't the right place for this.. I recently joined an online gambling website and clicked on live assist. To verify my identity they asked for my username and password. I did not give ...
0
votes
0answers
31 views

Security implications of client side authentication with a remote database

I'm developing a desktop app for use internal to my company. The app's installation file is located on our company server and therefore is only accessible to authenticated employees (under the ...
9
votes
2answers
1k views

Smartcard authentication SSH remote client

I want to use smartcard authentication for my SSH sessions. Now sometimes I want to use a ssh client within a ssh session. So this situation: My desktop computer with smartcard has a ssh session to ...
1
vote
0answers
46 views

Is there any advantage in using Google's IAM on Android?

We are building a few corporate apps for field workers / front office. In most cases each user will have their own device, but there are some shared devices (for example reception). The devices are ...
0
votes
0answers
30 views

How to integrate an Oauth2 based application into a Wordpress plugin?

I'm working on a Wordpress plugin that integrates an external service. This service has an API that authenticates using OAuth 2.0. The plugin is public and can be used by anyone who has an account at ...
2
votes
4answers
870 views

How to protect WordPress from brute-force attacks?

One of my WordPress sites is being constantly attacked with brute force. I have the WordFence and Clef plugins installed. The number of login attempts is limited to just one. The password is very ...