Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
66 views

Sudden excessive recent pop up of Apple ID password & profile on iPhone? Any widely known security Concerns?

Sudden excessive recent pop up of Apple ID password & profile on iPhone? Any widely known security Concerns? I've not had any such pop ups for long time, ever. It's usually not out of the ...
3
votes
1answer
301 views

verification of certificate chain using openssl verify command

When attempting to verify google server's certificate chain using openssl, I am getting error. Extract google's server and intermediate certificates: $ echo | openssl s_client -showcerts -connect ...
19
votes
7answers
6k views

Is PGP for user authentication a good idea?

I am building a web site that provides user login. For that, I am currently researching good strategies for dealing with authentication. How I'm doing it right now My current concept is modeled ...
1
vote
0answers
59 views

Circumventing authentication by relative path in flask

I'm working on a flask application which requires some authentication but not on every endpoint. I use this piece of code to exclude certain endpoints from my authentication handler. if request.path ...
65
votes
5answers
15k views

My email address is being used to enroll for online services. Should I be concerned?

Just before Christmas I received the following message in one of my GMail accounts: Sign-in attempt was blocked ********@gmail.com [redacted by me] Someone just used your password to try to ...
0
votes
0answers
80 views

Why server side hashing is required if the client side hashing is already in place?

I am looking for best practice for username/password login. People have different views for client side hashing on password. From Google's recommendation https://cloud.google.com/solutions/modern-...
0
votes
1answer
70 views

What are the tradeoffs between a common login site and login-per-site?

If you have multiple products/sites under a common domain, what are the advantages and disadvantages, from user convenience to security, of having a common login page? For example, this site uses ...
0
votes
1answer
61 views

Is there a security problem with having two factor auth running on the same machine that's requesting access?

Searched around and couldn't find a similar question. I've gotten tired of waiting for an 2FA SMS to come every time I check my email. So I got to setting up an app similar to say Google ...
3
votes
0answers
69 views

Can Chrome Extensions steal OAuth tokens from redirect-uri? [duplicate]

This is a duplicate of a stack overflow question, since it might apply more to security and authentication best practices. I'm working on auth between a Chrome Extension, Google Cloud Platform, and ...
2
votes
1answer
165 views

Possible public/private identity recovery after compromise without a centeral authority?

I’ve been thinking about P2P systems using asymmetric keys and wondering if there is anyway to recover an identity in the event it was compromised using some kind of web-of-trust. This seems to be a ...
1
vote
1answer
49 views

What is a login flow method to prevent account jacking when your website has Email/Password sign in AND Google Sign in?

For example, my website has Email/Password login and the "sign in with Google" button. If a user creates an account with their email and a password, then decides to sign in using the "sign in with ...
0
votes
0answers
95 views

What is delegation, identity delegation, and delegated authorization, and what are the differences among them?

I've been writing up a guide to OAuth 2.0, OpenID Connect, and Identity Server 4 mostly for my own learning, drawing on several sources such as OAuth2 In Action, OAuth 2.0 Simplified, and CISSP: A ...
3
votes
2answers
592 views

How to store API keys when algo trading?

I write Python scripts for clients to "algo trade" at currency/stock exchange websites. My clients are typically running my scripts on traditional personal desktop PC's. Usually using these PCs for ...
2
votes
1answer
259 views

OAuth2 for first party web-app

I am building a web (also potentially mobile app) for a platform that allows plugins. We're using the OAuth2 Authorization Code grant type for third-party client plugins. Which, if any, grant type ...
1
vote
0answers
56 views

Is a VPN + Firewall + Authorization Redundant?

I am creating a simple application so a distributed team can access sensitive data. This application will have a database that will be inaccessible to the public internet inside a VPC with my cloud ...
4
votes
3answers
96 views

implementing an authentication mechanism for understanding the basics of client authetication

I'm trying to implement a simple protocol to authenticate users and authorize them to access a certain web page/resource via a login form. Please note that this is just something to use on my own and ...
0
votes
0answers
44 views

Endpoint authorization using Vault

I have a bunch of micro-services set up which interact with each other. I want to set up authentication and authorization within these services so if a user has access to only one service, then it can ...
3
votes
1answer
51 views

Push notification - can I use any mobile auth application?

