Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
1 answer
96 views

Isn't there a critical built-in vulnerability in OAuth's Implicit flow?

I've read some blogs and did some labs regarding OAuth's implicit flow, but it seems to me everyone just turn a blind eye to a very critical point in the flow. Assuming that site A uses the implicit ...
Trigosin Darom's user avatar
0 votes
1 answer
87 views

Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?

It's considered a best practice in security for login form to provide a vague error message your username or password is wrong rather than the more precise: username does not exists wrong password ...
allan.simon's user avatar
0 votes
0 answers
139 views

If only 'two' insecure MFA options are available (email and sms) which is 'most secure'? [duplicate]

Although I disagree with the term MFA entirely if it refers to 'login code send to email', it's a one-time password at best, and likely badly implemented with its associated risks. I do see quite some ...
Bob Ortiz's user avatar
  • 6,665
1 vote
0 answers
125 views

Why is there no prevention of malicious polkit authentication agents?

A polkit authentication agent provides the user interface for administrators to input their password. It runs in user space. (https://www.freedesktop.org/software/polkit/docs/latest/polkit.8.html) An ...
Felix Ernst's user avatar
0 votes
1 answer
121 views

Authentication that immune to cookie hijacking [duplicate]

There is a website that uses a cookie to store the user’s session info. Let's assume that a hacker steals a user’s cookie to gain unauthorized access to their online accounts via some vulnerability. ...
Ghost Rider's user avatar
1 vote
0 answers
108 views

Are banks significantly reducing security by migrating everyone to mobile banking?

I have noticed a disturbing trend across banks (in the EU). Previously, many banks used 2FA by combining a login/password for an online banking website with a mobile authenticator app. However, many ...
TooTea's user avatar
  • 851
2 votes
1 answer
255 views

Is TOTP "more secure" and harder to crack than HOTP and why?

In addition to my question: How many known time/result combinations does it take to guess a HOTP/TOTP secret?. I've read often that TOTP is more secure than HOTP. One example: TOTP provides higher ...
Bob Ortiz's user avatar
  • 6,665
0 votes
0 answers
155 views

Prevent Session Hijacking with copying all metadata from a browser

For example, I'm signed in to my Gmail account. If I copy all data from all the places that Chrome uses (localstorage, all the cookies, all temp folders and so on) to another PC. How does Google ...
Ghost Rider's user avatar
10 votes
3 answers
7k views

Why do some websites require logging in twice? Not two steps, but two full username/password entries

There are a couple of web applications that I use that seem to require two successive logins. Not two steps, but two full logins. The behavior is such that I login in, get kicked out, then have to ...
Roy Hinkley's user avatar
0 votes
1 answer
124 views

Showing a license/id to a shopping website, worth it? [duplicate]

I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
skept1ca1's user avatar
10 votes
5 answers
5k views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
glades's user avatar
  • 219
0 votes
2 answers
200 views

OAuth2 authorization server dictating the resource server to the client

I am looking for any specifications, prior art, and known security considerations for a specific OAuth2 use case where: an authorization code grant is being performed. the client does not know the ...
Devin Ivy's user avatar
0 votes
1 answer
77 views

Authentication via User Interaction (Game play, using ML)

Something you know (password), something you are (biometrics), something you have (key card/security key) are the typical authentication factors. Several years ago I've seen a paper in which the users ...
Martin Thoma's user avatar
  • 3,932
1 vote
1 answer
809 views

Is there a problem with the use of HTTP cookies as auth tokens in mobile apps?

Imagine you have a website, for which you have configured a proper and secure session management / login system, using first-party / session cookies. Any interaction with that website is setup in the ...
DevelJoe's user avatar
  • 141
0 votes
0 answers
164 views

Progressive profiling with auth0: Security when communicating with auth0 actions

I currently try to implement progressive profiling with auth0 according to: https://auth0.com/blog/using-redirect-with-actions-to-gather-user-info-and-increase-conversions/ to gather first name and ...
Christian's user avatar
  • 101
0 votes
0 answers
124 views

IP Address 47.128.16.39 has been going through our site for more than 4 days

This IP address has been going through everything - every image, every page. How can we know who this is and whether they are doing any harm? Is this abuse? Should we report this? If yes, to whom ...
emgee's user avatar
  • 1
0 votes
0 answers
35 views

Do `Signature` headers have real benefits? [duplicate]

I'm working with an HTTPS API that requires me to include a Signature header, the signature is calculated as codeBase64(hmacWithSha384(key, body)). I'm wondering if it provides any real-life benefits ...
hangyas's user avatar
0 votes
0 answers
185 views

Optimal way to securely store password on client with server invalidation but not knowledge

A number of similar questions have been asked about this general topic before (e.g. How to store user credentials in browser securely?), but I wanted to seek some clarification on a specific scenario. ...
InterLinked's user avatar
0 votes
0 answers
107 views

Difference between PassKeys and using touch-id to login in Apps

PassKeys is a new way to sign-in to web-apps and mobile apps by FIDO alliance. I looked at it and could understand how it works; However, I'm unable to understand difference from using touch-id to ...
Procrastinator's user avatar
0 votes
0 answers
79 views

ow do I move password securely between api and web?

