Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

Filter by
Sorted by
Tagged with
12 votes
2 answers
2k views

Any plans/research for SSL-like method in telephony?

I have recently read about attacks using Caller ID spoofing technology. Criminals used it to impersonate bank or police employees and asked to install malware or transfer money to a given account. A ...
user avatar
  • 233
1 vote
1 answer
273 views

Security of email OTP authentication

I'm building my own authentication and deciding on the signup/login flow. I'm would like some security feedback on this type of flow: User submits email address. 6 character alphanumeric one-time-...
user avatar
  • 11
0 votes
0 answers
83 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
user avatar
-1 votes
1 answer
154 views

What are the security implications of the password policy for this bank? [duplicate]

I am aware of a bank (redacted for obvious reasons) that has the following password policy. Only English alphanumeric characters Min of 8, max of 14 characters No special characters (ex. !@#$%^&* ...
user avatar
1 vote
1 answer
156 views

"Trusting" the Host header in a port-forwarding environment

A similar question has be answered here already, but I have a very specific scenario in which it didn't fulfil my requirements. I am setting up an environment which includes a web-service running on ...
user avatar
  • 296
0 votes
1 answer
465 views

I have been hacked on Facebook multiple times today alone. What do I do?

My Facebook account has had its password changed four times today, and I'm wondering what to do. The first time, was at 5:02pm. I received an email saying that my password had been changed. I recently ...
user avatar
0 votes
1 answer
149 views

How exactly does the detection of a cloned FIDO2 credential work?

I am trying to understand the FIDO2 standard. I know that a Relying Party has to implement a mechanism that checks the counter of the respective credentials. Most of the time, a counter is stored in ...
user avatar
  • 3
0 votes
0 answers
73 views

How can I secure an API used for app secret keys without using CORS, created using AWS API gateway?

I am using an API , made using an AWS service named API Gateway [Which may not be of great importance]. I have gone through various articles mentioning that rather than storing secret keys directly on ...
user avatar
0 votes
1 answer
109 views

Security for website admin panel [closed]

I am creating an admin panel for my website. I am coding the entire website by myself. What are some essential security features that I should implement so that only I can access the admin panel and ...
user avatar
  • 101
1 vote
0 answers
99 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
user avatar
  • 111
0 votes
0 answers
77 views

Setting secret at factory to be used in Bluetooth pairing authentication

Setup: We have 2 kinds of Bluetooth devices. Device Type A is connected to power with ethernet capability and will be used as initiator for BT connections. Device Type B is mobile, battery powered (...
user avatar
  • 101
2 votes
1 answer
102 views

Are the authentication factors considered to be of the same strength?

Are the authentication strength of the different authentication factor categories (knowledge-factors, posession-factors and inherence-factors) ranked in any way, like "inheritance-factors are ...
user avatar
  • 697
1 vote
0 answers
102 views

Decoupled authentication flow, very vulnerable to Man in the Middle attacks?

I'm in the process of building a kinda odd mechanism to "bypass" authentication. Which of course I know its weird, but many business requirements are weird... So it is a design that derives ...
user avatar
  • 111
0 votes
1 answer
110 views

Using SSO, does this count as only one authentication factor?

When using Google SSO, does this count as only one factor of authentication or as many factors as I use for my google account? If it counts as a single factor, would this be "something I have&...
user avatar
  • 697
1 vote
0 answers
37 views

Do I need TFA if I have a strong password? [duplicate]

This is the inverse of this question here. Google keeps prompting me to enable Two-Factor Authentication for my Google account. I don't like the inconvenience of TFA, such as mandating that I will ...
user avatar
29 votes
9 answers
6k views

When does 'something you have' NOT become 'something you know'?

I am currently trying to get an understanding of multi factor authentication. The biggest issue so far: When does "something you have" NOT get reduced to "something you know"? I ...
user avatar
  • 697
0 votes
0 answers
71 views

Does a previously logged-in device count as an authentication factor?

Is a device I used previously an a website an additional authentication factor? I would imagine yes, but the device somehow has to send something to the server to prove that it was previously logged ...
user avatar
  • 697
1 vote
2 answers
278 views

Is there any way to guarantee real user registration?

