Skip to main content

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
3 votes
1 answer
287 views

Oauth: redirect uri validation [duplicate]

As per the below resource: https://www.oauth.com/oauth2-servers/redirect-uris/redirect-uri-validation/ we should validate the redirect url at 3 points: at time of app registration when the auth flow ...
gaurav5430's user avatar
0 votes
0 answers
1k views

Is using the CSN of a mifare desfire EV2 safe?

From what I know, Mifare Classic cards are easy to copy/clone using a device such as a flipperzero, and it has to do with authentication using the CSN (card serial number) However, let's say that a ...
Ismail's user avatar
  • 1
1 vote
0 answers
108 views

Storing auth token in html

Current projects webs application utilises a cookie based approach to store users auth token. Implemented with secure and http-only attributes set. All traffic over https. The application loads third ...
Sam's user avatar
  • 11
3 votes
1 answer
4k views

Is it safe to send an API key in an HTTPS request? [duplicate]

Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ? We need to send data to a 3rd party from ...
Pure.Krome's user avatar
2 votes
2 answers
831 views

Oauth: native UI for internal / first party apps

We have an oauth implementation, which was chosen because of the following reasons: session sharing across different applications easy to reason about the security considerations as oauth is well ...
gaurav5430's user avatar
0 votes
1 answer
133 views

How WhatsApp knows that account is logged in on 1 device

Recently I was switching devices and my WhatsApp got logged out from 1st device when I logged in to 2nd device. And I got this question on my mind How WhatsApp knows that account is logged in on 1 ...
Xyz's user avatar
  • 1
0 votes
0 answers
131 views

Providing encryption and password for an IOT device over gRPC

I've been breaking my head over how to do this, as it doesn't seem to fit any example I could find online. My IOT device servers will run on the client network and may be accessed over it or over the ...
FlashDD's user avatar
  • 101
0 votes
0 answers
62 views

Need of Transaction SIGnature (TSIG) record

Can't we simply send the shared secret key along with AXFR query? A hacker can easily use sniffed TSIG record to authenticate himself. Then how it's called SECURED zone transfer?
Aryan's user avatar
  • 11
3 votes
3 answers
2k views

Can a security system detect there are multiple copies of a single-issued fob?

My building gave me a single fob. I made 3 copies of it for my family and they all opened the building entrance but not my actual apartment door, until one day the building told me they had noticed I ...
Jonathan Beltran's user avatar
2 votes
1 answer
195 views

When signing with server public key, how do I prove server key is trustworthy?

I have a server-side app in a Docker container that communicates with my desktop client app. I am struggling with how to ensure that the response from the server is trustworthy. I am fairly new to ...
MatkatMusic's user avatar
1 vote
1 answer
157 views

Automatic Certificate Signing Request (CSR) Validation

I was wondering if there are papers or well-known algorithms to automate the validation of a Certificate Signing Request (CSR). Suppose I have a group of trusted services where I expose a "CA ...
Fidelio's user avatar
  • 13
1 vote
1 answer
864 views

Authentication using JWT signature, without header and payload

I am evaluating JWT as authentication mechanism for an API. The idea is to use JWT as API key. One thing I want to implement is revoking API keys. Since revoking involves a state change in my backend, ...
Nopx's user avatar
  • 113
0 votes
2 answers
938 views

How does a single mobile banking app implement a two factor authentication? [duplicate]

Recently I had more or less the same discussion with the helpdesk of several banks; a bank has a new mobile app that allows logging in without sending an SMS and without asking a confirmation code by ...
userFromEU2's user avatar
1 vote
0 answers
229 views

How to achieve an authentication method FIPS 140-3?

I've been studying the FIPS 140-3 but I still have questions about how to determine if an authentication protocol is FIPS compliant or not: 1- Is RADIUS over EAP-TLS FIPS 140 compliant? I know that ...
r4mpz0's user avatar
  • 11
3 votes
1 answer
287 views

How to design a desktop application that has access to a database via LAN?

As part of a project for school I've been tasked with designing a secure application that should be able to upload and download files from a database. I have very little experience in the area of ...
SERO9's user avatar
  • 31
2 votes
1 answer
235 views

Determine if the client certificate comes from a smarcard in mTLS [closed]

I am designing a web access gateway that authenticates users through certificates using the mTLS mechanism. I would like to be able to identify the users that access the system using a Smartcard and ...
Luna's user avatar
  • 31
2 votes
2 answers
1k views

Mutual TLS replacement

When last time I was thinking about mTLS, I came to a conclusion that this is too hard to implement but at the same time it provides high security. The reason why it's hard to implement is that it's ...
Szyszka947's user avatar
2 votes
0 answers
56 views

What datums are required for an Oauth 1.0 replay attack?

