Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
58
votes
8answers
9k views

Should I log users in if they enter valid login info in registration form?

Recently, we've had users complain that they forget that they have an account, try registering, and get error message that the user with such email already exists. There is a proposal to just log them ...
0
votes
0answers
68 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
1
vote
0answers
46 views

What is Received Sequence Counter(RSC) in WPA authentication

In WPA 4-way handshake and in Message 3 (while GTK transfer), A RSC (Received sequence Number ) sent by the Authenticator (AP) to the supplicant. The only information I found about RSC is that it's ...
1
vote
1answer
137 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
2
votes
1answer
69 views

Suspicious login alerts vs customer privacy

I would like to implement a "Login from a suspicious location" email for my users. The first thing that came to my mind was to use a GeoIP Latitude Longitude and a k-d tree to compare the ...
3
votes
1answer
113 views

Does TLS fall back to unauthenticated key exchange if the CA is not known to the client?

My lecturer said that if the server sends a public key certificate (RSA) signed by a Certificate Authority that the client does not know about (i.e. the client doesn't have a master certificate for ...
2
votes
2answers
172 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
1
vote
0answers
57 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
1
vote
3answers
151 views

ssh and anonymity?

According to the man page, ssh by default sends multiple public keys from files in the ~/.ssh folder, one by one, until authentication success. Does that mean that the server side could know multiple (...
0
votes
1answer
115 views

Authentication to offline device

I have an offline safe at a remote location that I want to give people access to at my discretion. I would like to control who and when they have access, without having to travel to the safe. Example: ...
1
vote
1answer
65 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
0
votes
0answers
56 views

Server to server API authentication

We have an ASP.NET WEB API 2.0 that will be accessed by an MVC Core site. We want to restrict access to the API only to the MVC Core site (both sites will run on our VMs in Azure). Is it sufficient ...
0
votes
0answers
52 views

Trace Unauthorized login into My Gmail and Facebook Account [duplicate]

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
0
votes
0answers
140 views

Why does using JWT refresh tokens protect against CSRF during authentication?

I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance ...
2
votes
1answer
40 views

Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software

I've been reading many research articles about RoT - Root of Trust - for establishing a chained root of trust going up from BIOS to the Kernel. However, most of the article go briefly on how RoT works ...
5
votes
1answer
512 views

Is there a security reason to require email address and password in separate steps? [duplicate]

I have noticed lately that instead of having an email address and password entry box on the same page/screen, a lot of websites and apps will instead ask for your email address first, then it will ask ...
1
vote
0answers
34 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
0
votes
0answers
47 views

Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
0
votes
0answers
34 views

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
1
vote
1answer
75 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...
2
votes
3answers
576 views

Securing client side code of react application [duplicate]

I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription. Are there any methods to ...
0
votes
0answers
60 views

How do I assure that a site that I visit does not know I have been there before? [duplicate]

If I use the same machine (my PC) but with a different IP address and a different browser that I have never used to visit a site, will that site still be able to identify me? I don't understand the ...
1
vote
0answers
41 views

Problems understanding the use of Distance Bounding against Man-In-The-Middle attacks

I currently have to write a paper for university in my Network Security lecture about methods of secure location verification. Therefore, I chose to write about several distance bounding protocols, e....
2
votes
1answer
431 views

Propagating user context between microservices secured with M2M JWT tokens

We have a current microservice architecture where we secure communication between microservices via Machine-To-Machine access tokens (these tokens are obtained using the Client Credentials grant flow)....
8
votes
4answers
2k views

Alternatives for sending plaintext password while login

Note: I've already read Is it ok to send plain-text password over HTTPS? and https security - should password be hashed server-side or client-side?, but here it's about a specific replacement method (...
2
votes
1answer
101 views

how message authentication code share keys?

How are secret keys shared between receiver and sender, especially when we want to have confidentiality that sender and receiver are using two keys, one for MAC algorithm and one for encryption and ...
74
votes
8answers
10k views

Why is email often used as the ultimate verification?

In many services, email can be used to reset the password, or do something that is sensitive. Sensitive data is also quite often sent to you by email, e.g. long links that enable access to your ...
0
votes
1answer
122 views

Secure HTTP login in an embedded (IoT) system

HTTPS in an embedded (IoT) system is (as far as I know) not necessarily a good solution. Basic Authentication is not secure. Acceptable in an internal network. Idea: Login.html (when called up) sends ...
3
votes
1answer
187 views

Spooky Suspicious Sign-In From My Town

I just had a weird experience that I am trying to figure out. I received a suspicious sign-in notification from google on my gmail account. They had my correct password. This isn't that surprising, ...
1
vote
1answer
52 views

What happens if a secure token is provided to a trusted party that gets compromised

Take for example - AWS STS token or JWT tokens. Let’s say node A got a token for accessing a resource of account X on behalf of account X. Access includes read/write privileges. Let’s say few minutes ...
1
vote
0answers
72 views

Zero-Trust alternative to google sign-in, is this a feasable design?

