Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
8
votes
3answers
290 views

Why would password managers provide support for OTP codes? [duplicate]

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been ...
0
votes
2answers
72 views

Is there a type of login security that is keylog and screen capture proof that doesnt require a 2nd device?

I am looking for a login security measure where it is keylog and screen capture proof. Is there some type of login security like a 2FA without the need of a second device, but remembering a pattern or ...
0
votes
0answers
35 views

Delegating to multiple auth providers from a single page application

Consider a use-case in which a single page application using an OAuth identity flow has to use one of many possible identity providers, as determined by what user is logged in. More specifically, I ...
2
votes
2answers
401 views

Exposed my browser cookie of my request header

I exposed my browser cookie of my request header in a web forum. After I realized what I have done - I logged out, cleared my browser and logged in again. Am I safe now? Can someone still use that ...
2
votes
1answer
105 views

How to manage API keys

I'm trying to consume a payment processor API (not developed by my), but (being honest) I don't know anything about security, I don't understand API keys and authentication, I have multiple questions ...
2
votes
1answer
236 views

Authenticate-then-Encrypt: does the authenticity provide a benefit?

First off: I know that encrypt-then-authenticate is better, however I want to understand the following for authenticate-then-encrypt. The underlying cipher is AES-CTR or AES-CBC for this consideration....
2
votes
2answers
149 views

How is mailbox.org 2FA method referred to as, correctly?

Their 2FA to log in to their web interface requires two things: something you know (PIN); something you have (OTP, generated by app for example). After that, you need to log in by: input email ...
0
votes
0answers
17 views

Security implications of protecting private data with a long URI exclusively [duplicate]

A website hosts private/personal information at a very long and unpredictable URI, yet access to this URI is completely unauthenticated. Are there any major security issues with this? I can think of ...
0
votes
2answers
64 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
1
vote
2answers
95 views

How can I give users access to thier data without requiring any authentication? [closed]

The premise of this question boils down to frictionless access to data. I have User A whose records I have kept on a database. I want to send them a link to their records such that they can access ...
1
vote
0answers
53 views

Understanding Risk-based authentication (Google case) [closed]

I am trying to access my Gmail account. I have the correct password. When I click on login it asks for a confirmation code sent to my recovery email. Hopefully, the recovery email does not have this ...
1
vote
0answers
49 views

What is the optimal authorization flow for this usecase?

Imagine that I'm building a server that provides useful APIs for web chat development. I want it to be accessible only to registered developer accounts. A developer registers and builds a chat that ...
1
vote
1answer
73 views

2FA on Stack Exchange, Where Is It Or What I am Missing?

Not sure if this is the right spot to post this, but I have not been able to find how to enable 2FA (such as authy, MS/google authenticator, yubikey etc...) on stack exchange using email ...
1
vote
0answers
34 views

Why do some “OAuth” providers ask for personal info?

I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion. When I want a Client to process my google docs for something, I have to go through ...
1
vote
0answers
61 views

Possibility of EMVCO 3DS Authentication Decoding [closed]

I bumped across a request via Traffic analysis through Burp Suite Proxy & it looked like a 3DS Authentication. Sample below: My question was if this authentication could be intercepted, decoded ...
0
votes
0answers
52 views

Protect breached email accounts

We are a big supermarket chain and have had complaints about fraudulent activities from a few customers who have used a particular email domain. We are in the process of implementing MFA on our site. ...
4
votes
0answers
106 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
0
votes
0answers
47 views

Using fields in X.509 cert for authorization [duplicate]

I understand that X.509 certificates are used for authentication. How can I use the information provided in an X.509 certificate for authorization? For example, are there any fields in the certificate ...
0
votes
2answers
70 views

How to avoid data discrepancy between multiple parties with dependent financial interests?

Generalized problem say there are 2 companies/parties A and B (there may be more) and there is an event E which is recorded by both A and B. Let's say the occurrences of event E according to A is 'E ...
2
votes
1answer
55 views

Using encryption key as input keying material

Libsodium supports Blake2 for key derivation. It seems like you shouldn't truncate the output to get two keys (eg one encryption/one mac) as the recommended way is to use a counter as the salt for ...
32
votes
6answers
4k views

Should I log users in if they enter valid login info in registration form?

