Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Authenticating/ identifying dynamic UI Client to Back-End [duplicate]

The title may be a bit misleading so I will try to make this as clear as possible. We have several microservices that expose endpoints and they communicate to each other. They needed to authenticate ...
user avatar
  • 101
0 votes
1 answer
71 views

O365 MFA: Challenge (Approve or Deny) sign on - dangerous?

I have been searching resources online about proper MFA/2FA (with O365 specifically) considerations. How is the MFA push challenge notification to Approve or Deny a sign-on not dangerous? I have yet ...
user avatar
  • 1
2 votes
1 answer
211 views

Is providing a "Acceptable client certificate CA names" list a security vulnerability for a server?

The certificate list I am referring to can be found using the openssl command, and is displayed under the "Acceptable client certificate CA names" heading. I am wondering if by exposing this ...
user avatar
0 votes
0 answers
117 views

Is client-side bcrypt sent over tls + server-side sha hmac secure for password storage?

I want to hash passwords for security, but strong bcrypt by nature eat up a bit of resources of the server. So I was thinking to do the encryption on the client side. This would prevent the password ...
user avatar
1 vote
1 answer
108 views

Does rust's Cargo provide cryptographic authentication and integrity validation?

Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
user avatar
0 votes
0 answers
68 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
user avatar
0 votes
2 answers
109 views

Should login requests be padded to avoid revealing password length?

If an attacker who can watch network traffic knows a victim's username and can figure out which request is a login, then the size of the login request will reveal something about the password length. ...
user avatar
  • 125
2 votes
2 answers
313 views

When using certificates as authentication, what identities the "who" part?

When using x509 certificates for authentication, I understand that there is a shared source of trust (the signing certificate authority). So that explains why a server is able to authenticate the ...
user avatar
0 votes
0 answers
118 views

Disabled MD5 and enabled SHA under SCHANNEL/Hashes in registry. xfreerdp fails with an ssl i/o error

So delving into securing server and not quite understanding how I broke the ability to rdp into my server (using xfreerdp). I disabled MD5 as an available hash and enabled SHA. The exact changes in ...
user avatar
  • 212
1 vote
2 answers
327 views

What are possible implications of ignoring the ssh host key warning?

With password authentication you're basically giving your password to the attacker. At least that is my understanding. What about public key authentication? I hear that a private key never leaves your ...
user avatar
  • 257
0 votes
1 answer
107 views

Modern security flow/process for trusted Mobile and SPA apps with self-hosted OIDC

Currently, there are two common auth flows i know: Resource Owner Password Flow Authentication Code Flow + PKCE (didn't mention other, since this one is more robust within redirect-based) This theme ...
user avatar
  • 101
0 votes
0 answers
58 views

Managing key storage and key rotation in a clustered authentication service

I want to build an authentication service that uses JWT with signatures generated using RS256. In a single-server solution, the implementation is rather straightforward. However, when it comes to ...
user avatar
1 vote
2 answers
148 views

How can I prevent people from logging into public services with non-company accounts?

Since everyone seems to have personal outlook, hotmail, and gmail accounts, is it possible to prevent people from using non-company email accounts when logging into Google, Bing, and other websites on ...
user avatar
0 votes
0 answers
65 views

Ways of Authentication in case server and client are hosted on different domains

I´m working on a project where user authentication is required. For some reasons we have to host the frontend and the backend on different domains. I usually send httponly cookies from server to ...
user avatar
  • 101
0 votes
1 answer
124 views

HTTP authentication with client-side private key

I'm designing a web service meant for storing data for users, but these users don't have proper server-side accounts, just a random master key the user generated and stores on their device (a bip39 ...
user avatar
0 votes
0 answers
120 views

CBC-MAC vulnerability with reused keys

I'm looking at the CBC-MAC vulnerabilities that arise when CBC-MAC is used incorrectly, specifically when the keys for encryption and authentication are reused. The source I'm relying on is the ...
user avatar
0 votes
1 answer
118 views

Multiple SMS activation codes received by error

For several days now I am receiving activation codes by SMS that look like this: Your ToYou verification code is 8058 Some are from ToYou, that seems to be a delivery service, others are from similar ...
user avatar
  • 101
0 votes
1 answer
1k views

Have I been hacked? I got an email from "account-security-noreply@accountprotection.microsoft.com" and now I am getting spam in my inbox

Three days in a row I got an email from Microsoft with the address, "account-security-noreply@accountprotection.microsoft.com" which everyone says is real. No one but me has used the account ...
user avatar
0 votes
1 answer
301 views

OpenID Connect with or without reverse proxy?

