Skip to main content

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
1 answer
1k views

OIDC + Authentik: Which token to give to user for authentication?

I am implementing a web service with a front end and back end. Everything but the login endpoint requires authentication. For authentication I use Authentik. However, I have trouble wrapping my head ...
Tim's user avatar
  • 1
1 vote
0 answers
123 views

Is it bad practice to store passwords in a JWE? If so, why?

First of all, I know that passwords generally do not have to be stored in a JWT or JWS since the token in itself can be used to authenticate. My circumstances are very specific though. In my program, ...
JoffLobster's user avatar
0 votes
0 answers
113 views

Possible authentication vulnerability, is it an issue?

I have found an interesting bug (?), but I'm not sure if it is an actual vulnerability. Let's assume we have target, A, user, B, and 3rd party auth provider, C. User B signs up with target A with ...
UCYT5040's user avatar
  • 101
1 vote
0 answers
121 views

SSH Login Security - Proxy User with key and su to root

Introduction: I know this question has been asked many times before in many different forms, but I wanted to come at this in a slightly different way. I am considering many different ways to secure ...
user avatar
0 votes
0 answers
124 views

Is there a security flaw in this system design?

I'm working on the authentication part of my application. Previously, I was using Firebase but I decided to work differently for some reason. As I never implemented such a system, I'm asking for your ...
Big_Boulard's user avatar
3 votes
1 answer
340 views

Session Identifier: User-specific data in signed cookie vs Randomly generated session identifier

This question is inspired by looking at the functionality of the Flask-Login extension for the Python's Flask Framework (Web Framework). This extension generates a session identifier using the user's ...
WhiteFox's user avatar
1 vote
1 answer
154 views

What is the easiest way to implement a "passthrough" to let a device bypass the header requirement of an API which we both own?

For starters, I don't have any prior knowledge of implementing security/authentication on backends and frontends because of various reasons. So please forgive my ignorance. So I implemented JWT token ...
rminaj's user avatar
  • 111
0 votes
2 answers
235 views

Security of password managers vs. risk of losing access

Is it safe not to have a 2FA for a password manager itself? It seems that using an app for TOTP authentication for a password manager could increase the security. But it turns out that in this case I ...
Broadways2's user avatar
0 votes
1 answer
77 views

Is create a key to access resources than send it to client instead of login/password system , a good idea?

I would like to make a key/string/token encrypted string to send it to the user via email. This encrypted KEY would have encrypted data (resource id) and would be stored in the database along with ...
V S Vuca's user avatar
0 votes
1 answer
123 views

Query on best practice - using 2FA to self-authorise IP addresses in an allow-list

I want to know whether a solution I'm considering for a web app is particularly secure / in line with best practices etc. Scenario - a web application, it's a stock management app for small retailers. ...
clumsybiker's user avatar
0 votes
4 answers
686 views

Is it bad practice to exclusively use phone numbers for both the sign-up and login process?

I am creating an app. Users need to both login and sign-up. I want to simplify the form for this process as much as possible. This got me thinking. Instead of doing the traditional email, confirm ...
Steven Khouri's user avatar
0 votes
1 answer
201 views

Is every string a possible username?

I have noticed that a lot of websites only allow a fixed amount of username changes, and does not allow the reuse of a previously or currently used username. For example, on Fandom.com once a username ...
God's user avatar
  • 1
1 vote
1 answer
1k views

SSH - What is the relationship between fingerprint and known_hosts file?

I am trying to understand the relationship between fingerprint of SSH server's public key and known_hosts file. There are two SSH servers with same public key. I, the client has the private key. I ...
rocky_alpine's user avatar
0 votes
2 answers
282 views

Why is known_hosts automatically updated but authorized_keys is not?

Referring to this post. We learned about ssh today, and I know that you have to add your public key to the "authorized_keys" manually on the server, but the very first time you log into the ...
user129393192's user avatar
5 votes
1 answer
220 views

Protection of API from abuse (signup and carding attacks)

I have a backend (API) and mobile apps. Mobile apps user use same client_id (Oauth2). Now I see many Bots signing up, adding credit card for checking them (carding) I cannot throttle, limit them since ...
dev's user avatar
  • 997
8 votes
4 answers
5k views

Enabling a user to revert a hacked change in their email

I am writing a web app and I want to set up a system where, when a user changes their email, it gives them a link to have the change revert back. The purpose of this is for when a hacker changes an ...
David Thielen's user avatar
0 votes
1 answer
137 views

2FA implementation security

I am looking to implement 2FA. I know of duo and eg. Eset secure authentication. But both solutions seem to be implemented in a strange way, that is they require some form of communication with either ...
atapaka's user avatar
  • 465
1 vote
1 answer
156 views

Is it possible to authenticate a device with a server without the device knowing any sort of secret?