Recently, we've had users complain that they forget that they have an account, try registering, and get error message that the user with such email already exists. There is a proposal to just log them ...
0
votes
0answers
61 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
1
vote
0answers
35 views

What is Received Sequence Counter(RSC) in WPA authentication

In WPA 4-way handshake and in Message 3 (while GTK transfer), A RSC (Received sequence Number ) sent by the Authenticator (AP) to the supplicant. The only information I found about RSC is that it's ...
1
vote
1answer
116 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
2
votes
1answer
63 views

Suspicious login alerts vs customer privacy

I would like to implement a "Login from a suspicious location" email for my users. The first thing that came to my mind was to use a GeoIP Latitude Longitude and a k-d tree to compare the ...
3
votes
1answer
92 views

Does TLS fall back to unauthenticated key exchange if the CA is not known to the client?

My lecturer said that if the server sends a public key certificate (RSA) signed by a Certificate Authority that the client does not know about (i.e. the client doesn't have a master certificate for ...
2
votes
2answers
79 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
1
vote
0answers
49 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
1
vote
3answers
143 views

ssh and anonymity?

According to the man page, ssh by default sends multiple public keys from files in the ~/.ssh folder, one by one, until authentication success. Does that mean that the server side could know multiple (...
0
votes
1answer
84 views

Authentication to offline device

I have an offline safe at a remote location that I want to give people access to at my discretion. I would like to control who and when they have access, without having to travel to the safe. Example: ...
1
vote
1answer
63 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
0
votes
0answers
50 views

Server to server API authentication

We have an ASP.NET WEB API 2.0 that will be accessed by an MVC Core site. We want to restrict access to the API only to the MVC Core site (both sites will run on our VMs in Azure). Is it sufficient ...
0
votes
0answers
52 views

Trace Unauthorized login into My Gmail and Facebook Account [duplicate]

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
0
votes
0answers
80 views

Why does using JWT refresh tokens protect against CSRF during authentication?

I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance ...
2
votes
1answer
39 views

Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software

I've been reading many research articles about RoT - Root of Trust - for establishing a chained root of trust going up from BIOS to the Kernel. However, most of the article go briefly on how RoT works ...
5
votes
1answer
508 views

Is there a security reason to require email address and password in separate steps? [duplicate]

I have noticed lately that instead of having an email address and password entry box on the same page/screen, a lot of websites and apps will instead ask for your email address first, then it will ask ...
1
vote
0answers
34 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
0
votes
0answers
43 views

Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
0
votes
0answers
30 views

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
1
vote
1answer
69 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...
2
votes
3answers
411 views

Securing client side code of react application [duplicate]

I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription. Are there any methods to ...
0
votes
0answers
59 views

How do I assure that a site that I visit does not know I have been there before? [duplicate]

If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
1
vote
0answers
40 views

Problems understanding the use of Distance Bounding against Man-In-The-Middle attacks

I currently have to write a paper for university in my Network Security lecture about methods of secure location verification. Therefore, I chose to write about several distance bounding protocols, e....
2
votes
1answer
215 views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
8
votes
4answers
2k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
2
votes
1answer
79 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
74
votes
8answers
10k views

Why is email often used as the ultimate verification?

In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
0
votes
1answer
117 views

Secure HTTP login in an embedded (IoT) system

HTTPS in an embedded (IoT) system is (as far as I know) not necessarily a good solution. Basic Authentication is not secure. Acceptable in an internal network. Idea: Login.html (when called up) sends ...
3
votes
1answer
162 views

Spooky Suspicious Sign-In From My Town

I just had a weird experience that I am trying to figure out. I received a suspicious sign-in notification from google on my gmail account. They had my correct password. This isn't that surprising, ...
1
vote
1answer
51 views

What happens if a secure token is provided to a trusted party that gets compromised

Take for example - AWS STS token or JWT tokens. Let’s say node A got a token for accessing a resource of account X on behalf of account X. Access includes read/write privileges. Let’s say few minutes ...

1
2
3 4 5
82