Many popular reverse proxies (tomcat, nginx, ...) seem to handle OpenID Connect and act as a Relying Party to hide the authentication complexity to all applications behind the reverse proxy, which ...
user avatar
  • 33
1 vote
0 answers
76 views

Why does Windows facial recognition not require a password on startup?

I was reading the following question: Why do mobile devices force user to type password after reboot? To find out why fingerprint authentication on my Windows 10 laptop isn't an option on startup. It ...
user avatar
2 votes
3 answers
437 views

OAuth2 - using Id Token for authentication to a backend service

Many resources on the internet state that you should use Access Token and not Id Token to authenticate to an API, but do not provide explicit reasons why. Are there any real drawbacks to use an Id ...
user avatar
  • 229
0 votes
1 answer
88 views

can an SSH session be initiated with a public key

I am able to SSH into an Embedded Linux device remotely using a private key with the following command as example (where id_rsa is the private key file): ssh -i id_rsa root@192.168.30.199 This will ...
user avatar
0 votes
1 answer
83 views

Is it bad security to pre-filled all the signup fields for my users?

I have a list of people with all their personal information (name, first name, date of birth, email, etc.). I created an account for each of these people in my database. I'm using Firebase. Since I ...
user avatar
1 vote
1 answer
245 views

OWASP Pentest - "Sensitive data sent in clear text" [closed]

We have our web app / REST API getting tested by potential customer. In the report they came up with this issue: Sensitive data like user credentials on login page, password reset, change password ...
user avatar
  • 121
0 votes
1 answer
242 views

How can a Microsoft "unsuccessful sign-in" trigger a 2FA request?

I was certain I'd find a question asking this, but a search didn't return any results. I have 2FA enabled on my Microsoft account, which requires me to approve all sign-ins using the Microsoft ...
user avatar
2 votes
2 answers
2k views

Is it possible to set an HttpOnly Cookie from one domain to another subdomain

I am pretty sure that the answer to my question is no, but I have been have a hard time finding an answer through official documentation or other posts here. Here is simple use case for some context: ...
user avatar
0 votes
1 answer
131 views

How secure does a session cookie have to be?

For personal learning I'm developing a webapp (PHP+MySQL) with login procedure as described in this article. I'm using two (pseudo)tables for validation: [users] id | username | password_hashed [...
user avatar
0 votes
1 answer
266 views

Can I reuse the refresh token as the remember me token?

I have an application with a server-client architecture. The server is a REST/JSON API and the client reaches to the server via HTTPS. I currently have a short-lived access token (JWT, stateless, 15 ...
user avatar
  • 101
0 votes
1 answer
147 views

Is the authentication system of this website secure enough?

Since I write an API for a website, I'm interested in his login system and his requests but something bothered me, I have the impression that the security system is weak... When I login, I send POST ...
user avatar
1 vote
0 answers
101 views

Relation between Radius - PAP - CHAP

I struggle to understand what relation RADIUS has with PAP and CHAP. Individually, I understand how CHAP and PAP work but I need clarification Based on the image above, imagine I set up the switch ...
user avatar
1 vote
0 answers
85 views

Advice on authenticating client requests for multiple APIs behind a load balancer

We've built a number of APIs that sit behind a load balancer. request -> lb -> app1 -> app2 -> app3 The load balancer routes requests based on the path to the ...
user avatar
1 vote
1 answer
249 views

Hashing sessions and retrieving them using cookie(s) with session "id" and "token"

I'm implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed). OWASP and ...
user avatar
2 votes
1 answer
114 views

Extended expiration on JWT

When we are talking about JWT authentication, how big of a security risk would it be to eliminate the concept of a refresh token and just have a single JWT have an expiration time of, let's say 30 ...
user avatar
  • 457
1 vote
1 answer
149 views

Is it possible to use cookie-based single sign-on authentication scheme if sites do not share a common DNS parent domain?