When generating a OTP, I know I can use either Authy or Google Auth, either can scan the code & generate the same OTP. What about push notification? Are Duo/Okta verify and other apps ...
0
votes
1answer
60 views

Proving authenticity of data accessed over TLS by an untrusted third party

Is there any way an untrusted third party who has access to content from a website over HTTPS can prove the authenticity of the data (i.e. that it was distributed by a server in possession of a ...
2
votes
0answers
104 views

Admin able to set new plaintext user password - security problem?

I am working on this application that can be deployed and run by anyone on their server. Most often, it is run as a web service. In our new version, we removed the possibility for admins to set and ...
-2
votes
1answer
81 views

Prevent unauthorized download of files from a webserver [closed]

So i have a webserver and i would like to have users login and then be able to download an exe file directly from the webserver the issues with this is that users can easily download the file directly ...
1
vote
1answer
498 views

How to invalidate JWT tokens without a database lookup with each request to the server?

JWT Bearer token and stateless REST API question I am implementing a stateless REST API. I am used to using sessions built into frameworks or 0Auth but now I am in the process of developing my own ...
0
votes
1answer
127 views

Microservice security: How to perform authorization + services also need auth checks individually?

I have the following architecture for accessing a REST service that requires authentication: Oidc token flow managed at the client Access token verified at the server in the auth service (proxied ...
0
votes
1answer
100 views

oidc authentication webapp REST api

So I have looked at the following client library, implementing the OpenID Connect spec: https://github.com/IdentityModel/oidc-client-js It works as expected, and I can now allow users to login with ...
0
votes
1answer
184 views

Why authenticated boot not Secure boot?

Context: Secure boot is one of the important elements of Trusted Computing in computer system. One variety of the Secure boot is authenticated boot. While secure boot prevent the boot of a non trusted ...
2
votes
0answers
59 views

Benefit of authentication with a gateway

Given... a public web service with enabled SSL/TLS the web service enforces authentication using JSON Web Tokens a client on a LAN without an Internet connection a proxy on the LAN that grants point-...
0
votes
1answer
86 views

Why is the Diffie-Hellmann exchange not enough to authenticate the communication partners in IKE_SA_INIT?

The IKE_SA_INIT does create a key seed SKEYSEED from the Diffie-Hellman values and nonces. Since the exchange does sharing the secret between the communication partners, I do not understand why it is ...
0
votes
0answers
43 views

Can anyone identify the authentication backend used by a PHP website from the following URL?

Client POSTs creds, and if authenticated, server responds with a 302 redirect to an enormous path: https://phpwebsite.com/login/auth/[encoded_data] where encoded_data is either 811, or 726 ...
-2
votes
1answer
92 views

Security without Login

I am working on a web-app where user can access his purchased item using two word/Number combination and then user add card details on same page for the payment of those item. Point to be noted ...
0
votes
2answers
99 views

Is there any solution to this system?

INTRODUCTION First of all, I'm a beginner in RSA mechanisms and similar but I'm really interested in knowing if this is possible. In this scenario, I organized a party where certain people receive a ...
1
vote
1answer
97 views

How to securely send data to a javascript broswer client?

I have a client which requires some currently public API endpoints be encrypted and secure (although it's more of a checkbox than anything I worry about someone attacking, or I would not accept the ...
2
votes
1answer
45 views

Authentication followed by storage decryption on login?

I got a typical login setup: Username/password that is passed to server, hashed/salted with PBKDF2, then compared to hashed/salted entry in login database. After that, JWT token is generated and ...
1
vote
3answers
111 views

Using two salts - one stored with the password, one stored in a random row in a separate table

Imagine a login system is being created, and a user's password is hashed thusly: Users.password = PBKDF2(salt1 + password + salt2) The result of that ^ operation and salt1 are stored side-by-side in ...
2
votes
0answers
51 views

How to mirror user access between Windows 2016 Servers

I'm setting up an intranet web server that will handle requests coming from multiple different types of employees. One of the requests that my server will need to handle is to query data from a ...
3
votes
1answer
146 views

How exactly do mobile apps achieve authorization code flow with PKCE?