I am working with some software where the vendor creates log files on exception. The files include a number of Oauth fields, and the vendor claims this is not a security risk. The Oauth fields ...
DatsunBing's user avatar
1 vote
1 answer
422 views

How can I share web-platform credentials across multiple desktop apps on Windows?

I have two desktop apps, each authenticate against our server using OIDC in order to call our web api. Currently the users need to login independently in each application. I noticed when using ...
Oren Yosifon's user avatar
2 votes
1 answer
2k views

How to interpret a Google "Someone is trying to sign in to your account from another device" message?

I received this message on my Pixel 4a phone yesterday evening: I pressed "No, it's not me" and then saw this message: I was at home with a cat and five-year-old son. I was cooking and my ...
cja's user avatar
  • 1,639
0 votes
1 answer
670 views

OAuth2: Is PKCE required if the callback is located in the backend?

This is the architecture I want to follow Source: https://stackoverflow.com/questions/73075156/what-exactly-is-redirect-uri-in-google-oauth2-request-for-getting-authorization I'm using a backend to ...
MrRobot9's user avatar
  • 103
0 votes
0 answers
120 views

Auto-login to account with PII using a random URL

I have a booking system where passengers need to add information that is quite sensitive (passport details etc). When they book, I generate a (difficult to crack) reference number, which they use to ...
Sprep's user avatar
  • 101
1 vote
2 answers
194 views

How can Alice ping and authenticate Bob without any of them sharing their public keyes beforehand

Both hosts have just their public and private key pair (but they do not have the other party’s public key). Bob should be authenticated Assume that the two hosts share clocks that are synced, i.e ...
user avatar
0 votes
0 answers
65 views

Authenticate requests from landingpage to API passing through proxy

Imagine the scenario where you have a client who wants you to implement calls to an external API on a landingpage that you've setup for them. The external API works based on a contract and API keys ...
DevelJoe's user avatar
  • 141
0 votes
0 answers
553 views

Oauth: Authorizing multiple clients at once

I have an application where the frontend app talks to 2 set of API servers: be1.domain.com and be2.domain.com both these servers are independent entities (they do share the same top level domain, in ...
gaurav5430's user avatar
2 votes
2 answers
307 views

What is the point of the sign-in timeout of Microsoft services?

The sign-in process of Microsoft services has a timeout whereby if you wait too long to input a password, the sign-in dialog expires and you need to refresh the dialog. For example, this is what ...
Kal's user avatar
  • 287
2 votes
0 answers
130 views

What would be the most complete procedure to get a simple login system working securely?

I don't have formal CS education but i've written one or 2 little websites. I have troubles communicating even in my native language but i hope this is understandable. With simple i mean something ...
Silly_Code_Valley's user avatar
1 vote
0 answers
83 views

Does Firefox's addon/extension installer provide cryptographic authentication and integrity validation?

Does Firefox's built-in installer for addons/extensions validate its payload's authentication and integrity for all files it downloads before actually installing them? I avoid in-app updates because, ...
Michael Altfield's user avatar
1 vote
4 answers
778 views

Is this a safe system to authenticate users by phone number?

I'm making a Actix-web/Rust web-application where users are solely allowed to register and login with their mobile phone number. The login-screen consists of one input asking for the phone number. If ...
O'Niel's user avatar
  • 2,914
1 vote
2 answers
420 views

Using one server and user database for multiple websites

Goal I'd like to have multiple independent websites with one shared authentication server. The auth server will have one database in which all users are stored (just username, email and password, so ...
Mike V.'s user avatar
  • 11
1 vote
4 answers
208 views

Account recovery for mobile games?

Mobile games typically have lots of users that take multi-month (or year) breaks and come back much later when they've heard about an update to the game or have a nostalgic urge to come back. ...
eof's user avatar
  • 111
-1 votes
3 answers
104 views

Does the SE login page need hardening against third party javascript?

Closely related to the Meta question Can Google and Cloudflare find my SE password? In short the SE login page loads javascript from Google and Cloudfare. I believe the javascript has full access to ...
joro's user avatar
  • 115
1 vote
0 answers
163 views

Creating session based on Google sign in

Does it make sense to implement your own session management on top of the Google sign in? Scenario: I have a web app where I allow users to sign in with Google. I just need this sign in to verify the ...
gaurav5430's user avatar
0 votes
1 answer
121 views

Authenticate people online with simple public / private key scheme or similar

how can I ensure that person X on website A is the same person who contacts me? Here is my use case. On website A I post message asking username X to contact me. Someone send me an email - how do I ...
Lofter's user avatar
  • 1
1 vote
1 answer
1k views

For cookie containing access_token, setting secure = false, is that bad practice? Even if signed with jwt?

