Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
1
vote
3answers
609 views

Are security questions considered as 2FA?

Many sites have a step during registration when you have to create security questions and answers for them. Is this type of security layer considered as 2FA? From what I know, 2FA is used for the ...
1
vote
0answers
357 views

How to uses FIDO2 hmac-secret extension for offline authentication? [closed]

How hmac-secret extension defined in the CTAP2 Specification is used to help implement offline authentication with an authenticator. Is there any other specification that says how to do this? From the ...
1
vote
1answer
345 views

Cookieless Authentication

I am working on an authentication server that can act as a central place to manage authentication for multiple projects, sort of like keycloak or ory kratos. While working on implementing ...
1
vote
1answer
59 views

Standard Protocols or secure mechanism to authenticate users offline

We have a use case wherein a mobile app that can be used by multiple users on the same device needs to authenticate the users in some offline scenarios. We were using Password grant as in OAuth2 to ...
9
votes
2answers
431 views

Why is Webauthn not used as primary authentication method?

In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all ...
1
vote
1answer
330 views

for reCaptcha, the token needs to be sent to backend for validation right?

So far, I have reCAPTCHA setup in the "submit" button for my login form with v2 Invisible recAPTCHA. But, I have a feeling that the token that I retrieve from Google needs to be sent to my ...
2
votes
1answer
98 views

Authentication for website and mobile app

This doing a Spring Boot application (Rest API, JPA, etc) uses (via Rest) from a website (Angular) and a mobile app (Android). The user using the mobile app (in the future) will be able to ...
2
votes
0answers
77 views

Authentication in Desktop App

I'm reading the OWASP Authentication Cheat Sheet, but it obviously is focused only on web browser. I'm searching for something similar for a desktop app. I want users to login to a desktop app. The ...
1
vote
1answer
152 views

What is the best way to go about generating a “token” for user authentication

Let's say I have a MySQL database with thousands of user accounts in it. These accounts contain lots of data, but for verification purposes, they each contain a username and a (hashed and salted) ...
3
votes
1answer
379 views

Does it make sense to have the application block users by IP as well as the firewalls?

I am planning to create a system, but I still have some questions about security. I would like to know if it makes sense to block unauthorized users from accessing the system, through the ip, using a ...
8
votes
3answers
706 views

Why would password managers provide support for OTP codes? [duplicate]

Can anyone explain me what's this trend of providing passwords and OTP codes on the same service? What benefit or value are they trying to bring to the table? We, as security professionals, have been ...
0
votes
2answers
110 views

Is there a type of login security that is keylog and screen capture proof that doesnt require a 2nd device?

I am looking for a login security measure where it is keylog and screen capture proof. Is there some type of login security like a 2FA without the need of a second device, but remembering a pattern or ...
0
votes
0answers
73 views

Delegating to multiple auth providers from a single page application

Consider a use-case in which a single page application using an OAuth identity flow has to use one of many possible identity providers, as determined by what user is logged in. More specifically, I ...
2
votes
2answers
431 views

Exposed my browser cookie of my request header

I exposed my browser cookie of my request header in a web forum. After I realized what I have done - I logged out, cleared my browser and logged in again. Am I safe now? Can someone still use that ...
2
votes
1answer
181 views

How to manage API keys

I'm trying to consume a payment processor API (not developed by my), but (being honest) I don't know anything about security, I don't understand API keys and authentication, I have multiple questions ...
2
votes
1answer
256 views

Authenticate-then-Encrypt: does the authenticity provide a benefit?

First off: I know that encrypt-then-authenticate is better, however I want to understand the following for authenticate-then-encrypt. The underlying cipher is AES-CTR or AES-CBC for this consideration....
2
votes
2answers
290 views

How is mailbox.org 2FA method referred to as, correctly?

Their 2FA to log in to their web interface requires two things: something you know (PIN); something you have (OTP, generated by app for example). After that, you need to log in by: input email ...
0
votes
0answers
18 views

Security implications of protecting private data with a long URI exclusively [duplicate]

A website hosts private/personal information at a very long and unpredictable URI, yet access to this URI is completely unauthenticated. Are there any major security issues with this? I can think of ...
0
votes
2answers
137 views

Approach to authorizing users and X.509 certificates

I have a system where I'm using X.509 certificates to authenticate the client to the server. The certificate is sent to an HSM to be signed. When it is returned it is used as part of a TLS connection. ...
1
vote
2answers
113 views

How can I give users access to thier data without requiring any authentication? [closed]

The premise of this question boils down to frictionless access to data. I have User A whose records I have kept on a database. I want to send them a link to their records such that they can access ...
1
vote
0answers
93 views

Understanding Risk-based authentication (Google case) [closed]

I am trying to access my Gmail account. I have the correct password. When I click on login it asks for a confirmation code sent to my recovery email. Hopefully, the recovery email does not have this ...
1
vote
0answers
63 views

What is the optimal authorization flow for this usecase?

Imagine that I'm building a server that provides useful APIs for web chat development. I want it to be accessible only to registered developer accounts. A developer registers and builds a chat that ...
1
vote
1answer
117 views

2FA on Stack Exchange, Where Is It Or What I am Missing?

Not sure if this is the right spot to post this, but I have not been able to find how to enable 2FA (such as authy, MS/google authenticator, yubikey etc...) on stack exchange using email ...
1
vote
0answers
47 views

Why do some "OAuth" providers ask for personal info?

