Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
2 votes
3 answers
376 views

To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?

I am trying to achieve better security in my authentication system implementation with both server-side hashing and client-side hashing. (See the first reference below for more prerequisite knowledge.)...
user avatar
  • 131
0 votes
0 answers
331 views

Security: Plaid vs Quicken vs Mint

Why are people so quick to criticize Plaid for using login info when trusted apps like Mint do the same thing? They require username and password for bank info, but seem to be trusted. I wanted to use ...
user avatar
0 votes
2 answers
165 views

How/What to prompt user for fingerprint login using smartcard?

We are using a PIV smartcard that has biometric information (fingerprint) of the user encoded on the card to login into our application. We have the capability to read the fingerprint from a reader ...
user avatar
0 votes
4 answers
236 views

Forget Me Not? Abandoning the Forgot Password Functionality

They say a chain is only as secure as its weakest link. When it comes to account security it seems to me that the Forgot My Password functionality is the weakest link in the security chain because it ...
user avatar
1 vote
1 answer
152 views

Security requirements for public API keys

I need to provide security requirements for public API keys that will be generated by a web application and then used in automation scripts by clients. The scripts will be run on the endpoints several ...
user avatar
  • 11
0 votes
2 answers
273 views

Are there still ways that OTP is safer than FIDO?

From my reading I understand that USB keys (for example Yubikeys) are more secure than OTP authentication apps (such as Google Authenticator). The primary reason is that FIDO is done without human ...
user avatar
1 vote
1 answer
180 views

Your username can only be changed once?

I've seen quite a few security centric sites enforce this policy: Your username can only be changed once My question is: Is this done from a security standpoint? If yes, what is the logic behind it? ...
user avatar
0 votes
0 answers
73 views

Strategies for segregating anonymous and secure access to APIs

Traditionally, we used either path-based access control or a separate DNS for public and private content segregation. In the modern era of standard-based auth, what are the best auth strategies for ...
user avatar
0 votes
0 answers
80 views

Docker: How to download & verify a publisher's root key (out-of-band, distinct-domain cryptographic verification, WoT)

For a given publisher of docker images on Docker Hub (let's say debian), how do I download their root release/image signing key and verify its authenticity from multiple sources out-of-band from each-...
user avatar
1 vote
2 answers
212 views

Are 6 digit number verifications secure?

I've noticed that many services and/or platforms now send 6 digit codes to verify user actions. Typically sent to an email. With these being 6 digits long & assuming that you get at least 3 tries ...
user avatar
35 votes
8 answers
13k views

Why don't some services offer Google/Facebook/Apple/Twitter login

Why don't some services offer Google/Facebook/Apple/Twitter login? Namely Crypto exchanges. I assume they want as many users as possible & this is a great way to get more. Is there some sort of ...
user avatar
0 votes
1 answer
304 views

Secure ajax login form

When the client is logging in, I send an xhr request to the server. However the request looks like this: localhost:80/api/login-ajax/&username=johndoe&password=123456 This is insecure for ...
user avatar
0 votes
1 answer
93 views

Lab Environment Authentication Best Practice

Looking for best practice advice regarding lab environment authentication. We have a lab to evaluate and perform regression testing of third-party applications and hardware. No proprietary information ...
user avatar
1 vote
0 answers
104 views

What prevents attackers from posing as legitimate smb server?

Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens: The computer is booted up in another network ...
user avatar
  • 11
2 votes
0 answers
98 views

IoT Device Authentication

I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/ I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
user avatar
1 vote
2 answers
132 views

What are the benefits of using different certificates to identify the same service to different audiences?

Recently I was having a discussion with a team which uses a separate certificate for each different backend service that it interacts with. The backend services do client auth as well so that is what ...
user avatar
  • 3,181
0 votes
0 answers
153 views

How does Nessus offline registration work?

To use the free trial of Nessus, you need an email address to receive an activation key. There are two modes to activate a Nessus server: Online mode registration If the computer running Nessus ...
user avatar
  • 173
0 votes
0 answers
172 views

Why my yubikey is not protected by a PIN to log into Google?