I would like to ask how I should go about securely transmitting the password between two applications. I have two projects that work with each other. The first one is a project called AuthApi, which ...
nikki's user avatar
  • 1
0 votes
0 answers
251 views

Refresh-token rotation without additional frontend requests

I'm implementing a refresh-token rotation mechanism. For the sake of simplicity in implementing the frontend I would like to remove the need for requesting a new access token when an old one expires. ...
Ilija Vuk's user avatar
  • 101
1 vote
3 answers
825 views

is mTLS authentication alone considered secure for authentication

We have recently engaged an external party to undertake a pen test on a recently implemented API. The API is considered internal although it itself is on AWS and is consumed from on-prem resources, ...
Kinexus's user avatar
  • 113
0 votes
1 answer
751 views

Identifying a session hijacking attack [closed]

I understand session hijacking has been a widespread attack vector in the past months. If an attacker steals a user’s session cookies, they can bypass 2FA and login/password. If this is the case, how ...
Mark O's user avatar
  • 3
0 votes
1 answer
90 views

Simplest federated authentication protocol: is this the right way to do it?

I've been struggling to find very simple, low level explanations of federated authentication protocols. Previously I've seen SAML and oauth, but they both seem to be very high level and far more ...
Jachdich's user avatar
  • 103
0 votes
1 answer
91 views

Is csrf protection required for extremely short lived cookies?

I have an app with token-based authentication (stateless). for specific endpoint that serves an pdf file, it was ideal for me to authenticate via cookie. so I creates a cookie with my access token, ...
ינון רחמים's user avatar
0 votes
1 answer
162 views

Evading authenticated diffie hellman with MITM

I understand that in a non-authenticated Diffie-Hellman setup, a man-in-the-middle attack can occur. Now i'm curious about the feasibility of the following scenario: Let's assume a situation where www....
SempriGno's user avatar
0 votes
1 answer
139 views

WebAuthn does not guarantee public-key integrity other than trough attestation?

I've been reading about WebAuthn and try to write some code to exercise. One thing I noticed is that the spec doesn't seem to provide any way to verify the correctness of the public-key being create()'...
DannyNiu's user avatar
  • 374
0 votes
0 answers
132 views

What's the best approach to storing JWTs on the client

I'm developing a web application and I want to use token based authentication, but after implementing the feature on the server side I got stuck on trying to figure out what is the best approach to ...
iKingNinja's user avatar
0 votes
0 answers
102 views

Passkeys versus passwords for intranet websites

Do passkeys offer more security for intranet websites compared to passwords? I know there are additional methods like 2FA to get more security, but I just want to look at a optional replacement for ...
fitcfitcfatc's user avatar
-1 votes
1 answer
138 views

PATCH request on a login attempt

I have a problem deciding what is the most secure method to send a login request with a username and password strings, I understood that PATCH is less secure than PUT while both are less secure than ...
Jan Safronov's user avatar
1 vote
1 answer
660 views

Where are wifi passwords stored? [duplicate]

I'm looking for technical details on how Windows, Linux, and macOS all store the SSIDs and passwords for every wireless network you've ever connected to. I've tried searching for this, but my Google-...
Wes Sayeed's user avatar
0 votes
1 answer
797 views

Perfect DMZ: LDAP auth to AD

My goal is to integrate a public facing service with AD using LDAP. While I vouch for federated approach to user authentication, the business dictates LDAP. We run a DMZ subnet and I insist on not ...
Grigory Sergeev's user avatar
1 vote
1 answer
135 views

Is using the computer for MFA safe?

Recently, I discovered that MFA apps just calculate that codes based on a private key and the time clock, so it's easy to use tools like gnu pass to replace those apps with your computer. But what are ...
Vitor Figueredo Marques's user avatar
1 vote
0 answers
76 views

MS-CHAPv2 Auth protocol downgrade

I'm researching about PPP (Point to Point protocol) and it's security aspects. While exploring PPP Authentication I've noticed possibility for security downgrade attack. Generally authentication ...
Zduniusz's user avatar
0 votes
2 answers
422 views

Most secure way to pass data from client to server?

