Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
9
votes
5answers
3k views

Does 2FA Help Prevent Unauthorized Access in Phishing Attacks?

Given Attacker is targeting a user of bank.com. bank.com uses SMS or Google Authenticator 2FA, where the user enters the 2FA code into a form. Scenario Attacker registers domain name baank.com ...
0
votes
0answers
33 views

Login failures use case fine-tuning

I have set a policy in AD for account lockout in AD for 4 unsuccessful login attempts. I have a use case for Login failures event ID 4771, with a threshold of 50 login failure attempts. Now my use ...
0
votes
1answer
70 views

Best practices for generating and storing authorization codes and access tokens in OAuth server

I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
0
votes
0answers
61 views

Is caching the credentials hash and auth result secure?

I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including ...
0
votes
0answers
47 views

Low-Power Keyless Entry

When I get within a meter of my car with the key in my pocket, the door unlocks automatically. A standard 200mAh 3V coin cell powers the key for about two years. To think about this easily, let me ...
0
votes
0answers
44 views

Oauth2: should I increase the refresh token expiring date?

I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...
0
votes
0answers
27 views

Is it safe to use base64 value in API header for Basic Authorization? [duplicate]

I'm using a base64 value (dGVzdFRva2VuOlRlc3QxMjM=) as the Basic Authorization header when calling an API. Anyone is able to decode this value to the plain text value (testToken:Test123). Base64 ...
1
vote
1answer
97 views

Is it possible to defend against user enumeration during registration? [duplicate]

I am currently reading the book "Web Security of Developers" and it talks about avoiding Username Enumeration, and it makes no mention of the registration/signup page for your system. I've ...
0
votes
1answer
54 views

Risks with setting up a authentication-less public VPN

I'm in the process of setting up an authentication-less public VPN. To prevent against DoS attacks, I'm going to set up some sort of IP address based rate limiting. The VPN is port-bound, i.e., it ...
2
votes
0answers
38 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
3
votes
1answer
101 views

How do we verify a human agent in light of WCAG 2.2?

WCAG is a set of standard web accessibility criteria developed by the W3C that have been adopted by regulatory agencies in a number of countries, including Section 508 in the U.S., which makes ...
1
vote
1answer
107 views

How to properly invalidate JWT tokens and sessions in this use case?

I am building a web app, which is made of a Node.js Backend and Angular (NOT AngularJS!!! I only used the tag, because Angular was not available..) Frontend. How do I properly secure this app? I ...
1
vote
0answers
65 views

Strange account activity - how to investigate

Today I have observed very strange scenario which appears to be attempts to hack an account. So first, let me tell the pre-story: I have started to receive 2-factor authentication SMS messages from ...
0
votes
1answer
80 views

Server to server authentication

I need to perform sensitive REST API calls between 2 server applications that I am writing. To do this I need to be able authenticate the server that is performing the sensitive API calls. The current ...
0
votes
0answers
78 views

SSH certificates and mutual authentication

SSH certificates are a recent addition to the protocol, and I see them as being used mostly for the clients. Can the server use an SSH certificate too? And if so, is it possible to have mutual SSH ...
0
votes
0answers
59 views

What is the need of HMAC in Diffie-Hellman? [duplicate]

When Alice and Bob both have the same shared secret to encrypt their data (Diffie-Hellman) and Alice encrypts her data with this key and Bob can decrypt it with the same key, then Bob knows that the ...
0
votes
0answers
35 views

Authenticate Windows/Linux process against hardware security module

I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
2
votes
2answers
238 views

Magic links: JWT vs random string

Tutorials I've come across about implementing magic link authentication (in Node) recommend a mechanism like this: the user hits your endpoint with their email address you generate a signed JWT from ...
14
votes
7answers
3k views

Timing attacks in password hash comparisons

I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
0
votes
1answer
58 views

OAuth 2.0: what's stopping a client from lying to the Resource owner about scopes

I'm seeing token scopes as more of a contract between what a third-party application can do on behalf of some user's consent. Therefore, let's say a client asks a Resource owner to authenticate and ...
0
votes
2answers
87 views

Protecting OTP based authentication

Let's say I have a website which uses 4 digit OTP based authentication for login i.e. users will enter their mobile number, receive OTP on the entered mobile number, enter the received OTP to login ...
0
votes
0answers
74 views

2 person 2-factor authentication?

I'm trying to build a system as follows: User 1 is a low permission user. They will be using their phone and at some point will need to do a secure action. User 2 is an admin user and will be in the ...
0
votes
0answers
14 views

Is password less login secure? [duplicate]

Recently I came across this password less login. For authentication, we need to enter an email address and click on a login button. We will receive a link in your email and when we click on that link ...
0
votes
0answers
35 views

Providing shared access to a single machine without a shared account

In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
3
votes
0answers
114 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
27
votes
9answers
7k views

How does “Somewhere you are” authentication add further security?

In addition to the authentication techniques that are based on “something you have”, “something you know” and “something you are”, authentication techniques that consider “somewhere you are” are also ...
0
votes
1answer
51 views

Is it safe to add “Access-Control-Allow-Origin:*” to an API endpoint with custom authentication via header?

