Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
0
votes
1answer
56 views

Is client-side hashing secure during password creation when verification is still done server-side?

Trying to do this to distribute the work of creating a lot of users in which their passwords are hashed. This will cause the server to do a very large amount of work. The idea is this: (Assume ...
1
vote
2answers
199 views

Can gnupg sign multiple files in parallel?

I want to sign every file in a directory. I can do so with the following shell command, but it's slow. Serial Execution: find . -type f -printf "Signing %p...\n" -exec gpg --quiet --batch --...
3
votes
2answers
171 views

Is it necessary to force a newly registered user to login?

In a web application, is there a security advantage to forcing a newly registered user to manually log into their account, or is it safe to automatically log in a new registration? Assume that the ...
0
votes
1answer
97 views

Secure a REST API

I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources ...
0
votes
2answers
41 views

Role-based authorisation and TLS

I want to implement role based authorisation in my TLS connections. I.e. when my client authenticates with the server I want them to have certain privileges based on their role. Are there any ...
0
votes
0answers
19 views

Found out that a paid VPN service emails plaintext passwords [duplicate]

I recently found out that a VPN service does not hash their customer passwords and I need professional insight on how to deal with this. Here's how I found out: Bought a subscription on the wrong ...
0
votes
3answers
98 views

Prevent Replay Attack When using FingerPrint as login

We have an application that allows users to login using fingerprint. The server validating the sent fingerprint. Now, anyone can watch the traffic and resend them. What the best way to prevent this ...
0
votes
0answers
94 views

What is the point of hashing an API key?

Within my API backend i have a unique KeySalt for every API Key public string Key { get; set; } public byte[] KeySalt { get; set; } public string KeyHash { get; set; } When the user creates a new ...
0
votes
1answer
110 views

Is TCP's 3-way handshake a kind of mutual authentication?

Assuming no one is able to inspect or MITM in the network. Can I see it as a way to ensure the source IP in packet's header is the real source of the packet, so a kind of authentication ?
2
votes
1answer
160 views

What is the point of having a refresh token if it can be as easily stolen as an access token on client-side/JavaScript applications (SPA/PWA)?

From my understanding, the point of having a refresh token and short lived access tokens is to mitigate the consequences of having the access token stolen. This way, if this happens, the attacker will ...
1
vote
2answers
72 views

Terminology question - authentication through encryption

I came across a number of somewhat similar solutions, which are based on the knowledge factor related to a symmetric key in particular: If a party was able to generate correct message authentication ...
0
votes
0answers
14 views

How do I securely type OS login password in public? [duplicate]

So I use a password to log into my laptop, there's no 2FA or hardware security keys. I cannot use a blanket (like Snowden did) or a piece of cloth to cover my upper body or my hands. I don't want ...
9
votes
5answers
3k views

Does 2FA Help Prevent Unauthorized Access in Phishing Attacks?

Given Attacker is targeting a user of bank.com. bank.com uses SMS or Google Authenticator 2FA, where the user enters the 2FA code into a form. Scenario Attacker registers domain name baank.com ...
0
votes
1answer
82 views

Best practices for generating and storing authorization codes and access tokens in OAuth server

I've recently implemented an OAuth server functionality to our service. I've consulted OAuth 2.0 Threat Model and Security Considerations and addressed most of the concerns. I am curious about any ...
0
votes
0answers
107 views

Is caching the credentials hash and auth result secure?

I have an API that is handling a lot of volume and is using Basic authorization. This is causing me some performance issues and I'd like to move to token based auth but for various reasons, including ...
0
votes
0answers
48 views

Low-Power Keyless Entry

When I get within a meter of my car with the key in my pocket, the door unlocks automatically. A standard 200mAh 3V coin cell powers the key for about two years. To think about this easily, let me ...
0
votes
0answers
49 views

Oauth2: should I increase the refresh token expiring date?

