Skip to main content

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
1 vote
1 answer
147 views

Scalable REST API authentication

I'm trying to implement authentication with React and Node via REST API and getting really confused. In many articles I see the JWT way to handle the authentication, but I also see that this is not ...
MarkDou's user avatar
  • 11
0 votes
1 answer
61 views

What are the security concerns with setting up this authentication handshake

We have a custom online service that is private. My company can access it via SSO but there is no other login mechanism. We have a business partner that has its own online portal, which its own ...
user1821431's user avatar
3 votes
1 answer
712 views

Does Push 2FA protect against phishing/MitM better than TOTP?

I was having the debate of TOTP vs Push Notifications and found this claim online: Is the 2FA method protected against phishing? Chart Explanation: The most common method of phishing is persuading a ...
Grooke's user avatar
  • 278
0 votes
2 answers
147 views

Using IP for one request (one time) protection

I have an endpoint that accepts data as signed PASETO tokens. It has one problem - if someone "cracks" the TLS encryption or this signed token leaks then everyone can use it as long as the ...
Szyszka947's user avatar
0 votes
0 answers
285 views

OpenID Connect for authenticating a web-api

I want to accomplish the following: Having a web application or mobile app authenticating users using openid connect. Having a REST Api authenticated using openid connect using the same user as for ...
Wilko van der Veen's user avatar
1 vote
2 answers
187 views

Random identifier vs identifier plus HMAC

Suppose I have a resource that I want to be accessible only using a specific link. I could generate a link using a 256 bit random identifier, e.g. https://example.com/aMXtSQufIxntoMSnTQGdgMfs84VzM-...
Gordon Leigh's user avatar
2 votes
1 answer
4k views

Why do big sites use cookies and not OpenID connect?

As I understand it, OAuth is the natural evolution of authentication protocols I understand in a general way that evolution is as follows: basic authentication cookies tokens, at this point you want ...
user60108's user avatar
  • 187
3 votes
2 answers
570 views

Is it a good idea to reuse certificate issued by public CA for internal database client authentication?

Let's say we have: Publicly available HTTPS API (e.g. api.example.com). The web server that runs it uses a certificate from a publicly trusted CA (e.g. Let's Encrypt) with both server auth and client ...
Alexander's user avatar
0 votes
1 answer
326 views

Should resource servers behind an API gateway independently verify authentication claims?

Is it considered OK to "authenticate" via unverifiable plain-string headers simply asserting a principal name (User-ID: 12345), as long as this is behind an API gateway that does verify ...
Joshua Honig's user avatar
3 votes
1 answer
452 views

Authentication flow leading to wrong authenticator app - what happened, and how to prevent?

Someone I know ended up installing a sketchy authenticator app while going through Microsoft's SSO authentication flow, and I'm trying to understand how this happened exactly. The user's organization ...
Cedric Reichenbach's user avatar
0 votes
0 answers
150 views

Solutions for out of band biometric login

I am enhancing our login flow to include biometric verification via your phone. The user will log in to the desktop app but will have to verify their identity via their phone. We already have an app ...
Decrypter's user avatar
  • 101
4 votes
1 answer
430 views

Why would websites ask users to reauthenticate after a password change?

I was discussing with a non-IT friend after he came to me with a question regarding security and password change. As he puts it: "Why do websites ask me to re-authenticate after a password change?...
Yuriko's user avatar
  • 1,528
1 vote
1 answer
102 views

Is there a security-related motivation for prompting me for my email address, and then my email and password?

Often when I am signing into web sites, I am prompted for credentials in two steps. First, they ask me to enter my email address. I type it in and click a button. Then they ask me for my password. I ...
adam.baker's user avatar
1 vote
1 answer
115 views

Interpreting OWASP prohibition: no sensitive-account login to any frontend interface

OWASP’s Authentication Cheat Sheet states unequivocally: Do NOT allow login with sensitive accounts (i.e. accounts that can be used internally within the solution such as to a back-end / middle-ware /...
Jim Ratliff's user avatar
1 vote
0 answers
146 views

oauth2 with additional secret

I'm using Spring boot to create an application that stores user secrets in a database (I have to store the secrets); each secret is stored in the database after being encrypted with the user's ...
xRoby's user avatar
  • 11
30 votes
3 answers
8k views

Why are PIN codes usually of even length (4 or 6)?

A huge problem is PIN guessing from birthdays (dd/mm/yy lends to a 6 digit number that is easily guessed, dd/mm/yyyy for 8 digits). It's very often that a PIN number is taken from someone's birthday ...
jonvyltra's user avatar
  • 409
0 votes
0 answers
43 views

On the gains and losses of an additional client side stretching of the user password [duplicate]

Picture a state of the art implementation of a website registration and login system. I'm interested in analyzing what a defender gains and loses by feeding the user password to a key-stretching KDF ...
Margaret Bloom's user avatar
1 vote
3 answers
338 views

Can you exploit an SQLi authentication bypass for anything else?

