Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
-1
votes
1answer
77 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
3
votes
4answers
498 views

Passing plain text password over HTTPS

My login for POST is over HTTPS. Therefore, I don't do anything to the provided password before submitting. And I don't see an issue there unless someone is watching your browser's developer console. (...
1
vote
1answer
95 views

In an Arm TrustZone based Trusted Application (TA), how can a remote party tie an output to a particular TA?

I've been looking at the following figure which shows, with Arm TrustZone architecture, resources of a system can be divided into a Rich Execution Environment (REE) and a Trusted Execution Environment ...
0
votes
2answers
106 views

Is it less secure to force periodic user logouts vs keep them logged in?

I've been unable to find any research or information on this. Google periodically signs me out and forces me to sign back in. I have multiple devices and multiple google accounts so it's a bit ...
1
vote
1answer
62 views

How exploitable is a none JWT?

A recent penetration test has discovered that my org is using the JWT authentication scheme that allows the 'none' algorithm. How exploitable is this in the real world? I understand that the issue can ...
1
vote
1answer
121 views

Is it OK to store the user's plain-text password in a claim?

For customer reasons, my web app authenticates the user against a proprietary user database using a simple API like bool authenticate(string username, string password) In case the user changes his ...
26
votes
2answers
9k views

What's the point of Microsoft Account 2FA if it still lets me log in using password instead?

I have a Microsoft Account linked to a Microsoft Authenticator app for 2FA purposes. Every time I log in, it first sends me the Authenticator request, but I can always click "Other ways to sign ...
2
votes
2answers
56 views

how to deal with with authentication tokens in the client browser and in my database?

I am building an asp .net mvc project and I want to save the user who is currently logged in , So I read about sessions and cookies and I found that authentication tokens stored in a cookies are a ...
2
votes
1answer
130 views

Understanding Secure Boot

I'm trying to understand the secure boot process of an OS but there are few points I can't wrap my head around. At a high level, afaik, secure boot ensures that the loaded OS is authenticated by its ...
1
vote
0answers
119 views

Secured data upload to Aircraft over ARINC 615A

We have a requirement for Data loading function to Aircraft. There is Avionics standard termed as ARINC 615A and ARINC 665. 615A specifies high speed Ethernet based data load operation; where POINT-TO-...
1
vote
1answer
58 views

What are the logical steps taken to perform ssh key authentication?

I understand the logical steps of asymmetric key cryptography as it relates to TLS, however, I've started using Git and in a bid to avoid having to use a password for authentication, I've set up ssh ...
0
votes
1answer
65 views

MacOS able to access data without password

On a Mac, one can go into recovery mode by turning off the Mac and clicking Command R while turning it on. Then, by typing resetpassword into Terminal, one is able to reset the password without ...
3
votes
2answers
322 views

User authentication: In HTTP Server vs. in Web Application

Management decided to switch the authentication-backend from LDAP to Kerberos as LDAP is deemed "obsolete and insecure". Also they want to switch from Apache to nginx for "performance ...
0
votes
0answers
38 views

Security concern on locally stored authentication token

It is a common method on mobile applications to allow users to bypass authentication process by verifying a locally stored token (previously authenticated) on device. This is to strike a balance ...
0
votes
1answer
82 views

Why to use username and password instead of just a long password? [duplicate]

Why do most websites use the pair of username and password as we can just use a long password like a token to identify a user? A simple example: On the server, we create a JSON file with user data ...
1
vote
0answers
53 views

Automating SAML login for service users?

Is it possible to fully automate the login of a service user (i.e. a programmatic, software based "user") without user interaction? I have a service provider that's SAML protected. Basic Auth and ...
2
votes
0answers
676 views

How is a bad actor able to disable Amazon's 2-step verification without supplying a OTP?

My wife's Amazon account was hacked yesterday. She discovered the purchases, changed her password to both gmail and Amazon, and enabled Amazon's 2-step verification (2FA) through SMS on her phone and ...
0
votes
2answers
245 views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
2
votes
1answer
35 views

Is an LDAP injection possible for a basic search query?

I'm trying to secure a login endpoint by attempting to bypass the login that uses LDAP. It employs a search query of "cn=" + username + ", dc=example, dc=com" with a filter of "(objectClass=*)". Is ...
9
votes
3answers
475 views

Does python's pip provide cryptographic authentication and integrity validation?

Does python's pip package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
1
vote
2answers
99 views

Replay Safe Mutual Authentication (libsodium)

I am working on an end-to-end encrypted messaging application as an educational activity with some of my extra time. I have chosen to use libsodium for the underlying crypto. I have run into a hang-up ...
0
votes
1answer
54 views

Why would a software need my IP address in authentication token?

I was looking at the authentication token used in my network requests to a software that we use at work. I noticed that this is not a general JWT OAuth token but some XML based token. I guess, old way ...
0
votes
1answer
52 views

Same session cookies for a user logging from different browser/machine

I am new to web application security and have a few doubts regarding session cookies. Which of these is considered more vulnerable: Having the same session cookies for a user logging in from ...
2
votes
1answer
87 views

Explaining a bad approach - not comparing hashes

Today I saw a snippet a code for authentication logic : function checkPass($pass, $login){ $inputedPass = $pass; $req = $bdd->prepare('SELECT password FROM agents WHERE password = ...
1
vote
2answers
97 views

What is the benefit of public Certificate Authority when using SSL mutual authentication?

I was working the other day and I had a question come up, that I want to ask here to make sure my assumptions are correct. In terms of SSL Mutual Authentication a self signed CA and a public CA ...
0
votes
0answers
70 views

Clear Browser Cache of Certificates Used for Authentication

We are using cert based authentication where the client sends a cert to the server, which is validated for authentication for a web application. This all works well. The problem happens when the user ...
0
votes
2answers
122 views

Why make it difficult to disable MFA tokens?