I was thinking about zero-trust systems over the last few weeks and it seems like there are many things that could be implemented that way. With password managers being one of those things, I was ...
2
votes
1answer
129 views

How do I add 2FA to my personal computer?

I have a Windows 10 PC that I would like to protect a little better. I've looked for solutions online, but they're all business oriented. What I would like, in an ideal situation, is having to enter ...
1
vote
1answer
45 views

How to prevent the device from connecting to the original AP?

I'm running an Evil Twin attack with airgeddon. Point is that after deauth the account is going, automatically, to get reconnected to the orginal AP and not the fake one. The aireplay is likes so: ...
1
vote
1answer
928 views

Logging into remote server via SSH using VPN (Wireguard). Is it foolproof?

I have a remote server into which I login via ssh. On this server I have setup a Wireguard VPN to which my host connects. The ssh server (ssh daemon) listens on a private IP interface (the server's ...
2
votes
0answers
350 views

Keycloak and Open ID Connect best practices

I'm a bit lost as to the best practice surrounding a production-ready access management based on keycloak and open id connect. My understanding is that if you use Keycloak's provided adapters, instead ...
2
votes
1answer
108 views

client_id vs distinguished name in mutual tls

i am reading this in the OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens What is the difference between a client_id and a distinguished name? I see in the PKI Mutual-TLS ...
0
votes
3answers
121 views

Problem understanding salting

I'm a beginner in Information Security and am learning about salting. Unfortunately, most of the time I have to learn by myself since the lecturer doesn't provide deep explanation on these. I now have ...
0
votes
0answers
55 views

How to implement ChaCha20Poly1305 with large files? (Streamed/Chunked AEADs)

I have a private file encryption project that I'm working on that currently uses Encrypt-then-MAC. However, I've been looking at age and the article that's referenced in the spec that discusses ...
1
vote
0answers
142 views

Difference between JSON web token, bearer token, and MAC token in OAuth2

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens where the authorization server issues a client a JSON web token with the following format { "iss&...
0
votes
1answer
84 views

Should the API automatically renew the expired JWT or wait for the client to?

In most examples I’ve read, I see people mentioning that when the server returns a 401 the client should hit the jwt refresh endpoint, passing in the refresh token somehow (i.e as a cookie), and then ...
0
votes
0answers
69 views

validation of an access token from the resource server

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Boun Access Tokens The client after receives an access token (which is also entails his certificate in a hash format) from ...
0
votes
1answer
66 views

symmetric keys during mutual TLS

I have a client how asks a token from an auth server in order to use it to an endpoint which serves as the resource server. Between the client and the server, a handshake is utilized in order the two ...
0
votes
1answer
80 views

Client — CertificateVerify during handshake

I am trying to understand how the client is authenticated to the server during mutual tls So during the handshake, the client sends this message Client — CertificateVerify This message is used by the ...
0
votes
1answer
88 views

Certificate and public key flows in mutual TLS

I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens I am interested to know how the certificates and public keys are exchanged between the client and the ...
0
votes
1answer
145 views

What is an endpoint in the context of TLS?

What is the purpose of endpoints in mutual TLS authentication? Actually, what do we mean by an endpoint? I am following this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access ...
0
votes
1answer
90 views

OAuth alternative for two-party scenario?

I'm trying to come up with an authentication/authorization system for what seems like a really simple scenario, but as far as I can tell it's virtually unsupported. There are two parties, total; ...
0
votes
0answers
388 views

SAML-Authentication with angular, node.js and an identity provider

I want to to implement SSO using SAML2. But I don't know how to get it work with a distributed system where each instance is running independently on its own server. The environment consists out of ...
0
votes
1answer
141 views

CSRF token in SPA login JSON response?

Is it safe to include the CSRF token as part of an HTTPS successful login JSON response in an SPA? If not, is there a better mechanism for sending it which avoids the Double Submit Cookie pattern? ...
1
vote
0answers
26 views

HMAC with random application Id and secret with DPAPI

We have open endpoints because there is a flow where access token is still not presented. Because of that, I've implemented HMAC + DPAPI (using Azure Blob Storage) to store the keys, without involving ...
0
votes
1answer
115 views

How an IDP sends SAML assertion to an SP?

I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible. First is ...

1 2 3
4
5
84