Pretty much what the title says. I have been playing around with discord webhooks lately and one problem I have discovered is that anyone with the webhook url/token can send messages. This means that ...
OldAmmo's user avatar
  • 13
0 votes
1 answer
81 views

Securing access to SAC from Windows EMS

When enabling Emergency Management Services on Windows, one can access a limited terminal from a serial port, by default there's no authentication required. To leave the limited environment, you need ...
Zulgrib's user avatar
  • 121
0 votes
0 answers
19 views

Should I back up my Google Authenticator codes to my Google Account? [duplicate]

I just opened the Google Authenticator app and it says: "Sign in to back up your codes to your Google Account". How is that secure? I mean, wouldn't doing that essentially defeat the purpose ...
ma11hew28's user avatar
  • 289
0 votes
1 answer
119 views

Will a verified JWT token always ensure that user is authenticated when signed by an authentication server?

Prerequisites I have a client application (CA), an authentication server (AS) and a resource server (RS). The resources on the RS must be accessed and usable only by authenticated users which have the ...
condorwasabi's user avatar
0 votes
2 answers
147 views

Best way to store remembered recently used accounts for web application

In a web application where you have to log in, we want to implement a feature that shows recently used accounts for the device. The login screen will display a list of the usernames of the accounts ...
user2190492's user avatar
0 votes
0 answers
103 views

Passwordless authentication using expiring hardware keys

I am looking for a solution to implement passwordless authentication using expirable hardware keys. It is for devices around the world with Windows OS, and sometimes service technicians have to do ...
Taras's user avatar
  • 101
1 vote
0 answers
124 views

How does a TPM verify the identity of the calling process/service?

Any application can use a TPM chip to securely create and store cryptographic keys. For example for Digital Rights Management (DRM) or for prevention of cheating in online games. However, how can a ...
Equinox's user avatar
  • 21
1 vote
1 answer
1k views

Cracking WiFi credentials without handshake or PKMS

How can I crack WiFi credentials WITHOUT using the traditional method of capturing a PKMS or Handshake? When I connect to a WiFi network, I simply enter a password into a text box just like any other ...
Brendan F's user avatar
0 votes
1 answer
2k views

Using localStorage to keep the user logged in in PWA

I am searching for a safe way to keep the user logged in in my Progressive Web Application. When the user installs the PWA he needs to authenticate by the traditional auth method (e-mail and password)....
O'Niel's user avatar
  • 2,914
0 votes
1 answer
157 views

Is there a problem to store user permissions in the database instead of in a external auth service?

In AWS Cognito we could define a role/permissions as a custom attribute in the user pool, but we could have a User table and a caching database and fetch roles each time the user does a request. Of ...
Vitor Figueredo Marques's user avatar
1 vote
3 answers
481 views

How do websites check that password hashes saved in the database are the same as passwords hashed client-side?

How do websites check that password hashes saved in the database are the same as passwords hashed and sent by a client? I know that client-side hashing is not secure.
Den4ik's user avatar
  • 21
0 votes
2 answers
214 views

Data Model for JWT claims

I'm implementing a JWT-based REST API for the first time and I'm trying to figure out what information to send back on the response entity when a user logs in. The strategies I am considering are: ...
hotmeatballsoup's user avatar
1 vote
1 answer
111 views

Sudo user without ability to login

I have a main user with home folder encryption enabled. To avoid typing long phrase each time I want to have another user with sudo privilege and weak password. In the terminal I would first switch ...
Pawel Cioch's user avatar
1 vote
2 answers
176 views

Can my local MySQL server be accessed without permission

I have hosted a MySQL database server on a VPS to connect to a flask web app on the same VPS. It only has users with host as local ip address. Can it be accessed by anyone else remotely, except me? If ...
Prog Techs's user avatar
0 votes
2 answers
186 views

How to reuse PIN codes in the most secure way?

I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes. What could be a strategy for ...
Gamutmapper's user avatar
1 vote
1 answer
134 views

Why is it a bad idea to accept passwords one character at a time for an authentication mechanism?