Let's imagine the following: I've developed a mobile app using Xamarin (iOS/Android compatible) I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's ...
4
votes
2answers
757 views

Is it possible to mac-spoof Xfinity Wireless?

Background Comcast/Xfinity operates various wireless hotspots across the US, accessed via the SSID xfinitywifi through the many wireless access points shown on https://hotspots.wifi.xfinity.com/ ...
2
votes
1answer
73 views

Does re-authenticating to apps on an unlocked phone really make an app more secure?

Several apps on my iPhone X including LastPass, and iCloud passwords prompt me for my Face ID before allowing me to use them. I guess the idea is that someone could accidentally take my unlocked phone ...
3
votes
1answer
109 views

Putting personal Data in E-Mail vs sending password in plaintext to access that data

I started working on a service that sends out mails with a link to a registration form. (e.g. a registration for a movie premier) The link would look like this https://movie-premier.com/rsvp/USERCODE ...
1
vote
0answers
38 views

OpenID Authentication Method Reference Name for a code sent via email

Introduction: I am currently implementing acr_values, acr & amr principles on a Open ID Provider server. The claim amr (described in the OpenID RFC 1.0) has no standard clearly defined in this ...
1
vote
0answers
46 views

Advantages of EAP Authenticator in EAP protocol

What is the purpose of using a EAP authenticator in the EAP protocol ? Since underhood, the authentication procedure is between the EAP peer and the authentication server, what is the advantages of ...
2
votes
2answers
82 views

Is putting an authentication tokens inside the HTML body safe?

I have a project, a webapp/website that uses cookies to authenticate users with long randomly generated strings (also with samesite:lax, httponly, secure), however I also have an API which itself ...
2
votes
0answers
59 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
3
votes
1answer
85 views

OAuth 2.0 authorization code flow vulnerable to “shoulder surfing”?

When using the OAuth authorization code flow in web applications, after successful authentication of the resource owner, the authorization server usually responds with a browser redirect to pass the ...
30
votes
9answers
7k views

Is there a way to add salted hashing to my user authentication without breaking my former login server

I am presented with the following scenario: I have a MySQL-Database with a table of users. The table has two fields: username and password. The password is stored as an unsalted hash. An over 15 ...
0
votes
2answers
121 views

Best way to authorize and authenticate a user on web API

I am doing a hypothetical web just for learn some security tips and the first problem I've found is the login, I've read like 40 articles, a lot of questions here on stackoverflow and I still don't ...
1
vote
2answers
26 views

Viability of simplified JWT

Our team has been building a custom distributed authentication mechanism, and I wanted to ask if this approach is actually viable. The approach is a dumbed down version of Jason Web Token (JWT). ...
2
votes
1answer
80 views

IKEv2 Using Different PSKs

We're setting up some new tunnels and have been told to use IKEv2. I understand that IKEv2 allows different authentication methods, e.g. one side using PSK and the other using a certificate. We don't ...
3
votes
0answers
50 views

How to add a new webauthn key if the existing one isn't portable

Webauthn supports authentication or multi factor authentication with either hardware keys or authentication features that are built into the device used (Windows Hello, Android with a Fingerprint, ...)...
1
vote
1answer
44 views

When does OAuth re-authenticate users?

I assume OAuth protocol being something like this: user registers to Gitlab using Facebook (for example) Facebook asks if user accepts sharing profile info with Gitlab user accepts Gitlab receives ...
1
vote
1answer
73 views

What are the security risks of basic authorization in SOAP requests?

What are the security risks of basic authorization in SOAP requests? I know that the username and password are concatenated and sent in Base64 in an HTTP header on every subsequent request, but it is ...

1 2 3
4
5
78