Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

424 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
110 views

No fields captured in BurpSuite

I am using burpsuite to bruteforce my routers login form, but I have encountered an issue... When I enter something into the password field, BurpSuite shows the request, but not what was entered. For ...
1
vote
0answers
566 views

SSO - Client Certificate vs SAML

For me SSO is sign on where one need not type the password explicitly. I see one of the possible way to achieve it is by using Certificates loaded in browser. SAML/OAuth delegates the job of ...
1
vote
0answers
61 views

Is this system of tracking users via Wi-Fi secure?

I am trying to make an app which will be used to track the presence of the users in a location, using the Wi-Fi hotspot of the location. The purpose is to know which user was at the location for how ...
1
vote
0answers
61 views

Are there vulnerabilities/advantages associated with a VPN service that uses only an account number, no password for authentication

The VPN service mullvad has an interesting (let's call it that) form of authentication, namely that all you receive is an account number, which you can pay for to receive a certain amount of time to ...
1
vote
0answers
53 views

Can malicious app read private variable from my App?

I have a local object "Login" (with a password and id) in my activity and I would like to know if I launch a fragment and use a setter to initialized the fragment, is it secured ? Can a malicious app ...
1
vote
0answers
61 views

Secure upload/download design with malicious storage server

Assume we have a malicious storage server (a user-agnostic key-value store, supporting server.put(key, value) and server.get(key)) that we want to use for per-user based secure file storage. The two ...
1
vote
0answers
43 views

How to submit scores securely from app that uses only Facebook login?

Our android app only has Facebook login. Here's what happens on the server: A user is created when a POST request is sent using Facebook's user access token in the body. Whenever a user gets created ...
1
vote
0answers
219 views

JWT refresh flow generally secure?

I will be using JWT for authentication for my REST API. I am using third party cloud services and database write are very expensive so I am trying to avoid writing to the database as much as I can. ...
1
vote
0answers
3k views

Secure a page in iFrame from being used outside

In a secured area of a partner site we would like to embed an iFrame. The partner will generate a hash (accessToken) that will form a part of iFrame's src, e.g. <iframe src="our-domain.com?hash={...
1
vote
0answers
36 views

A query with message block and gray code in LightMAC

In lightMAC the message is divided in to M[1] M[2] and so on eg: M[1]M[2]···M[l] ←− M If we consider AES block cipher 128-bit then I am wondering is the size of individual message block is 128-bit ...
1
vote
0answers
323 views

How to cache auth credentials to speed up authentication

I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username ...
1
vote
0answers
46 views

Is it possible to integrate 302 based auth with 401 based auth?

I'm looking at securing endpoints with a technique similar to HAWK which returns a 401 authentication with OAuth which uses 302 based redirection How can I combine two different authentication ...
1
vote
0answers
116 views

How can I audit the modules and stage markers in OWIN's authentication pipeline?

ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline. I want to ensure that there are no rogue Nuget packages no hard to find partial classes ...
1
vote
0answers
33 views

Trying to locate a photo transfer that was done on my macbook

Is there a way to view file transfers for photos that may have gone off my macbook by the file sharing being open? or by way of a usb save? I had private photos stolen by a "friend" while using their ...
1
vote
0answers
697 views

Is it enough to check the Audience of OAuth2 Access tokens?

I am investigating using Social Login for a web service fronted by Web-based portals and Mobile applications. The idea is to "Authenticate" the user and let the service create an "API-Key" once the ...
1
vote
0answers
233 views

Logout from IdP, where should user end up?

When a user clicks Logoff on my website, it executes the following .NET code: public ActionResult SLOService() { // Receive the single logout request or response. // If a request is received ...
1
vote
0answers
309 views

What is the difference in implementation between HybridAuth and OpenID Connect?

I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
1
vote
0answers
101 views

Finding Vuln in linux login console

I'm trying to find vulnerability on an appliance based on Ubuntu 12.0.4 and this is about console (COM port) section now. my findings: The password field is sensitive to large string. for example if ...
1
vote
0answers
388 views

Same value of WSS_KeepSessionAuthenticated cookie for different users after login

There is an application that uses NTLM authentication. After you enter your credentials, you get three cookies. I logged in with three different browsers(IE, chrome and mozilla) and as three different ...
1
vote
0answers
73 views

Credential transport for networked game

I'm developing a networked game, and this game will require players to authenticate to the server. The both client and server are written in Java. I'm trying to find an efficient password transmission ...
1
vote
0answers
151 views

In kerberos will a key for a host prinicpal work if the keytab containing the key is stored somewhere inaccessible to that host?

I'm following the instructions here: https://www.freeipa.org/page/Windows_authentication_against_FreeIPA to try to allow a Windows machine to authenticate logins against a FreeIPA server on RHEL. I'...
1
vote
0answers
35 views

Should a unique CRA password salt travel the wire?