I have manually confirmed an SQLi authentication bypass in a user login portal. The payload itself is quite simple. Can this vulnerability be used to do anything else such as enumerate users or inject ...
ishy987's user avatar
  • 13
1 vote
2 answers
195 views

What ways other than password and authorized SSH key are there to log in to a Linux system?

When deleting a user on a Linux system, if you lock their password and kill all their processes, a logged in user disconnects and can't log in with his password anymore. But if they still have an ...
lolz's user avatar
  • 11
0 votes
0 answers
184 views

Can OTPs substitute password? [duplicate]

One-time passwords (OTPs) usually serve as the 2nd factor in a 2FA scheme. But, in isolation, I believe they are more secure than passwords, since they are ephemeral and passwords are still badly ...
sourcream's user avatar
  • 111
1 vote
1 answer
250 views

Do sites like reddit and Quora expose their Google API client keys to the public?

On Quora, when I want to sign in using Google, I am redirected to this URL, which has a parameter client_id=917071888555.apps.googleusercontent.com. Similarly, reddit takes me here, which has ...
Cornelius Brand's user avatar
0 votes
1 answer
383 views

Fully Qualified Domain Name (FQDN) based authentication

IP addresses can change and the FQDN is slightly more constant. So I thought that FQDN based authentication instead of IP based authentication might be a good idea, but I didn't find any information ...
Szyszka947's user avatar
19 votes
4 answers
6k views

How is TouchID more secure than a simple password?

This likely stems from my complete lack of familiarity with encryption technology and IT security in general, however it isn't clear to me how biometric authentication (such as Apple's TouchID) makes ...
10GeV's user avatar
  • 301
1 vote
0 answers
156 views

Passthrough authorization from web-application to web-api

I am designing an new web application with a web-api backend. We want to try using OpenID Connect and we are looking into the best way to authorize the user for the API. Setup: User logs in into ...
Wilko van der Veen's user avatar
0 votes
1 answer
265 views

Strange Root CA certificate in Windows Trusted Root CA Store

While reviewing Root CA certificates in Windows Trusted Root CA Store I came across a stange Root CA certificate with Issuer Desktop-XXXXXXX and Subject Desktop-XXXXXXX, enhanced key usage for server ...
1000's user avatar
  • 1
0 votes
0 answers
69 views

Is there a need for mutual Authentication in the following use case? if so why?

I came across this use case where mobile devices operating in a pull architecture (connecting to an AWS cloud service endpoint) based on some device triggers will request to be unlocked via a TLS ...
Dave Jones's user avatar
1 vote
1 answer
197 views

Why does channel binding prevent MITM attacks?

I have read RFC 5056, RFC 5929, and RFC 5802. They say channel binding can prevent MITM attacks in an insecure environment where the client does not or cannot verify the authenticity of the server. If ...
relent95's user avatar
  • 131
4 votes
2 answers
2k views

What will happen if I accept this "Change your search setting to: smartwebfinder.com"?

When I want to install Ultrasurf extension it gives me this message: So I do not understand what this "Change your search setting to: smartwebfinder.com" wants to do. When I go to this ...
dsd's user avatar
  • 41
0 votes
1 answer
107 views

Is SMS a secure authentication method? [duplicate]

I’ve seen many HN comments bashing on SMS being insecure. But WhatsApp and signal both use it as their primary authentication method so it can’t be that bad? Why is it bad? What attacks are it ...
david_adler's user avatar
3 votes
1 answer
750 views

Is FIDO2 authentication vulnerable to a social engineering replay attack?

I'm starting to learn about the FIDO2 standard, and I'm wondering if this scenario is possible... Victim visits a credential harvesting page and enters their credentials Credential harvesting backend ...
Sean W.'s user avatar
  • 835
0 votes
0 answers
94 views

Authenticating with unencrypted POST credentials - is it safe? [duplicate]

If a webpage is served over https and to authenticate it receives both login and password as unencrypted POST parameters (free text) is it considered unsafe?
Luke G's user avatar
  • 121
6 votes
1 answer
2k views

SSH Man in the middle attacks - how to detect if the victim is allowed to login on a remote server and which method is used

There are some man in the middle tools for ssh, which can be used to intercept ssh sessions: SSH-MITM project OpenSSH fork with implemented mitm capabilities The OpenSSH fork has some problems with ...
herbert-m's user avatar
0 votes
2 answers
89 views

Altering requests after authenticating

In a web mvc application I have the user login and then he is navigated to a View which presents some data fetched from the database based on a unique Id of the user. He can continue to other views to ...
microwth's user avatar
  • 2,473
2 votes
1 answer
500 views

Is OTP an acceptable alternative to a password in single-factor authentication?

