Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
30 views

Choosing oauth flow-type for on-prem installations

So according to the resources found here and in the official protocol documents I have a good grasp on what flow-types to use for what client-type. According to the following picture (credit: https://...
1
vote
0answers
75 views

How to implement a web login using a public/private key pair?

I am trying to create a web form, where the user can login without creating/entering a password. Assume the following pre-requisites are met: The user and server have pre-generated a public/private ...
2
votes
1answer
89 views

Why don't fingerprint authentication systems don't store 'hashes'? [duplicate]

Usual password authentication systems do not store passwords directly on the server, but only hashes of those passwords. Why do fingerprint authentication systems not offer this possibility?
1
vote
0answers
36 views

Authenticating Adobe .pdf electronic signatures

Having created a certificate for electronic signing within Adobe Acrobat DC, can I authenticate documents signed using it by issuing a signed paper statement to recipients stating that it would be ...
0
votes
1answer
39 views

Does a password-derived public key authentication improve security over pure password-based authentication?

Despite best efforts it is pretty clear that most users reuse their credentials, especially for what they consider non-critical sites such as forums. While TFA does mitigate the potential damage of ...
71
votes
8answers
11k views

What is the suggested best practice for changing a user's email address?

I recently jumped onto the hypetrain for an unnamed email service and am currently on my way to update all my accounts on various websites to get most of my (future) data off Google's Gmail. During ...
2
votes
1answer
41 views

How to design a single-request, non-CA-based custom server-to-server authentication method?

We have a series of services exposed as web servers. Potentially, every web app could contact and be contacted by any other one. I want to secure the communications between the applications, which ...
2
votes
1answer
112 views

Authenticate limited client devices from server without login process

I have limited client devices and one server. I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or ...
0
votes
0answers
34 views

NFC Ultralight C - design an authentication system (can it be clone protected?)

I am trying to design an authentication system that will be based on NFC Ultralight C cards. Key concept in my system is that the card identifies a specific person, but this concept can be easily ...
1
vote
1answer
52 views

Understanding TS 133 501 (5G) Step 2 of EAP-AKA'

I have a question dealing with the EAP-AKA' used in 5G to authenticate clients coming from a 3GPP-Network. I read the latest specification on ETSI. The problem which I have is based on Step 2 on Page ...
0
votes
0answers
19 views

How do I implement a token based authentication system in a mesh network?

In this i would like to build a token based system where the MAP(mesh access point) generates a token for verified client and that token can be used for seamless handoff when the client travels from ...
0
votes
2answers
104 views

How do I write my own authentication protocol and add that to OpenWrt? [closed]

I would like to add a ticket based authentication mechanism to my network. Can you give me brief idea where do I start, which language should i write the protocol in and how do i get those in my ...
-1
votes
1answer
75 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
3
votes
4answers
415 views

Passing plain text password over HTTPS

My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
1
vote
1answer
87 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
0
votes
2answers
106 views

Is it less secure to force periodic user logouts vs keep them logged in?

I've been unable to find any research or information on this. Google periodically signs me out and forces me to sign back in. I have multiple devices and multiple google accounts so it's a bit ...
1
vote
1answer
62 views

How exploitable is a none JWT?

A recent penetration test has discovered that my org is using the JWT authentication scheme that allows the 'none' algorithm. How exploitable is this in the real world? I understand that the issue can ...
1
vote
1answer
120 views

Is it OK to store the user's plain-text password in a claim?

For customer reasons, my web app authenticates the user against a proprietary user database using a simple API like bool authenticate(string username, string password) In case the user changes his ...
26
votes
2answers
9k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
2
votes
2answers
53 views

how to deal with with authentication tokens in the client browser and in my database?

I am building an asp .net mvc project and I want to save the user who is currently logged in , So I read about sessions and cookies and I found that authentication tokens stored in a cookies are a ...
2
votes
1answer
126 views

Understanding Secure Boot

I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around. At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
1
vote
0answers
98 views

Secured data upload to Aircraft over ARINC 615A

We have a requirement for Data loading function to Aircraft. There is Avionics standard termed as ARINC 615A and ARINC 665. 615A specifies high speed Ethernet based data load operation; where POINT-TO-...
1
vote
1answer
55 views

What are the logical steps taken to perform ssh key authentication?