For the purpose of my studies, I am trying to answer the below scenario, in my opinion it is not a good idea, because it would leave the system open to brute-force attacks. A novel password scheme is ...
compLearner's user avatar
1 vote
1 answer
124 views

AEAD: Authenticating a digest of my data instead the data itself

Relevant question for Python: Stack Exchange: https://stackoverflow.com/questions/75739308/aead-authentication-with-huge-input-that-doesnt-fit-into-ram Top Answers: https://topanswers.xyz/python?q=...
user2373145's user avatar
1 vote
1 answer
160 views

Is SRP/PAKE equivalent to an asymmetric crypto challenge?

As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
Dolda2000's user avatar
  • 191
0 votes
3 answers
181 views

Avoid checking passwords for dos attacks

A server gets requests with a username and password. Checking the password can be expensive, so a hacker can do a DoS attack by sending lots of requests with random passwords. No attempt to break in, ...
gnasher729's user avatar
  • 2,409
0 votes
0 answers
165 views

store strings in db with asymmetric encryption for a python app keeping the data secure

I'm designing an app that receives sensitive data input from a user and that data needs to be saved securely in a database. As far as I understand it needs asymmetric encryption but since this app has ...
mic f's user avatar
  • 1
0 votes
1 answer
166 views

How does Android/Firefox authenticate the Android Pocket app, for example?

I installed the Android Pocket app and logged in. My default browser is Firefox, which is already logged in to my Firefox account. This meant I did not have to enter my Firefox account password. ...
sourcejedi's user avatar
0 votes
0 answers
388 views

Cross-domain login authentication

I am currently working as system integrator for a banking company, that asked me to provide an authentication integration on a third party website on which the company would like to redirect users, ...
Los Sol's user avatar
  • 11
0 votes
0 answers
793 views

best way to keep user logged in with cookie and jwt?

I'm making an SPA with Laravel REST API and trying to keep it stateless. Right now I'm trying to achieve proper JWT authentication and 'remember me' functionality. On successful login the client ...
Bufer's user avatar
  • 11
10 votes
2 answers
2k views

Show if email exists and if password was incorrect on our login screen? [duplicate]

We're developing a new login screen for our system, we have a couple of million users and we're thinking about what to disclose to the user. We currently: Let the user know that the email or password ...
petur's user avatar
  • 201
0 votes
2 answers
156 views

How does a validity check on a stylus-made signature compare to a validity check for a pen-made signature

In the old days, when signatures were used to sign cheques, there were people specialized in how to determine whether a signature came from a particular person or from a different person (forger). ...
Joselin Jocklingson's user avatar
0 votes
1 answer
389 views

Bearer JWT client authentication and access token issued by authorization server

An authorization server issues an access token with issuer details which are exposed in a well-known API of that server. This server uses client authentication JWT tokens with clients configured. ...
user890234's user avatar
0 votes
1 answer
717 views

Implementing secure two factor authentication with Google Authenticator?

I would like to add two factor authentication to a login screen. My understanding of the process is the following: Generate a QR Code Scan this Code with Google Authenticator app Use a library to ...
JavaForAndroid's user avatar
1 vote
0 answers
116 views

Login with self-signed PGP/GPG cert. without security key

Is there a way I can use a PGP certificate to login on my computer, but without a smartcard? I have multiple self made certificates for document encryption and also a state issued one for legal ...
Unix's user avatar
  • 13
0 votes
1 answer
282 views

Google Security Cookies; Prevents cookie leak to malicious XHRs

Below is an excerpt from https://policies.google.com/technologies/cookies#security The ‘pm_sess’, ‘YSC’ and ‘AEC’ cookies ensure that requests within a browsing session are made by the user, and not ...
Aadithya V's user avatar
0 votes
2 answers
103 views

How would you enforce user to only connect on a given network?

How would you enforce user PC to only connect to a given network? Answers need to be OS agnostic. One weak solution could be to set client-side firewall rules to only allow communications with ...
Erwan's user avatar
  • 213
2 votes
1 answer
253 views

Should I display the 2FA secret only once or it can be always available?

A logged-in user enables 2FA for his account and a QR code with the secret is displayed. Is it correct to display the same QR code again when the user visits the 2FA settings page after some time? Or ...
collimarco's user avatar
0 votes
1 answer
95 views

Does this implementation of 2FA expose valid credentials?

I have come across scenarios where a website would send OTP once a user has supplied valid username/password. A confirmation dialog e.g. An OTP has been sent to your registered mobile number would be ...
Youbecks003's user avatar
1 vote
2 answers
113 views

Security/Liability Concerns with Sign-In-Provider Account Merging

Assume my solution offers 5 identity providers that users can choose from Apple Facebook Github Google Microsoft These providers all take user identity very seriously. Is there any legitimate ...
user65023's user avatar

1 2
3
4 5
91