According to the "Single sign-on" page on Wikipedia: A simple version of single sign-on can be achieved over IP networks using cookies but only if the sites share a common DNS parent domain....
user avatar
  • 351
2 votes
2 answers
148 views

How to do auth without user interaction in an enterprise environment?

We are building a Chrome Extension that will be force-installed on each employee's browser for the companies we work with. We currently use OAuth but many employees are forgetting to sign up. We are ...
user avatar
  • 21
3 votes
1 answer
528 views

What is Google's "match the number" verification trying to achieve?

When I log into my Google account from my laptop with 2FA enabled, I usually get a prompt on my smartphone in order to confirm the log in. I tap OK and then I am logged in. However sometimes I am not ...
user avatar
  • 133
0 votes
1 answer
202 views

How best to cryptographically sign scientific papers?

Academia has had some high profile cases of forged identity; for instance, in the last decade the publisher Springer has had to retract 62 papers for this reason alone. Usually these aren't high-...
user avatar
  • 171
0 votes
1 answer
106 views

Does having secondary email for 2FA increase security

Bank account have portals that one can access online. After entering my uname/password, OTP is sent via SMS to mobile phone. After entering OTP and password again, one is allowed access to online ...
user avatar
  • 149
0 votes
0 answers
65 views

Do I need to authenticate a user on WhatsApp when using twilio?

We are building an online shop using django. We have developed an API for our application to interact with Twilio. This is so users can buy products on WhatsApp from our application. I want to know ...
user avatar
  • 101
1 vote
1 answer
261 views

Is OAuth2.0 Authorization Code Grant flow with PKCE really secure?

CONTEXT There is a SPA that uses Authorization Code Grant flow with PKCE to get info from an API all the info is highly sensitive RESEARCH Here is what I found of how Authorization Code Grant flow ...
user avatar
  • 143
0 votes
2 answers
170 views

Is it bad practice or major security risk to cache decoded auth tokens in my backend?

I've set up a firebase passport strategy on a NestJS server which works fine, but I did not like the long load times it would incur on all requests that went through it. So I decided to cache decoded ...
user avatar
0 votes
1 answer
128 views

Store a password as an identifier (as safely as possible)... since there is no other choice

I have to deal with a place that has some terrible security practices. For example, this place gives people passwords (eg. domain logon on Windows, but paired with their name as the username) that is ...
user avatar
1 vote
1 answer
136 views

Is username + password functionally equivalent to a single login string of the same length?

My intuition is failing me with this. Would it make it easier or harder for an attacker trying to gain access to any of the accounts in a database? I can see that in the case of a single login string, ...
user avatar
  • 111
0 votes
2 answers
126 views

Authentication strategies for dealing with users that willingly provide their credentials to others

Let's say we have an employee that has an account on an online system that she does her work on. Let's say she doesn't want to do the work. So she provides her login credentials to someone else. 2FA ...
user avatar
2 votes
1 answer
187 views

Is multiple methods of Two-Factor authentication less secure than a single method of 2FA?

If I set up 2FA on my Microsoft account (for example) and I create multiple methods such as SMS, email, and an authenticator app, will I be more vulnerable than if I only set up the authenticator app? ...
user avatar
  • 123
2 votes
3 answers
203 views

Is it sensible to accept a password + any other random characters for successful authentication?

Supposing a user of my system has set their password to Password123 At the login screen, what would be the security implications of me accepting: Password123 or Password1234 or Password123ABC Based on ...
user avatar
  • 21
1 vote
1 answer
176 views

Is 2FA based on Google Authenticator Real?

I was reading this response on SE about 2FA: Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of ...
user avatar
2 votes
3 answers
367 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
user avatar
  • 131
0 votes
0 answers
329 views

Security: Plaid vs Quicken vs Mint

Why are people so quick to criticize Plaid for using login info when trusted apps like Mint do the same thing? They require username and password for bank info, but seem to be trusted. I wanted to use ...
user avatar
0 votes
2 answers
165 views

How/What to prompt user for fingerprint login using smartcard?

We are using a PIV smartcard that has biometric information (fingerprint) of the user encoded on the card to login into our application. We have the capability to read the fingerprint from a reader ...
user avatar

1 2
3
4 5
87