Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

425 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
581 views

Check if user is logged in on other ADFS authenticated site

I've been looking around for this specific situation, but so far no good.. We have multiple websites that use ADFS WSFederation, and we would like for a user to always pass through one, before being ...
2
votes
0answers
434 views

Token based authentication: Why invalidate the token after each request?

I use the gem devise_token_auth while developing an API for a mobile app. Authors claim that: Tokens should be invalidated after each request to the API. This behavior is enabled by default. Can ...
2
votes
0answers
156 views

How does Adobe Pass Auto-Authentication work?

At time marker 2:05 of this video, he describes that Adobe Pass can automatically identify you based on your broadband provider, and sign you in/authorize you for media content. Can anyone describe ...
2
votes
0answers
378 views

Security token in android and embedded system

I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app. The users are categorized into 3 groups: owner of the board. ...
2
votes
0answers
477 views

Astonishing Recent Belkin Router Auth Bypass Vulnerability: CSRF Used to Exploit?

I was visiting the CERT site main page today for another reason when I glanced at the list of recent vulnerability bulletins and came across some news I had somehow missed before today: a notice that ...
2
votes
0answers
753 views

SimpleWebRTC Server Side Authentication for Room Access

I am trying to do some sort of server side authentication to allow only specific clients to join a SimpleWebRTC Room. Right now, any client that goes to the SimpleWebRTC "demo" page can join the room....
2
votes
0answers
176 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
2
votes
0answers
581 views

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 (...
2
votes
0answers
613 views

HMAC authenticated API calls with multipart/form-data file uploads

We have an existing API where 3rd parties can push data. The API calls are authenticated with HMAC using the same scheme as described in Ruby's ApiAuth library which I use to verify signed requests. ...
2
votes
0answers
360 views

How does disabling sign in upon confirmation make devise any more secure?

Referencing reasons given in this question https://stackoverflow.com/questions/18655334/avoid-sign-in-after-confirmation-link-click-using-devise-gem Devise does not allow the immediate sign-in of ...
2
votes
0answers
1k views

NFS IP spoofing

I am using VirtualBox: where the guest is an Arch ISO and the host Windows/Cygwin or a generic Linux. For sharing host folders, VB native shared folders is not an option (since the setup requires ...
2
votes
0answers
424 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
2
votes
0answers
1k views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
0answers
476 views

Digital signature based authentication schema using two passwords

I'm working on an authentication system for a web based Bitcoin-related service. As part of the service, users do some less sensitive operations (mostly reading and sending various types of ...
2
votes
0answers
227 views

How to verify a message?

I have a 192 bit data string and a 384 bit signature calculated with curve ANSIp192r1 as well as the public key. These readings originate from a SYM2 electricity meter and I would like to ...
2
votes
0answers
137 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
2
votes
1answer
141 views

Secure CDN content for a multi-tenant application

We have a multi-tenanted application that has sensitive content behind a secure login. We'd like to host that content on a CDN but prevent unauthorised users from accessing it. What are the best ways ...
2
votes
1answer
125 views

How does the password protect the data keys on an encrypted HDD / SSD?

How is the data key used for full disk encryption protected? Is a wrapping key derived from the password, or is it simply unlocked once the password has been supplied? If an existing or proprietary ...
1
vote
0answers
58 views

How to implement a web login using a public/private key pair?

I am trying to create a web form, where the user can login without creating/entering a password. Assume the following pre-requisites are met: The user and server have pre-generated a public/private ...
1
vote
0answers
62 views

Secured data upload to Aircraft over ARINC 615A

We have a requirement for Data loading function to Aircraft. There is Avionics standard termed as ARINC 615A and ARINC 665. 615A specifies high speed Ethernet based data load operation; where POINT-TO-...
1
vote
0answers
47 views

Automating SAML login for service users?

Is it possible to fully automate the login of a service user (i.e. a programmatic, software based "user") without user interaction? I have a service provider that's SAML protected. Basic Auth and ...
1
vote
0answers
78 views

Are JWT still not recommended for sessions?

It seems there is a large divide as to wether or not you should have JWT or Session ID for managing user session on WebApp/API (for a web front end or/and a mobile app). It seems that the consensus ...
1
vote
0answers
37 views

How do I force a user to login again when using refresh tokens and their password changes

I am implementing my first service with authentication. So far I have a POC service that issues JWT tokens with an expiry of 1 minute. Users are forced to login again every minute which is not great. ...
1
vote
1answer
57 views

What are disadvantages of a reverse OTP flow, where OTP is visible on a website and is retyped on authenticated mobile client?

I want to authenticate a user on a 3rd party website (this is more or less an OAuth flow, so this website will be able to perform actions on behalf of my user afterwards, e.g. receive some of her data)...
1
vote
0answers
25 views

Detecting multiple active login sessions to AD with workstation/DC event logs

I'm using Splunk to try to detect multiple Windows login sessions by a single user, as an indicator of compromise. However, I'm not sure how to go about this - I can ingest workstation logs (events ...
1
vote
0answers
18 views

Is an “inversed” Device Authorization Grant flow secure for authenticating a daemon/service native app to a web server?