I would like to provide some free tokens to users on registration, I don't want bot accounts to register and get free tokens. Is there any way to prevent this? I would like to use phone verification, ...
user avatar
1 vote
1 answer
115 views

Whose fault/bug is it in the below case?

Say there are 2 servers a.example and b.example. b.example uses 3rd party authentication from a.example via OAuth or other protocols. Now a user user1 with account xyz@a.example logs in and sets up a ...
user avatar
0 votes
1 answer
105 views

What is different between SVO logic versus BAN logic?

While reading about authentication protocols, I saw on Wikipedia on Burrows-Abadi-Needham logic: In some cases a protocol was reasoned as secure by the BAN analysis but were in fact insecure.[3] This ...
user avatar
1 vote
1 answer
123 views

Trying to determine if our application login constitutes 2FA

Our organization uses a Voip "push to talk" type app on Android and IOS devices. The application connects to a server on premises through the internet. To use the app, the user is assigned ...
user avatar
  • 113
3 votes
0 answers
336 views

How does local pass-the-hash (mimikatz's sekurlsa::pth) work?

Mimikatz's sekurlsa::pth documentation states: mimikatz can perform the well-known operation 'Pass-The-Hash' to run a process under another credentials with NTLM hash of the user's password, instead ...
user avatar
  • 95
0 votes
1 answer
137 views

Combining confidentiality, authenticity and data integrity to form secure URL

There are clients (mobile application), they can share links to their profile info, which should be confidential. The link expires in 5 minutes (configured). They set Auth-Code so that the one who ...
user avatar
  • 147
0 votes
1 answer
472 views

Why some payment methods allow being embedded in an iframe and some don't?

Let's take some examples: Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame ...
user avatar
1 vote
0 answers
99 views

Is Google OAuth login in 3rd party applications via system browser secure?

Numerous mobile applications allow me to "Login with Google". From technical perspective, I assume this would usually follow those OAuth native app login integration guidelines: https://...
user avatar
0 votes
1 answer
223 views

Creating Client certificate for mutual TLS authentication

I have an application that is installed at customer premises. This sometimes has to communicates with their server(PACS server), and the details are configured in our application. I have to enable TLS ...
user avatar
1 vote
1 answer
98 views

How does the supplicant connect to the auth server in EAP TTLS?

I understand that a tls has to be established between the supplicant (end user device) and the auth server but a few things are unclear : How does the supplicant know the ip adress of the auth server ...
user avatar
  • 29
2 votes
0 answers
276 views

Alternatives to OAuth 2 for first-party native applications

I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
user avatar
43 votes
2 answers
6k views

Why don't car keys use algorithms like RFC 4226?

I've been reading a bit into car security and all of the ways cars can be stolen through various alterations of replay attacks. Upon researching whether any of the more modern cars are using anything ...
user avatar
2 votes
1 answer
187 views

ePassport Chip Authentication - how to verify?

I want to implement Chip Authentication for ePassport documents, and wish to validate my understanding of it. I've managed to get it up and running by using the JMRTD library, specifically the ...
user avatar
  • 185
0 votes
2 answers
140 views

Could blockchain be useful for a protocol to verify content from a trusted publisher in the way I'm thinking of? [closed]

The problem with static software whitelisting is that in the real world, employees with versatile jobs need to run unexpected programs. Company sets up a whitelist to limit what programs can run - ...
user avatar
  • 1,300
0 votes
1 answer
108 views

How to force web sites and services to stop resetting passwords of accounts without user's permission and prompt? [closed]

A new trend in account security is spreading: web services like LinkedIn reset passwords automatically when detect attempts of getting access with wrong password or from new locations. Thus, a user ...
user avatar
1 vote
1 answer
92 views

Security risks of the following authentication flow

Let's say Party A has many customers (one of them let's call it Customer X) with data in Party A. Party A is allowing Customer X to get data from their API. In order to do that: Customer X downloads ...
user avatar
2 votes
2 answers
178 views

Digital Signature verification Automate vs Manual

Digital Signature verification process for software installation can be done automatically during execution or manually by user. (I'm considering PKI Method of certification.) For example, in case of ...
user avatar
  • 725
-3 votes
2 answers
173 views

Number of biometric samples required to form an exhaustive set of fingerprint hashes?