I understand the logical steps of asymmetric key cryptography as it relates to TLS, however, I've started using Git and in a bid to avoid having to use a password for authentication, I've set up ssh ...
0
votes
1answer
65 views

MacOS able to access data without password

On a Mac, one can go into recovery mode by turning off the Mac and clicking Command R while turning it on. Then, by typing resetpassword into Terminal, one is able to reset the password without ...
3
votes
2answers
305 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
0
votes
0answers
38 views

Security concern on locally stored authentication token

It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device. This is to strike a balance ...
0
votes
1answer
81 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
1
vote
0answers
53 views

Automating SAML login for service users?

Is it possible to fully automate the login of a service user (i.e. a programmatic, software based "user") without user interaction? I have a service provider that's SAML protected. Basic Auth and ...
2
votes
0answers
570 views

How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?

My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
0
votes
2answers
224 views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
2
votes
1answer
35 views

Is an LDAP injection possible for a basic search query?

I'm trying to secure a login endpoint by attempting to bypass the login that uses LDAP. It employs a search query of "cn=" + username + ", dc=example, dc=com" with a filter of "(objectClass=*)". Is ...
9
votes
3answers
399 views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
1
vote
2answers
92 views

Replay Safe Mutual Authentication (libsodium)

I am working on an end-to-end encrypted messaging application as an educational activity with some of my extra time. I have chosen to use libsodium for the underlying crypto. I have run into a hang-up ...
0
votes
1answer
53 views

Why would a software need my IP address in authentication token?

I was looking at the authentication token used in my network requests to a software that we use at work. I noticed that this is not a general JWT OAuth token but some XML based token. I guess, old way ...
0
votes
1answer
48 views

Same session cookies for a user logging from different browser/machine

I am new to web application security and have a few doubts regarding session cookies. Which of these is considered more vulnerable: Having the same session cookies for a user logging in from ...
2
votes
1answer
87 views

Explaining a bad approach - not comparing hashes

Today I saw a snippet a code for authentication logic : function checkPass($pass, $login){ $inputedPass = $pass; $req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
1
vote
2answers
87 views

What is the benefit of public Certificate Authority when using SSL mutual authentication?

I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct. In terms of SSL Mutual Authentication a self signed CA and a public CA ...
0
votes
0answers
70 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
0
votes
1answer
105 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
9
votes
3answers
3k views

Client side password hashing with static salt - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
1
vote
2answers
121 views

Public-key-based website login

I'm looking to implement a public-key based login / authentication for a website. This will not be used for general users – it will be used by both automated scripts and for admin logins. Before ...
0
votes
1answer
112 views

How safe is my login system (conceptually)?

I implemented a 2FA authentication for a web app with PHP and Google Authenticator. In order to login to my system there are a few steps: User types in a complex master password in order to access ...
0
votes
2answers
59 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
1
vote
1answer
66 views

Is it ok to share relevant login information on an API's public endpoint?

I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens. Any request to the API needs an access token to the Authorization header. The API validates that ...
1
vote
2answers
1k views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
1
vote
0answers
82 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
0
votes
2answers
68 views

Generating QR-Code for 2fa from google maps api risky?

I am currently using 2-factor authentication to tighten security for my login system. I use Google Authenticator to scan a QR Code, which generates a key which I can use to login. What worries me ...
1
vote
3answers
149 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
1
vote
2answers
70 views

What are Security Considerations of Using File Upload/Comparison as Simplified Second Factor?

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...
0
votes
0answers
36 views

Securing my own routes with “Login with X” and OAuth2

I have a single page application which communicates with a REST backend. I want to require a user to login before being allowed to access certain routes. I want to offload user authentication to ...

1 2 3
4
5
81