I am working on a hobby project which will involve a web server (hosted and owned by me) and a native app (which will communicate with the web server periodically) an end-user can install via a deb/...
1
vote
1answer
31 views

Where to store tokens for analysis team members

As part of their day-to-day work, each member of our analysis team must handle a variety of sensitive information. For example: username and passwords for our internal databases, and tokens for ...
1
vote
2answers
90 views

How to secure an email subscription endpoint?

I have a simple static webpage that lets users sign-up for a newsletter. Once they enter their email address, it gets sent to a public endpoint (AWS Lambda). This lambda function forwards the email ...
1
vote
0answers
64 views

Does this two-token scheme work?

Security noob here. I've been trying to figure out how to secure my web app from both CSRF and XSS. It's a single-page app that talks to a JSON API on the server side. I'm trying not to do a roll-...
1
vote
1answer
67 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
1
vote
1answer
60 views

Validating JWT in server-to-auth-server scenario

The main question here is: If you are using a backend server to authenticate a user with a third party provider such as Auth0, do you need to validate the JWT received in this scenario? I am looking ...
1
vote
1answer
82 views

SSO SP Initiated Single Sign Out - User Experience

I work on a software product that allows customers to use SAML or OAuth provisioning to their users. e.g to Azure AD. Now non technical savvy users understandably presume that logging off from our ...
1
vote
1answer
74 views

I am signing (HMAC) outgoing webhooks to allow users to verify their source, should I also sign outgoing responses?

To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack: Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to ...
1
vote
0answers
60 views

Circumventing authentication by relative path in flask

I'm working on a flask application which requires some authentication but not on every endpoint. I use this piece of code to exclude certain endpoints from my authentication handler. if request.path ...
1
vote
0answers
56 views

Is a VPN + Firewall + Authorization Redundant?

I am creating a simple application so a distributed team can access sensitive data. This application will have a database that will be inaccessible to the public internet inside a VPC with my cloud ...
1
vote
0answers
38 views

OpenID Authentication Method Reference Name for a code sent via email

Introduction: I am currently implementing acr_values, acr & amr principles on a Open ID Provider server. The claim amr (described in the OpenID RFC 1.0) has no standard clearly defined in this ...
1
vote
0answers
55 views

Advantages of EAP Authenticator in EAP protocol

What is the purpose of using a EAP authenticator in the EAP protocol ? Since underhood, the authentication procedure is between the EAP peer and the authentication server, what is the advantages of ...
1
vote
0answers
43 views

What does jarsigner verify in the first place (integrity or authenticity)?

I was reading sth about android code signing and have run into this statement: The second jarsigner command at v in Listing 3-7 first verifies the signature block and signing certificate, ...
1
vote
0answers
52 views

Security of the native Password Autofill function in iOS 12

I have read Apple documents on the iOS 12 password autofill function for iPhones. But I could not find much information pertaining to where the passwords are stored and what vulnerabilities might ...
1
vote
2answers
124 views

Is it common for malwares to use public-key cryptography to authenticate their C2 commmunications?

I'm sure there are instances of this, but I ask it because malwares are often so makeshift that I could definitely see their authors purposely using weaker forms of authentication to perform ...
1
vote
0answers
31 views

The benefit of JWT refresh token if authorization and resource server are merged?

Is there any benefit in using refresh tokens if your auth and resource server are combined? I understand the benefit when they are separate: The refresh token is never sent to the resource server, ...
1
vote
0answers
44 views

JWT scheme with different signing algorithms

I'm planning to implement a (slightly non-standard?) JWT authentication scheme with refresh and access tokens, in which refresh and access tokens use different signing algorithms: refresh token uses ...
1
vote
1answer
79 views

Authenticate Static Public Keys

How can a static ECC public key be authenticated when being shared between the client (who has just created the static ECC public key) and the CA (Certification Authority) - who will sign and send the ...
1
vote
0answers
60 views

Is there any advantage in using Google's IAM on Android?

We are building a few corporate apps for field workers / front office. In most cases each user will have their own device, but there are some shared devices (for example reception). The devices are ...
1
vote
2answers
130 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
1
vote
0answers
101 views

Implementing an anonymous, password-less login model

I would like to implement a password-less login for a mobile application (discussion board/social media). The data contains non-critical social media content (usernames, posts, replies, photos). The ...
1
vote
0answers
62 views

Configure Burp to pass dynamic authentication token from the past response to the next request in intruder

I would like to reuse an authentication token (which is dynamic) between a response and a request in Burp Suite intruder. By dynamic I mean that the token is invalidated after being sent to the ...
1
vote
0answers
78 views

Designing distributed authentication/authorisation system

I'm trying to design a system that has the following elements: the main backend REST API (currently one, probably multiple in the future) front-channel client(s) -- JS-based single-page app(s) back-...
1
vote
0answers
82 views

Reason for iOS and Android fingerprint behaviour

Both iOS and Android allow using a fingerprint sensor for logging in, and allow applications to store secrets that can only be unlocked using the fingerprint. Both allow one or more fingerprints to be ...
1
vote
2answers
259 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...

1 2
3
4 5
9