I just setted my yubikey on Google so I can login into Google without any passwords. However, I don't even have to put a PIN on the yubikey, it simply works. I find this very very dangerous as anyone ...
user avatar
0 votes
0 answers
80 views

How Does it Work - User Authentication using Yubico Smart Card (Yubico PIV) on Mac

Background: I have setup my macOS Catalina so that I can authenticate my user account using my Yubico (set up as a Smart Card) and its PIN After setting this up I can see that there are now 2 ...
user avatar
4 votes
1 answer
241 views

How does Firefox protect Logins and Credit Card Data?

I have a question about how Firefox protects Login information (Website passwords) on the one hand and Credit Card data on the other. I noticed that there are two different approaches to how Login ...
user avatar
  • 153
0 votes
0 answers
99 views

Is a Keycloak User ID sensitive?

I am using Keycloak for OpenID Connect single sign on. I can see that the various users each have an ID in Keycloak, with the format similar to this example: a12346fb-bd93-fedc-abcd-0739865540cb. Is ...
user avatar
0 votes
0 answers
62 views

Authenticating Infrastructure SOAP-based API

I have been involved in a discussion the other day regarding the implementation of backend-to-backend authentication. The communications between each backend happen via SOAP (XML) message protocol. ...
user avatar
  • 1
1 vote
1 answer
562 views

OpenSSH AuthorizedPrincipalsFile Allows Any User

I am bewildered as to the below config and subsequent behaviour. /etc/ssh/sshd_config: AuthorizedPrincipalsFile /etc/ssh/principals /etc/ssh/principals: all host.example.com dev This allows me to ...
user avatar
0 votes
0 answers
96 views

Confirm User Account Without Exposing IP of Server?

Right now, when a user signs up for a new account on my site, the server sends the user a email verification link. When the user clicks the verification link, the link redirects to my server to ...
user avatar
7 votes
3 answers
242 views

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches?

Does there exist any hashing algorithms suitable for comparing data that is similar but not exact matches? For example one where similar input data generates a similar hash, with the difference in the ...
user avatar
  • 443
0 votes
1 answer
107 views

Which OAuth2 flow should I use?

Context I'm trying to build an hybrid multi-tenant API using OAuth2.0 using Laravel 8 Passport, so my system has 2 parts: one process the request from the tenant application, and the other part ...
user avatar
  • 143
21 votes
4 answers
4k views

How will biometrics be a safe way to authenticate users across the internet?

Let's say Alice created a new account on a service and this service saved her fingerprint as a way of logging in later. Then Alice creates a new account on a new service, but unfortunately this second ...
user avatar
0 votes
0 answers
72 views

Does dnf enforce cryptographic authentication and integrity validation by default for all packages? (fedora linux)

Does the built-in dnf package manager in Fedora-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
user avatar
0 votes
1 answer
100 views

Does pacman enforce cryptographic authentication and integrity validation by default for all packages? (arch linux)

Does the built-in pacman package manager in Arch-based systems require successful cryptographic authentication and integrity validation for all packages? I know that software downloaded with apt-get ...
user avatar
0 votes
0 answers
100 views

Is the handshake_traffic_secret of tls1.3 a symmetric key? If so, why need a master secret?

I guess it may be due to man-in-the-middle attack, but are there any other problems? So how does the master secret avoid these problems?
user avatar
  • 101
0 votes
1 answer
135 views

Should I save my 2FA setup keys instead of recovery keys?

In case we lose access to our 2 Factor Authenticator, we can use our one time recovery codes to regain access to our accounts But what if we store the setup key itself instead of the recovery codes? ...
user avatar
  • 1
0 votes
1 answer
125 views

Why can't tls1.2 server use certificate's private key to encrypt 'server finish', and send if after 'server hello'?

If don't consider 'change cipher spec' and performance. So client can send data immediately after 'client finish'. The handshake process may look like this: client hello -> server hello <- ...
user avatar
  • 101
0 votes
0 answers
28 views

Is verification code a scam? [duplicate]

When facebook sends the confirmation code, the name FACEBOOK is not displayed as the sender,, instead phone numbers of different countries. Until now, it was only on my notebook, but today I synced my ...
user avatar
1 vote
2 answers
153 views

Is it normal/safe/justifiable that a bank asks me for my full login details (account id and PIN) when calling via mobile phone?