I'm writing an authentication system and would like some suggestions on improving its security. Currently, I use RSA to communicate data between the client and the server. Here's the process: The ...
Daniel Rayburn's user avatar
0 votes
0 answers
64 views

Make use of encrypted or anonymous data in database [duplicate]

As an answer to the following question, I read the idea of encrypting user data with 2 keys based on random generation and the user password: Store encrypted user data in database But could anyone ...
Sichrisy's user avatar
0 votes
0 answers
139 views

Bearer JWT session token value

I am working on a personal project, I am now working on the authentication. My back-end is written in Python (fast-API) and I am generating a JWT bearer token that I put on my cookies for my front end....
Pierre-Alexandre's user avatar
1 vote
0 answers
93 views

Best practice of x.509 client certificates accross multiple systems

I have several MongoDB's where I use x.509 Certificates to Authenticate Clients Let's say I create certificate and user for admin: subject: CN=admin issuer: CN=MongoDB Issuing CA -> db.createUser({...
Wernfried Domscheit's user avatar
2 votes
1 answer
325 views

Should I return JWT tokens on a login route even if I am using cookies?

I have built a basic REST API that uses Json Web Tokens for authentication. Currently, I have built my frontend to store the JWTs in localStorage. I have read this is insecure and want to switch to ...
Jaanis's user avatar
  • 21
3 votes
1 answer
218 views

How to form the IV and Additional Data for TLS when encrypting the plaintext

When using AES GCM for encryption within TLS and referring to the below diagram: Is iv[0:3] the fixed IV established from the handshake and iv[4:11] are the current (write) sequence number + 1? For ...
rare77's user avatar
  • 145
1 vote
1 answer
158 views

Does TLS 1.3 include the auth tag from GCM in the record?

When TLS 1.3 is used with GCM AES (128), does the GCM auth tag (calculated right at the end) get included within the record? I am looking at the 1.3 RFC and section 5.2 doesn't seem to explicitly ...
rare77's user avatar
  • 145
1 vote
1 answer
187 views

CryptoKey with IndexedDB to secure stateless authentication

Stateless authentication using e.g. JWT can be dangerous as they are non-revocable and can leak giving full access. But they are really flexible. I'm considering a scenario where the issued JWT is ...
Szyszka947's user avatar
1 vote
1 answer
255 views

What happens first in a request having both CSRF Token and JWT token, authentication or authorization?

This question came across my mind when I sent an ajax request from html to a backend django server and forgot to add a csrf token to the request payload and recieved this error. 403 error means that ...
Aryaman Gupta's user avatar
0 votes
1 answer
1k views

OIDC + Authentik: Which token to give to user for authentication?

I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head ...
Tim's user avatar
  • 1
1 vote
0 answers
118 views

Is it bad practice to store passwords in a JWE? If so, why?

First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though. In my program, ...
JoffLobster's user avatar
0 votes
0 answers
109 views

Possible authentication vulnerability, is it an issue?

I have found an interesting bug (?), but I'm not sure if it is an actual vulnerability. Let's assume we have target, A, user, B, and 3rd party auth provider, C. User B signs up with target A with ...
UCYT5040's user avatar
  • 101
1 vote
0 answers
116 views

SSH Login Security - Proxy User with key and su to root

Introduction: I know this question has been asked many times before in many different forms, but I wanted to come at this in a slightly different way. I am considering many different ways to secure ...
user avatar
0 votes
0 answers
120 views

Is there a security flaw in this system design?

I'm working on the authentication part of my application. Previously, I was using Firebase but I decided to work differently for some reason. As I never implemented such a system, I'm asking for your ...
Big_Boulard's user avatar
3 votes
1 answer
327 views

Session Identifier: User-specific data in signed cookie vs Randomly generated session identifier

This question is inspired by looking at the functionality of the Flask-Login extension for the Python's Flask Framework (Web Framework). This extension generates a session identifier using the user's ...
WhiteFox's user avatar
1 vote
1 answer
150 views

What is the easiest way to implement a "passthrough" to let a device bypass the header requirement of an API which we both own?

For starters, I don't have any prior knowledge of implementing security/authentication on backends and frontends because of various reasons. So please forgive my ignorance. So I implemented JWT token ...
rminaj's user avatar
  • 111

1
2
3 4 5
91