Some websites make it easy to enrol multiple TOTP apps at the same time but make it difficult to disable these apps. For instance, the user would have to completely reset the MFA settings instead of ...
9
votes
3answers
3k views

Client side password hashing with static salt - did I find a breach?

I downloaded a software that has a login interface. It's a $100 a month subscription software. I disassembled the software and found that passwords are being sent by combining them with a hard coded &...
1
vote
2answers
123 views

Public-key-based website login

I'm looking to implement a public-key based login / authentication for a website. This will not be used for general users – it will be used by both automated scripts and for admin logins. Before ...
0
votes
1answer
113 views

How safe is my login system (conceptually)?

I implemented a 2FA authentication for a web app with PHP and Google Authenticator. In order to login to my system there are a few steps: User types in a complex master password in order to access ...
1
vote
2answers
68 views

How to establish a secure channel with authenticated and authorized access to a remote entity

I have the following problem: There are 3 parties A, B and X. X is holding 2 entities on behalf of A and B. A communicates with X to operate it's own entity. B also communicates with X to operate ...
1
vote
1answer
66 views

Is it ok to share relevant login information on an API's public endpoint?

I have an (https-only) API that uses OAuth2 for authentication and authorization via access tokens. Any request to the API needs an access token to the Authorization header. The API validates that ...
1
vote
2answers
1k views

How do I know/find out about Minecraft Server Vulnerabilities?

I remember playing Minecraft (Java-we're only talking about Minecraft Java on the computer here) at like 13-14 years old, and having this server owner claim that the server has been hacked, and that ...
1
vote
0answers
82 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
0
votes
2answers
70 views

Generating QR-Code for 2fa from google maps api risky?

I am currently using 2-factor authentication to tighten security for my login system. I use Google Authenticator to scan a QR Code, which generates a key which I can use to login. What worries me ...
1
vote
3answers
159 views

prevent/prohibit duplication of MFA software-token / ensure user identity

As I was unable to find any thread about this particular question, I'm trying to ask the community for help. We're currently using RSA RADIUS based 2FA to authenticate external VPN users from ...
1
vote
2answers
74 views

What are Security Considerations of Using File Upload/Comparison as Simplified Second Factor?

I am evaluating the idea of simplified second factor authentication by requiring a file to be uploaded, such as an image along with username/password. The file is stored on a user's device. My ...
0
votes
0answers
36 views

Securing my own routes with “Login with X” and OAuth2

I have a single page application which communicates with a REST backend. I want to require a user to login before being allowed to access certain routes. I want to offload user authentication to ...
1
vote
1answer
53 views

How do SRP (and PAKE generally) protect against verifier leak

I have been reading into PAKE protocols, specifically starting with SRP RFC2945 The gist of the requirement on the server is that the server saves triplet (username, verifier (v), salt (s)) in the ...
1
vote
0answers
44 views

How do I force a user to login again when using refresh tokens and their password changes

I am implementing my first service with authentication. So far I have a POC service that issues JWT tokens with an expiry of 1 minute. Users are forced to login again every minute which is not great. ...
0
votes
0answers
41 views

How to verify the genuine user identity using Google signin API?

I'm developing a mobile app. I have a question, and here is the scenario. If a person is logging into the App with google sign in API in a public network. The website will verify the user with his ...
0
votes
0answers
52 views

Why multi step login forms [duplicate]

I noticed that quite a lot of websites are using two pages login model today e.g. AWS, google, apple etc. They suggest user to type an account id/email and then navigate to a different place to ...
0
votes
0answers
60 views

U2F instead of password for “sudo mode”?

Some apps (Github being the most prominent IMHO) allow using U2F token as a means of validation for "sudo mode" (potentially dangerous actions in UI like creating a new token) instead of password. ...
1
vote
1answer
85 views

Should login/refresh authentication routes return new tokens if an existing, valid token is present?

My server sets cookies with the JWT and refresh tokens on login, and likewise when the refresh route is hit. If a valid JWT cookie is found in the request for these routes, should a new one be issued? ...
1
vote
3answers
70 views

Is it acceptable to make login name public?

I develop a web application where registered users see each others usernames. Log in is performed via HTTPS Basic Authentication based on correct username/password combination. This way an attacker ...
1
vote
1answer
81 views

Can OpenID Connect be used to implement social login?

Using OAuth to implement social login is insecure (https://tools.ietf.org/html/rfc6819#section-4.4.2.6) because OAuth doesn't provide authentication, only authorisation. The issue arises because the ...
1
vote
2answers
101 views

In case of TOTP code generation, why do products prefer a generic authenticator apps, such as Google Authenticator?

All the products supporting TOTP-based 2FA use one of the common authenticator apps such as Google Authenticator, Authy, etc. I want to understand whether there are any security reasons behind why ...
3
votes
3answers
101 views

When to implement authentication and authorization?

I am currently in situation where I have to decide when to implement security measures. So the question is simple, is it better to implement authorization and authentication methods right off the bat ...
0
votes
1answer
419 views

How to hide or secure django admin page?

I am working on an E-commerce website which is mainly in Django. I have this admin page. I want to hide, protect, secure it from other users/visitors means that only a set of IP address can view that ...
2
votes
1answer
70 views

how to protect smartphone data against theft?

i assume typical android has fully encrypted disk with a key stored in a header. header is encrypted using pin / pattern / fingerprint or not encrypted when there is no lock. is that correct? when ...

1
3 4
5
6 7
82