Number of biometric samples required to form an exhaustive set of fingerprint hashes? Slight variations in the sample produce different hash values of the sample data. The answer linked below ...
user avatar
  • 93
5 votes
4 answers
468 views

Is a "magic link" a kind of authentication?

From what am I reading, magic links require users to provide their email and the user will be sent an email with the link to sign-in, and the users can use this link to log into the system. Can this ...
user avatar
  • 51
1 vote
0 answers
82 views

What is Threat Profile is Microsoft addressing with the MSAL URI format?

Applications built for MSAL 1.0 and MSAL 2.0 have a default application URI of MSAL://GUIDHere/AppName This is in contrast with what other IDP's are doing. Can anyone explain the benefits or drawbacks ...
user avatar
1 vote
1 answer
178 views

RSA vs ECC certificate for IoT device client side certificate authentication

I am using client-side certificate authentication (mutual authentication) in my IoT prototype. we acquire client side certificates using embedded PKI through a CA. There are the provisions of ...
user avatar
0 votes
2 answers
159 views

Can cookies with a complicated secret be manipulated?

Im currently working on a personal full stack application using cookies with the express-session middleware. Theyre secured with some sort of secret. Im not really too sure how that works but I think ...
user avatar
1 vote
0 answers
120 views

Web authentication, replay, nonce and KEK

I am trying to figure out how to build a secure, playback-proof, web authentication scheme and at the same time be able to use a KEK at the server. After a lot of reading it seems that a reasonable ...
user avatar
0 votes
0 answers
68 views

Multiple user specific APIs with a single Authentication Server

I’m currently in need of some clarification for an authentication/overall strategy. First I will describe the use case and then the questions that arise for me. Use Case I want to have a single docker ...
user avatar
  • 1
0 votes
1 answer
69 views

Creating a separate privileged (admin) user account for authenticated VA scans

When reading many sources on performing authenticated vulnerability scans, it has been mentioned that creating and using a separate admin (privileged) user account for scans is recommended rather than ...
user avatar
0 votes
1 answer
124 views

Identifying unique visitor using only info that can be gathered through the browser?

There is a site that allows a voter to vote for their favorite nominee once a day for a certain amount of days. While entering a vote, the only info given is the ballot choice you choose and nothing ...
user avatar
  • 1
0 votes
2 answers
770 views

Does sending hashed password over url path parameter secure?

I need to create WebSocket authentication mechanism without using ticketing, so the whole authentication needs to be performed via HTTP (over SSL) GET request which is sent to upgrade connection to ...
user avatar
  • 103
0 votes
1 answer
136 views

WPA2 Enterprise Authentication Certificate Security

While reading up about WPA2-Enterprise, it states that it is more preferred over WPA2-Personal as it allows authentication via digital certificates which prevents over-the-air attacks. However, I am ...
user avatar
1 vote
1 answer
267 views

Why does message 1 of the WPA2 4 way handshake begin with the access point sending a random number?

All the references I have found https://en.wikipedia.org/wiki/IEEE_802.11i-2004 https://www.wifi-professionals.com/2019/01/4-way-handshake https://www.hitchhikersguidetolearning.com/2017/09/17/eapol-4-...
user avatar
0 votes
0 answers
33 views

Validate that CA really signed certificate [duplicate]

What is the process of validating that a ssl certificate I try to validate is really signed by CA I trust? What is the part of the certificate (The one I try to validate) is the one cant be faked? ...
user avatar
3 votes
0 answers
224 views

Should I build my own login functionality? [closed]

I've looked at various ways of logging in users and I'm wondering if I should write my own. There are a lot of third party solutions that make it easy and cheap to get started, like Amazon Cognito and ...
user avatar
4 votes
2 answers
614 views

Sending OTP before authentication / password verification

One of my old, rarely used computers had still an old password for my pyszne.pl / takeaway.com account stored in my browser's password manager. I tried to log into my account from that computer and ...
user avatar
  • 3,299
1 vote
1 answer
151 views

Can Google authenticator be used to link all my accounts together?

For example, if I add two accounts from different non-Google services, can Google (or maybe those services) because of that link them both together with my gmail account?
user avatar
  • 13

1
3 4
5
6 7
87