I'm using a server side rendering JS framework where the user signs into auth0, the client server then receives the access_token, uses jwt to sign it with our private key, and sends it to the client ...
iamadev's user avatar
  • 11
1 vote
0 answers
128 views

WAF checking username/password before passing to app [closed]

I want to protect a web app behind some other application. This application should only let users through after they authenticated. While this is a common use case for Web Application Firewalls it ...
Alex's user avatar
  • 119
2 votes
2 answers
663 views

OAuth2 public clients cant use client secret and still achieve a secure workflow, why is it used for confidential clients?

In an OAuth2 authorization flow, if I understand correctly the request made to receive a token with PCKE is almost identical between that of a public client and that of a confidential client. The only ...
Jeremy F's user avatar
  • 121
1 vote
0 answers
78 views

Authentication using an intermediate web app as an openid client

There are 3 different web apps: X: A resource provider that provides details about a user (implements authorization part of openid protocol). Y: Web service (implements openid client) that gets the ...
tomas's user avatar
  • 11
1 vote
2 answers
199 views

Using oauth for authentication

I understand that oauth is an Authorization protocol, but it is possible to use it for authentication when clubbed with something like open ID Connect. I am trying to understand why do we need an ...
gaurav5430's user avatar
1 vote
0 answers
2k views

Why "application/x-www-form-urlencoded" is normally used for login but not for registration?

I may be wrong, but for security reasons, in REST APIs the login credentials are always sent with the content type application/x-www-form-urlencoded. But I haven't seen the same with user registration;...
something's user avatar
1 vote
1 answer
453 views

When hardening my SSH key, why would I use yubikey-agent instead of the built-in `-sk` key type native to OpenSSH?

OpenSSH 8.2 added -sk key types that allow for FIDO/U2F hardware authenticators (like a YubiKey, etc.) yubikey-agent allows for the same functionality, except it (a) requires an additional client on ...
angryserver's user avatar
3 votes
3 answers
817 views

Is it OK to use client TLS certificate for site login instead of username/password?

Is it OK to just use a client's TLS certificate as a way of logging in to a website? What are the drawbacks? Is there any real system doing it? Normally, there is mutual client/server TLS ...
user3108468's user avatar
2 votes
2 answers
645 views

Why PAKE or Zero-knowledge password proof didn't replace sending a password via HTTPS

Technologies like Zero-knowledge password proof and PAKE seems to be pretty mature but almost all modern web-sites still send passwords over HTTPS to check authentication. At first glance, this ...
Ghost Rider's user avatar
1 vote
0 answers
249 views

Is "pam_ssh_agent_auth" more secure than passwords for sudo on a remote server?

I read about "pam_ssh_agent_auth" in combination with sudo, which can use a ssh agent to authenticate instead of using the users password: https://manpages.ubuntu.com/manpages/jammy/en/man8/...
student_at_work's user avatar
1 vote
1 answer
308 views

Preventing Signup API abuse from botnet

I am working on an e-commerce website, wherein make use of mobile OTP authentication for new signups. We have a fair bit of protection against bots and malicious actors by using aggressive rate ...
Abhinav's user avatar
  • 169
1 vote
1 answer
90 views

Mobile applications and user data security

My question is in regards to user data stored within mobile applications, after dealing with security issues of hacked firmware and manipulated apps. Is there a system that prevents modification to ...
Mandy Pease Newberry's user avatar
1 vote
3 answers
179 views

Why don't applications suggest passwords themselves?

Imagine a web app that, on the login page, has a password field which does not allow user input, but just displays a client-only generated password that is reasonably strong, with a button to re-...
prmph's user avatar
  • 227
0 votes
1 answer
233 views

How does the user stay authenticated after digest authentication?

Simply put, the digest authentication goes as follows: The user tries to access some resource that requires authentication. The server responds with 401 and the www-authenticate header. The client ...
GalSuchetzky's user avatar
1 vote
1 answer
2k views

What is cnonce in Digest Authentication

In digest authentication we use something that is called cnonce. According to RFC7616: This parameter MUST be used by all implementations. The cnonce value is an opaque quoted ASCII-only string value ...
GalSuchetzky's user avatar
0 votes
0 answers
167 views

SRP authentication in an Android app over REST

I'm currently trying to come up with an authentication process for an Android app, that talks with web backend using REST. At the moment the communication is secured by TLS (with cert pinning) and ...
barti90's user avatar

1 2 3
4
5
91