Lets say I have a site at myapp.com that talks to the api at myapi.com. For that to work I have to turn on CORS. I want to do it like that: Access-Control-Allow-Origin: * and my API authentication is ...
0
votes
0answers
59 views

LMv2 in NTLM authentication

I have done some research about NTLM and his challenge responses, and I have one last thing left unresolved. The LMv2 response, which is the newer version on of the old Lan Manager response, is ...
1
vote
0answers
97 views

SECURITY VIOLATION: Root login attempted - Which password is affected?

Logwatch shows that proftpd was tried to be logged into using root 0.0.0.0 (111.254.68.221[111.254.68.221]) - SECURITY VIOLATION: Root login attempted I found: Normally, proftpd does not allow root ...
0
votes
0answers
46 views

Secure Authentication of Technical User to a Network-Appliance-HSM

Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
0
votes
1answer
70 views

Why does the server generate a random challenge for SSH authentication?

Wouldn't it be more efficient if the client initiated the connection by generating their own message, and encrypting it using their private key, then sending both messages to the server so it would ...
1
vote
1answer
507 views

Authentication in Next.js application (SSR SPA with long sessions)

We’re currently developing a Next.js application (server side rendering) and are looking for secure ways to keep the users logged in for longer periods of time. AFAIK this can either be done using ...
2
votes
1answer
114 views

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection?

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? Can they agree on a cipher suite? Why?
1
vote
2answers
162 views

2FA authentication with QR code

Can someone confirm if the following solution is actually 2FA? User has to install a special mobile app. When the mobile app is opened for the first time, the user is asked to associate the device ...
0
votes
1answer
83 views

B2B authentication best practices

I'm in the process of developing a B2B (business-to-business) application. I've implemented JWT auth, and it is working as expected. Right now the authentication functions as if it were a B2C (...
0
votes
0answers
31 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
0
votes
0answers
32 views

Handling parallel login and Max invalid attempts using OTP with same phone number

I am designing a login system that performs login operation using OTP and Email ID of the registered user. The current approach is as below User enters the Registered Email Id If the Email ID is ...
0
votes
2answers
281 views

Why hasn't push notification authentication replaced SMS for 2FA?

So we use DUO for 2FA at work and it uses push notification authentication as the second factor for 2FA. It's so quick and easy! I enter my username and password, get a push notification on my phone, ...
1
vote
1answer
165 views

Can I use an ID token as proof of authentication?

I have a reverse proxy, configured as the Relying Party of an OpenID Connect identity provider. Then, it delegates the request processing to another web server, exposed on the internet. In order to ...
0
votes
1answer
82 views

For failed logins, what information should be given to users?

When a user fails to successfully login, what information should be given back to them? Normally, we post back "Account not found" or "Incorrect password" or "Incorrect ...
0
votes
0answers
492 views

(Re)Hacked Instagram accout even if Two Factor authentication was enabled

A friend of mine, let's call her Alice, had an Instagram account that was hacked. She uses an iPhone. The scenario looks like this: Alice gets a link from a Business Account via WhatsApp, and clicks ...
0
votes
2answers
89 views

Is it unsafe to have some users with passwords and some without?

I'm working on an app where some accounts use passwordless authentication by email (using magic links) and some require a password to login. Is it okay to represent this rule in the account table by ...
0
votes
0answers
59 views

Can a secure key-exchange algorithm replace hashing for password authentication?

Over the weekend I was thinking about the problem of scaling various web services. One common practice to scale authorization is to use cryptographically signed tokens. This way when a request comes ...
0
votes
1answer
69 views

API open endpoint best practices

I am currently developing an API for my front-end React application. All my routes (besides the two I'll mention below) are secure by the use of JWTs. They get generated once a user logs in and is ...
1
vote
3answers
143 views

What to include in emails to make them acceptable to email servers?

I need to send some automated emails from a program I'm working on. This is a new feature. I'm generating the emails, but they get filtered by most of the email servers that I send tests to. Only one ...
0
votes
0answers
34 views

Potential risk of allow login sites to be accessible through webview

I know that allowing site (especially login site) to be accessible by iframe is a bad practice. But I plan to use webView to "outsource" the login process in a mobile app to a website (owned ...
2
votes
1answer
116 views

Pros/Cons for showing a user how many failed login attempts they have remaining before getting blocked?

For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this? Something like:
0
votes
0answers
99 views

Is it safe to use HMAC to create an API key?

I am planning to create an API key using the user's password as message and a random number assigned to that user in my database as key (or vice-versa). I will then store the hash of that API key in ...
0
votes
1answer
52 views

Is it good idea to re-authenticate a user to access sensitive actions and data?

In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
3
votes
2answers
202 views

Is it safe to store data of small company in MySQL database on webhost?

A small company has a big list of customers. The list contains personal information like names, phone numbers, addresses, info (like what products bought) and some small notes. The data is stored at ...

1 2
3
4 5
82