Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
60 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
0
votes
1answer
85 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
8
votes
3answers
3k views

Client side password hashing with exposed salt word - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded "...
1
vote
2answers
104 views

Public-key-based website login

I'm looking to implement a public-key based login / authentication for a website. This will not be used for general users – it will be used by both automated scripts and for admin logins. Before ...
0
votes
1answer
93 views

How safe is my login system (conceptually)?

I implemented a 2FA authentication for a web app with PHP and Google Authenticator. In order to login to my system there are a few steps: User types in a complex master password in order to access ...
0
votes
2answers
47 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
1
vote
1answer
62 views

Is it ok to share relevant login information on an API's public endpoint?

I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens. Any request to the API needs an access token to the Authorization header. The API validates that ...
1
vote
2answers
154 views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
1
vote
0answers
78 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
0
votes
2answers
56 views

Generating QR-Code for 2fa from google maps api risky?

I am currently using 2-factor authentication to tighten security for my login system. I use Google Authenticator to scan a QR Code, which generates a key which I can use to login. What worries me ...
2
votes
2answers
85 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
0
votes
1answer
48 views

What are Security Considerations of Using File Upload/Comparison as Simplified Second Factor?

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...
0
votes
0answers
34 views

Securing my own routes with “Login with X” and OAuth2

I have a single page application which communicates with a REST backend. I want to require a user to login before being allowed to access certain routes. I want to offload user authentication to ...
1
vote
1answer
39 views

How do SRP (and PAKE generally) protect against verifier leak

I have been reading into PAKE protocols, specifically starting with SRP RFC2945 The gist of the requirement on the server is that the server saves triplet (username, verifier (v), salt (s)) in the ...
1
vote
0answers
37 views

How do I force a user to login again when using refresh tokens and their password changes

I am implementing my first service with authentication. So far I have a POC service that issues JWT tokens with an expiry of 1 minute. Users are forced to login again every minute which is not great. ...
0
votes
0answers
39 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
0
votes
0answers
39 views

Why multi step login forms [duplicate]

I noticed that quite a lot of websites are using two pages login model today e.g. AWS, google, apple etc. They suggest user to type an account id/email and then navigate to a different place to ...
0
votes
0answers
49 views

U2F instead of password for “sudo mode”?

Some apps (Github being the most prominent IMHO) allow using U2F token as a means of validation for "sudo mode" (potentially dangerous actions in UI like creating a new token) instead of password. ...
0
votes
1answer
48 views

Should login/refresh authentication routes return new tokens if an existing, valid token is present?

My server sets cookies with the JWT and refresh tokens on login, and likewise when the refresh route is hit. If a valid JWT cookie is found in the request for these routes, should a new one be issued? ...
1
vote
3answers
67 views

Is it acceptable to make login name public?

I develop a web application where registered users see each others usernames. Log in is performed via HTTPS Basic Authentication based on correct username/password combination. This way an attacker ...
1
vote
1answer
56 views

Can OpenID Connect be used to implement social login?

Using OAuth to implement social login is insecure (https://tools.ietf.org/html/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because the ...
0
votes
2answers
51 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
3
votes
3answers
90 views

When to implement authentication and authorization?

I am currently in situation where I have to decide when to implement security measures. So the question is simple, is it better to implement authorization and authentication methods right off the bat ...
0
votes
1answer
35 views

How to hide or secure django admin page?

I am working on an E-commerce website which is mainly in Django. I have this admin page. I want to hide, protect, secure it from other users/visitors means that only a set of IP address can view that ...
2
votes
1answer
59 views

how to protect smartphone data against theft?

i assume typical android has fully encrypted disk with a key stored in a header. header is encrypted using pin / pattern / fingerprint or not encrypted when there is no lock. is that correct? when ...
1
vote
1answer
61 views

How to verify a GPG file signature on Linux and Windows without connecting to the Internet?

Can you please hint me to the steps I need to verify a file's signature (without connecting to the Internet) on command line using GnuPG, when I have the required files ready: -installation file (eg ...
0
votes
1answer
50 views

File authentifications via PGP versus via unique file hashes

Many files that are available for download (eg in github) come along with "asc" signature files attached, or with a sha256 file hash. Can someone please explain difference of PGP signatures vs file ...
1
vote
1answer
57 views

Does TLS provide server authentication by default?

In the scenario where "Application A" wants to communicate with "Application B" over an API (HTTPS), I want to ensure mutual authentication is implemented. Meaning that "A" should authenticate "B" ...
1
vote
2answers
64 views

How secure is an IP whitelist compared to other web service security mechanisms like a passphrase?