I want my clients to be able to schedule a purchase for a given date. When they perform this scheduling action, they are authenticated with an oauth2 token. However the date could be so far from now ...
0
votes
0answers
33 views

Is it safe to use base64 value in API header for Basic Authorization? [duplicate]

I'm using a base64 value (dGVzdFRva2VuOlRlc3QxMjM=) as the Basic Authorization header when calling an API. Anyone is able to decode this value to the plain text value (testToken:Test123). Base64 ...
1
vote
1answer
135 views

Is it possible to defend against user enumeration during registration? [duplicate]

I am currently reading the book "Web Security of Developers" and it talks about avoiding Username Enumeration, and it makes no mention of the registration/signup page for your system. I've ...
0
votes
1answer
55 views

Risks with setting up a authentication-less public VPN

I'm in the process of setting up an authentication-less public VPN. To prevent against DoS attacks, I'm going to set up some sort of IP address based rate limiting. The VPN is port-bound, i.e., it ...
2
votes
0answers
41 views

Does the SSL/TLS lifetime change affect client certificates?

From 2020.09.01 Google, Apple an Mozilla changed the maximum trust time to 398 days. I'm working on a project, where the client also authenticates itself with a certificate. This certificate is stored ...
3
votes
1answer
112 views

How do we verify a human agent in light of WCAG 2.2?

WCAG is a set of standard web accessibility criteria developed by the W3C that have been adopted by regulatory agencies in a number of countries, including Section 508 in the U.S., which makes ...
1
vote
1answer
273 views

How to properly invalidate JWT tokens and sessions in this use case?

I am building a web app, which is made of a Node.js Backend and Angular (NOT AngularJS!!! I only used the tag, because Angular was not available..) Frontend. How do I properly secure this app? I ...
1
vote
0answers
65 views

Strange account activity - how to investigate

Today I have observed very strange scenario which appears to be attempts to hack an account. So first, let me tell the pre-story: I have started to receive 2-factor authentication SMS messages from ...
0
votes
1answer
89 views

Server to server authentication

I need to perform sensitive REST API calls between 2 server applications that I am writing. To do this I need to be able authenticate the server that is performing the sensitive API calls. The current ...
1
vote
0answers
125 views

SSH certificates and mutual authentication

SSH certificates are a recent addition to the protocol, and I see them as being used mostly for the clients. Can the server use an SSH certificate too? And if so, is it possible to have mutual SSH ...
0
votes
0answers
61 views

What is the need of HMAC in Diffie-Hellman? [duplicate]

When Alice and Bob both have the same shared secret to encrypt their data (Diffie-Hellman) and Alice encrypts her data with this key and Bob can decrypt it with the same key, then Bob knows that the ...
0
votes
0answers
40 views

Authenticate Windows/Linux process against hardware security module

I have a hardware security module connected to a host computer (Windows/Linux). The HSM contains symmetric keys used to encrypt/decrypt data (i.e. files and real-time communications); the keys are ...
2
votes
2answers
483 views

Magic links: JWT vs random string

Tutorials I've come across about implementing magic link authentication (in Node) recommend a mechanism like this: the user hits your endpoint with their email address you generate a signed JWT from ...
14
votes
7answers
3k views

Timing attacks in password hash comparisons

I had a discussion with a friend today about his password hash comparison. I argued that you can't return false on the first hash mismatch you have and I sent him a link to an article about a Java ...
0
votes
1answer
71 views

OAuth 2.0: what's stopping a client from lying to the Resource owner about scopes

I'm seeing token scopes as more of a contract between what a third-party application can do on behalf of some user's consent. Therefore, let's say a client asks a Resource owner to authenticate and ...
0
votes
2answers
103 views

Protecting OTP based authentication

Let's say I have a website which uses 4 digit OTP based authentication for login i.e. users will enter their mobile number, receive OTP on the entered mobile number, enter the received OTP to login ...
0
votes
0answers
77 views

2 person 2-factor authentication?