I recently discovered that when I have two-step verification disabled on my Amazon account, Amazon will allow me to sign in to my account using only my phone number and an OTP code sent via SMS. I am ...
Kevin K's user avatar
  • 123
1 vote
1 answer
205 views

How message authentication code (MAC) works?

Let's suppose I'm uploading some website to website example.com, and I'm signing every single file with MAC which is shared by users of my website to verify that me (the admin) uploaded that file. It'...
Algo's user avatar
  • 13
0 votes
1 answer
2k views

Does Google Authenticator share device information to website?

I wonder about Google Authenticator privacy. I wonder if the app shares any information to the website owner about devices that we use to add a new key. I mean information like IP address and device ...
John's user avatar
  • 1
1 vote
1 answer
287 views

Can the services inside the VPC be authentication less?

We have a micro-services architecture, where many microservers need to talk to each other for data. These services are inside a VPC. I need to understand if the HTTP APIs of these microservices need ...
Vamsi Pavan Mahesh's user avatar
0 votes
0 answers
14 views

Is a TOTP with RFC 6238 and a password in a manager 2FA? [duplicate]

For example Microsoft Outlook web based email service can be configured to require both a username/password combination and a time-based one-time password (TOTP) generated by the algorithm described ...
User65535's user avatar
  • 151
1 vote
1 answer
2k views

What are the security best practices to implement offline login of android apps?

My client has an android application requirement. The users of the application are workers who might have to work at places where internet connectivity is unavailable. So an offline login feature is ...
Anonymous Platypus's user avatar
1 vote
1 answer
1k views

Would storing the users IP address in a session token be more secure?

In a web app, would storing a users IP address in a session be more secure then storing it without it? I think that if I store a JWT in their cookies that includes their IP address for session ...
Justiniscoding's user avatar
0 votes
1 answer
504 views

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

What are some attacks I can try against this form of authentication? How do I test if they are cryptographically secure as well?
study man's user avatar
3 votes
2 answers
3k views

Create a cryptographically secure random string for auth cookie in javascript

I know there are multiple libraries for managing authentication, but I have a hobby project and wanted to create a very simple authentication system. It'd set a cookie in the client's browser with a ...
flen's user avatar
  • 225
20 votes
4 answers
5k views

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Alternatively, the question could be asked: Does issuing a checksum for a file we sign anyways just duplicate work? Use case: Firmware sent to an IoT device. We sign it, and form a separate checksum ...
kmfsousa's user avatar
  • 311
2 votes
0 answers
1k views

Why do I have to store a refresh token in db

As far as I know, JWT tokens are used for implementing 'stateless server'. But as I try to apply Jwt to my website that uses sessions and cookies for authentication, I found that most people store ...
John's user avatar
  • 21
-1 votes
1 answer
444 views

Using certificates for authentication in a web site

Today i faced a web site related to government that showed me all of my certificates in a combobox for authentication on that web site. What were those certificates? How can i show them in a asp.net ...
SilverLight's user avatar
0 votes
0 answers
503 views

Encrypt SVN for passwords

Could anyone give me advice on the best way to encrypt the SVN version control system on a Amazon Linux 2 instance? I am planning to encrypt or disable the SVN from asking if unencrypted passwords ...
samtech's user avatar
0 votes
1 answer
70 views

Can third-party authentication yield a static user-specific encryption key?

I'm writing a REST server + frontend with two goals that seem to conflict: Signing in yields a static, user-specific key (K1) to decrypt a document (D) stored encrypted on the server. The key should ...
RatherBeLunar's user avatar
1 vote
1 answer
624 views

Creating secure website-based login for a desktop app

This question relates to this post I made on StackOverflow recently, which I'll recap here briefly. I have a desktop app that I would like to authenticate through a website, using the process outlined ...
skillz21's user avatar
  • 113
0 votes
1 answer
491 views

AWS Service-To-Service authentication via Identity document

In AWS, Instance identity documents are signed documents that describe instance metadata such as private IP, image ID, etc. An identity document for an instance A an be obtained from instance A using ...
anon2328's user avatar
  • 121
0 votes
1 answer
299 views

What security concerns can arise from using HTTP Basic-Authentication? [duplicate]

During an engagement, i have been asked by a client to explain (with the use of one or more examples) why they must update their website authentication mechanism, as they are currently using HTTP ...
pashani jaulani's user avatar

1
3 4
5
6 7
91