In an authentication method I am using an auth-framework which runs an implementation of CRA which forwards salt (with key length / iterations), challenge to the client. With this information the ...
1
vote
0answers
19 views

Do any visual editors exist for claims-based access control, with several parallel evaluators?

This MSDN video at marker 14:20, describes a scenario where an employee can access a building if They are a valid badge carrying FTE They are in possession of a "sticker of shame", temporary badge ...
1
vote
0answers
1k views

OAuth 2.0 with webhooks

I am implementing an OAuth2-like flow using webhooks between two webservices (no browser/user-agent involved). The authentication server will grant access based on the URL of the webhook to which the ...
1
vote
0answers
550 views

DMZ with Reverse Proxy for both Web and Email servers

I have both a web server and email server, instead of placing these two "public" servers in the DMZ, instead In the DMZ I was going to place a Reverse Proxy. for the Web Server: Firewall accepts port ...
1
vote
0answers
22 views

Account Connected Devices ignoring Credential changes

Hello People of Security, one of my accounts got attacked, so they(Provider) did expire my password. I'm currently not able to log into my account. So when I started an older PC of mine, I was still ...
1
vote
0answers
32 views

How to enumerate smartcard logon attempts in Windows?

I need to provide my users with feedback when they log on at their workstations. This feedback needs to include: Date/time and workstation id of last successful login Number of unsuccessful login ...
1
vote
0answers
45 views

Why do I need to redirect in order to send the external OAuth2 authentication token to the client?

In an OAuth2 scenario: user confirmed his identity, allows the app to access his details server got the external access token I intend to respond directly with a local access token as opposed to ...
1
vote
0answers
477 views

Mifare cards authentication

I have few questions about Mifare authentication: 1) Can you confirm me that the authentication between the reader and the tag is as follow: the reader send the correct key to the tag for the sector ...
1
vote
0answers
33 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
1
vote
0answers
204 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
1
vote
0answers
210 views

Dynamic Key Management in WPA through Radius server

Can anybody tell me in detail (or provide good links), how the dynamic key management is done by the authentication server in WPA? In other words, let's say I gave my credentials to the authentication ...
1
vote
0answers
282 views

Clarification of RSA Key Exchange (TLS 1.2) and AES for On-Going Message Excahnge

I'm trying to understand the full flow of key exchanges for secure communications. As a potentially incorrect premise, I am under the impression that RSA is a good asymmetric technique for ...
1
vote
0answers
366 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
1
vote
0answers
82 views

Securing device communication with API back-end with no user interaction

We have remote devices programmed in Python that talk to our back-end to update our database with information gathered from sensors connected to our remote devices. The remote devices are not ...
1
vote
0answers
110 views

Migration problem between different machines using TrouSerS TPM library

My question coincides with the question posted by Maximiliano Ezequiel. Below is a question. I could make migration process work in one single machine. I can: Export SRK public key. ...
1
vote
0answers
200 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels (...
1
vote
0answers
577 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
1
vote
0answers
84 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
1
vote
0answers
205 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication (2-...
1
vote
0answers
81 views

fakeauthentication is working when my belkin belkin router f7d2301 mac-address filtering enabled

Actually i have enabled mac-filtering in my belkin router and the security policy is none and the authentication is open authentication. Iam(attacker) using kali linux. when i done a fakeauth attack ...
1
vote
0answers
2k views

Peer Entity Authentication and Data Origin Authentication services in OSI layers

What kind of Peer Entity Authentication and Data Origin Authentication services are provided in network layer(L3), Transport layer(L4) and application layer(L7) ?
1
vote
0answers
52 views

Authenticating requests across a two tier application architecture

Consider the following architecture: Users log into a website and issue commands to the website. In parallel, separate software processes ("agents") on different computers connect to the website ...
1
vote
0answers
107 views

Domain authenticated video links, prevent video link sharing

I'm running WordPress and I have s2member pro plugin. I have videos that I'd like any body to watch on my website and only on my website, I realize that they could record or capture the screen, it ...
1
vote
0answers
54 views

Persona combined with stateless token authentication

My REST-Backend is using Mozilla Persona to authenticate users. Normally you would just use cookies to authenticate any further requests but I want to use token based authentication (out of personal ...
1
vote
0answers
220 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
1
vote
0answers
100 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : 'v2....
1
vote
0answers
154 views

Time Based Authentication

I need a way of authenticating that a file was generated by a particular machine that has a unique ID and a unique random secret also known to the authenticator, as an added difficulty the file ...
1
vote
0answers
468 views

JWT for User Authentication + Client App Authentication + User Claims Holder?

I would like to switch the security layer of my API from Basic Auth over HTTPS + claims-based infrastructure (w/ claims populated in a delegatinghandler) to a more robust mechanism and support client ...
1
vote
0answers
910 views

Oauth authentication without state parameter

I have some security concerns about the first step of account authentication in my application. The authentication goes through an OpenID provider. If the response of such provider shows that the ...

1
3 4
5
6 7
9