I'm trying to build a system as follows: User 1 is a low permission user. They will be using their phone and at some point will need to do a secure action. User 2 is an admin user and will be in the ...
0
votes
0answers
14 views

Is password less login secure? [duplicate]

Recently I came across this password less login. For authentication, we need to enter an email address and click on a login button. We will receive a link in your email and when we click on that link ...
0
votes
0answers
35 views

Providing shared access to a single machine without a shared account

In our factory we have a "Big Machine" which runs 24/7 and requires input and monitoring from different operators across various shifts. Every operator needs to be able to stop/start/control ...
3
votes
0answers
115 views

Could an attack on time synchronization with a Galileo Satellite be used to spoof navigation messages with TESLA-based authentication?

I read about an attack on the TESLA protocol which will be used in Galileo's navigation message authentication (Full article can be found here: https://doi.org/10.1007/978-3-319-49806-5_1) Basically, ...
27
votes
9answers
7k views

How does “Somewhere you are” authentication add further security?

In addition to the authentication techniques that are based on “something you have”, “something you know” and “something you are”, authentication techniques that consider “somewhere you are” are also ...
0
votes
1answer
58 views

Is it safe to add “Access-Control-Allow-Origin:*” to an API endpoint with custom authentication via header?

Lets say I have a site at myapp.com that talks to the api at myapi.com. For that to work I have to turn on CORS. I want to do it like that: Access-Control-Allow-Origin: * and my API authentication is ...
0
votes
0answers
96 views

LMv2 in NTLM authentication

I have done some research about NTLM and his challenge responses, and I have one last thing left unresolved. The LMv2 response, which is the newer version on of the old Lan Manager response, is ...
1
vote
0answers
139 views

SECURITY VIOLATION: Root login attempted - Which password is affected?

Logwatch shows that proftpd was tried to be logged into using root 0.0.0.0 (111.254.68.221[111.254.68.221]) - SECURITY VIOLATION: Root login attempted I found: Normally, proftpd does not allow root ...
0
votes
0answers
47 views

Secure Authentication of Technical User to a Network-Appliance-HSM

Let's assume we have an internal environment consisting of some distributed systems, one central system and an internal PKI. The central system is serving a cluster of HSMs that shall be accessable by ...
0
votes
1answer
85 views

Why does the server generate a random challenge for SSH authentication?

Wouldn't it be more efficient if the client initiated the connection by generating their own message, and encrypting it using their private key, then sending both messages to the server so it would ...
1
vote
1answer
803 views

Authentication in Next.js application (SSR SPA with long sessions)

We’re currently developing a Next.js application (server side rendering) and are looking for secure ways to keep the users logged in for longer periods of time. AFAIK this can either be done using ...
2
votes
1answer
222 views

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection?

Can a client with an ECC certificate and a server with RSA certificate establish a mTLS connection? Can they agree on a cipher suite? Why?
1
vote
2answers
198 views

2FA authentication with QR code

Can someone confirm if the following solution is actually 2FA? User has to install a special mobile app. When the mobile app is opened for the first time, the user is asked to associate the device ...
0
votes
1answer
130 views

B2B authentication best practices

I'm in the process of developing a B2B (business-to-business) application. I've implemented JWT auth, and it is working as expected. Right now the authentication functions as if it were a B2C (...
0
votes
0answers
31 views

Secure authentication for sites which allow user to modify js/html

We have a site builder, allows users to add/modify JS/HTML/CSS. Is it possible to provide a global authentication for it? I mean users login once but can interact with all sites as their own names. ...
0
votes
0answers
35 views

Handling parallel login and Max invalid attempts using OTP with same phone number

I am designing a login system that performs login operation using OTP and Email ID of the registered user. The current approach is as below User enters the Registered Email Id If the Email ID is ...
0
votes
2answers
496 views

Why hasn't push notification authentication replaced SMS for 2FA?

So we use DUO for 2FA at work and it uses push notification authentication as the second factor for 2FA. It's so quick and easy! I enter my username and password, get a push notification on my phone, ...
1
vote
1answer
172 views

Can I use an ID token as proof of authentication?

I have a reverse proxy, configured as the Relying Party of an OpenID Connect identity provider. Then, it delegates the request processing to another web server, exposed on the internet. In order to ...

1
3 4
5
6 7
84