I don't mean to start another OAuth vs OpenID discussion, but I want to share the underlying cause of my confusion. When I want a Client to process my google docs for something, I have to go through ...
1
vote
0answers
80 views

Possibility of EMVCO 3DS Authentication Decoding [closed]

I bumped across a request via Traffic analysis through Burp Suite Proxy & it looked like a 3DS Authentication. Sample below: My question was if this authentication could be intercepted, decoded ...
0
votes
0answers
68 views

Protect breached email accounts

We are a big supermarket chain and have had complaints about fraudulent activities from a few customers who have used a particular email domain. We are in the process of implementing MFA on our site. ...
4
votes
0answers
126 views

Is asking the e-banking username/password from a 3rd party site compliant with 3dsecure and PSD2?

Recently I tried to make an online purchase in one of the biggest e-commerce sites in Greece. During checkout, and after providing debit card details, it asked me to provide the username/password (not ...
0
votes
0answers
48 views

Using fields in X.509 cert for authorization [duplicate]

I understand that X.509 certificates are used for authentication. How can I use the information provided in an X.509 certificate for authorization? For example, are there any fields in the certificate ...
0
votes
2answers
84 views

How to avoid data discrepancy between multiple parties with dependent financial interests?

Generalized problem say there are 2 companies/parties A and B (there may be more) and there is an event E which is recorded by both A and B. Let's say the occurrences of event E according to A is 'E ...
2
votes
1answer
70 views

Using encryption key as input keying material

Libsodium supports Blake2 for key derivation. It seems like you shouldn't truncate the output to get two keys (eg one encryption/one mac) as the recommended way is to use a counter as the salt for ...
58
votes
8answers
9k views

Should I log users in if they enter valid login info in registration form?

Recently, we've had users complain that they forget that they have an account, try registering, and get error message that the user with such email already exists. There is a proposal to just log them ...
0
votes
0answers
117 views

JWT implementation and protection against CSRF and XSS

I have been going through OWASP guidelines on managing JWT based authentication. So, I have decided to change my current JWT implementation as per that. Flow is as below. When authenticated ...
1
vote
0answers
67 views

What is Received Sequence Counter(RSC) in WPA authentication

In WPA 4-way handshake and in Message 3 (while GTK transfer), A RSC (Received sequence Number ) sent by the Authenticator (AP) to the supplicant. The only information I found about RSC is that it's ...
1
vote
1answer
162 views

Why don't security conscious websites use a combination of private unique identifier and password to secure their logins?

To be clear when I say "private unique identifier" I mean an identifier, which is not stored on the database for the website, it would be hashed in combination with the password and a good ...
2
votes
1answer
84 views

Suspicious login alerts vs customer privacy

I would like to implement a "Login from a suspicious location" email for my users. The first thing that came to my mind was to use a GeoIP Latitude Longitude and a k-d tree to compare the ...
3
votes
1answer
141 views

Does TLS fall back to unauthenticated key exchange if the CA is not known to the client?

My lecturer said that if the server sends a public key certificate (RSA) signed by a Certificate Authority that the client does not know about (i.e. the client doesn't have a master certificate for ...
2
votes
2answers
307 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
1
vote
0answers
95 views

Can I use a persistent SID cookie for 'remember me'?

For the moment I implemented a login form asking for a username and a password and returning a session id (SID) that is stored in a cookie, without setting max_age or expires so that it will be ...
1
vote
3answers
217 views

ssh and anonymity?

According to the man page, ssh by default sends multiple public keys from files in the ~/.ssh folder, one by one, until authentication success. Does that mean that the server side could know multiple (...
0
votes
1answer
153 views

Authentication to offline device

I have an offline safe at a remote location that I want to give people access to at my discretion. I would like to control who and when they have access, without having to travel to the safe. Example: ...
1
vote
1answer
78 views

Config file contains password hashes and signature keys

First, I am a beginner in IT security. I hope my question is not too dumb. I use a program that can show a live feed from a security camera. You can import a project file, that sets up user accounts ...
0
votes
0answers
67 views

Server to server API authentication

We have an ASP.NET WEB API 2.0 that will be accessed by an MVC Core site. We want to restrict access to the API only to the MVC Core site (both sites will run on our VMs in Azure). Is it sufficient ...
0
votes
0answers
54 views

Trace Unauthorized login into My Gmail and Facebook Account [duplicate]

I have experienced an unauthorized login into my Gmail and Facebook account, while I was logging into the accounts and doing school assignments. Suddenly, I got an email from Facebook about "...
0
votes
0answers
214 views

Why does using JWT refresh tokens protect against CSRF during authentication?

I have read a few articles regarding JWT refresh tokens, and how/why they are used. One thing i have seen mentioned here: https://hasura.io/blog/best-practices-of-using-jwt-with-graphql/#persistance ...
2
votes
1answer
55 views

Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software

I've been reading many research articles about RoT - Root of Trust - for establishing a chained root of trust going up from BIOS to the Kernel. However, most of the article go briefly on how RoT works ...
5
votes
1answer
529 views

Is there a security reason to require email address and password in separate steps? [duplicate]

I have noticed lately that instead of having an email address and password entry box on the same page/screen, a lot of websites and apps will instead ask for your email address first, then it will ask ...
1
vote
0answers
46 views

2FA/MFA in a resource-constraint product

I'm working on a resource-constraint product and asked to enable support for MFA/2FA for all maintenance services. Given that MFA/2FA is about using two elements out of three(something you have, know, ...
0
votes
0answers
63 views

Does npm (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the npm package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
0
votes
0answers
55 views

Does yarn (Node.js package manager) provide cryptographic authentication and integrity validation?

Does the yarn package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides providing ...
1
vote
1answer
91 views

Which factor of authentication is an X.509 certificate

Given 3 factors of authentication: Type 1: something you know Type 2: something you have Type 3: something you are Which factor of authentication would be an X.509 certificate, assuming this ...

1
3 4
5
6 7
85