When securing a web server/web application/website, you often have the choice between choosing something like using a password for authentication/securing a service and creating an IP whitelist or ...
2
votes
0answers
72 views

Can I skip any password hashing for localhost authentication?

Setup I have several services (Postfix, Apache (PHP)) that access a PostgreSQL database on a Debian Linux 10 system. everyone is on the same host they use the loopback interface (127.0.0.1) to ...
0
votes
1answer
61 views

Intercepting messeges in attacks on authentication protocols

I've recently read about Diffie-Hellman Man-in-the-Middle attack when a third party can intercept messages and thus construt two different symetric keys with both sides. However I still don't ...
1
vote
1answer
54 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
3
votes
0answers
50 views

Best practices for storing long-term access credentials locally in a desktop application?

I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this: Prompt the user for a ...
1
vote
0answers
25 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
1
vote
0answers
18 views

Is an “inversed” Device Authorization Grant flow secure for authenticating a daemon/service native app to a web server?

I am working on a hobby project which will involve a web server (hosted and owned by me) and a native app (which will communicate with the web server periodically) an end-user can install via a deb/...
2
votes
1answer
178 views

Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it

TL;DR I want to have "some thing" to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption. Context In this question ...
0
votes
0answers
28 views

Email WebView Mini Browser - can login be secure?

We send transactional emails all the time. If the links opened in the main browser where the user actually has a session cookie, things would be fine. But these days, GMail etc. just launch the link ...
0
votes
0answers
17 views

is KDC better than using symmetric keys and digitally signing for messages?

Lets say some bank sends messages between its own branch related to deposits and withdrawals. Messages are encrypted with symmetric keys and digitally signed in order to insure that messages cannot be ...
0
votes
0answers
62 views

How to facilitate secure chats between users

My company runs a chat room service where the users can securely send messages to one another. All users are authenticated by the service in advance, and will install software from the service onto ...
0
votes
0answers
31 views

How could I verify that a contract was actually sent to me from the client as soon as the contract is received?

If I want to store electronic contracts for clients over a long period of time. I need to make sure that those files are not readable by anyone other than the client until the client retrieves them at ...
0
votes
1answer
47 views

Why does Authorization Code flow need the authorization code?

I've implemented Auth Code flow with PKCE on my server, but I'm still not entirely clear on why I'm doing it. I've read through the IETF documentation and I get flashes of what seems like ...
0
votes
1answer
54 views

Reduce the risk of QRLJacking

I am currently working on a personal project to facilitate the connection of users to a private interface using a mobile application and a QR Code. Steps: Users download an application and log in ...
1
vote
1answer
58 views

Custom OAuth2 Authorization Server / Identity Provider

I am currently trying to implement my own Authorization Server following the OAuth2 protocol PKCE flow, coupled with my own Identity Provider. The idea is to be able to reuse the same identity ...
0
votes
1answer
76 views

Is sending token authentication information via cookie headers secure?

I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
2
votes
1answer
44 views

A couple of questions about ASP.Net Core default implementation for login security

By default, ASP.Net Core configures the login exercise with a couple of things that seem strange to me. I'd like someone who knows more about infosec than I to comment on these please. First, it ...
0
votes
2answers
86 views

Prevent download of an angular website by unauthenticated users

I have an app using angular and when deployed to a server, everyone can ofc download the source codes, obfuscated or not. Yet, I would like to prevent user that are not authenticated to see the ...
1
vote
1answer
66 views

What did the Author mean by saying “Bluetooth does not provide native user authentication.”

I was reading an article on Bluetooth security (see citation below), and in the introduction the authors writes: "Bluetooth specifications provide for three basic security services: - Authentication:...
0
votes
0answers
23 views

Can anyone send any certificate [duplicate]

I seem to be missing one fundamental point regarding Certificates and hoping someone can set me straight. It is constantly described that a certificate can be used for authentication and to ensure the ...
0
votes
0answers
15 views

If I store users username and password in cookies, for next time users logged in if they were clicked the remember me, is that a good idea? [duplicate]

I built new web application. In my login system I make remember me check box, If user clicks on that then his/her username and password will stored in cookies so for next time they will logged in ...
0
votes
0answers
28 views

'confirm old password' OAuth equivalent

I want to allow users to link/unlink several OAuth providers to their account. How can I mitigate 'office prank' attacks, when someone can access my computer while I am away? My account: OAuth with ...

1
2
3 4 5
79