I am calling my bank via mobile phone (in Germany) and the electronic voice asks me to type in my account access id (via the number pad), and like-wise, type in my account PIN, all the numbers, not ...
user avatar
  • 111
0 votes
0 answers
87 views

How to restrict pages on React.js using JWT?

I'm using React.js (with react-router for serving content) for frontend with a golang backend. For the authentication I'm using JWT. But I've now stumbled upon a problem. How do I keep users from ...
user avatar
  • 35
1 vote
2 answers
215 views

Does mutual TLS really authenticate two servers?

Suppose I have 2 Servers (Server A and Server B) that need to communicate with each other and not with anybody else. Can I use Mutual TLS (mTLS) to achieve this? Is mtls a good approach or will I have ...
user avatar
12 votes
3 answers
4k views

If we fixed SIM jacking would SMS then become a valid way to send an MFA token to?

And if not would like specific reasons why. I have this suspicion that, although an inferior method these days to MFA applications, believe that the security is adequate enough as most phone companies ...
user avatar
0 votes
0 answers
93 views

asymmetric file system authentication

Here is how integritysetup from the cryptsetup package in Linux works. A user provides an authentication key to the OS when reading or writing data to a file system. When reading, the OS only returns ...
user avatar
  • 139
0 votes
2 answers
635 views

Is there a downside to sending a refresh token on every request to an API?

Let's say that my user signs in and the server responds with a refresh token saved in a cookie (SameSite strict, HttpOnly, CSRF token too) and with the access token in response (saved in JS memory). I ...
user avatar
12 votes
2 answers
2k views

Any plans/research for SSL-like method in telephony?

I have recently read about attacks using Caller ID spoofing technology. Criminals used it to impersonate bank or police employees and asked to install malware or transfer money to a given account. A ...
user avatar
  • 233
0 votes
1 answer
243 views

Security of email OTP authentication

I'm building my own authentication and deciding on the signup/login flow. I'm would like some security feedback on this type of flow: User submits email address. 6 character alphanumeric one-time-...
user avatar
0 votes
0 answers
83 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
user avatar
-1 votes
1 answer
154 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
user avatar
2 votes
1 answer
153 views

"Trusting" the Host header in a port-forwarding environment

A similar question has be answered here already, but I have a very specific scenario in which it didn't fulfil my requirements. I am setting up an environment which includes a web-service running on ...
user avatar
  • 306
0 votes
1 answer
448 views

I have been hacked on Facebook multiple times today alone. What do I do?

My Facebook account has had its password changed four times today, and I'm wondering what to do. The first time, was at 5:02pm. I received an email saying that my password had been changed. I recently ...
user avatar
1 vote
1 answer
138 views

How exactly does the detection of a cloned FIDO2 credential work?

I am trying to understand the FIDO2 standard. I know that a Relying Party has to implement a mechanism that checks the counter of the respective credentials. Most of the time, a counter is stored in ...
user avatar
  • 13
0 votes
0 answers
73 views

How can I secure an API used for app secret keys without using CORS, created using AWS API gateway?

I am using an API , made using an AWS service named API Gateway [Which may not be of great importance]. I have gone through various articles mentioning that rather than storing secret keys directly on ...
user avatar
0 votes
1 answer
106 views

Security for website admin panel [closed]

I am creating an admin panel for my website. I am coding the entire website by myself. What are some essential security features that I should implement so that only I can access the admin panel and ...
user avatar
  • 101
1 vote
0 answers
83 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
user avatar
  • 111
0 votes
0 answers
74 views

Setting secret at factory to be used in Bluetooth pairing authentication

Setup: We have 2 kinds of Bluetooth devices. Device Type A is connected to power with ethernet capability and will be used as initiator for BT connections. Device Type B is mobile, battery powered (...
user avatar
  • 101

1 2 3
4
5
87