Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

438 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
1
vote
0answers
80 views

Securing pattern for tool for customer frontend

As a beginner in developing web APIs and other web technologies I'm wondering what could be the best approach for securing a tool in a customer's frontend. Let's say I'm offering a tool that can be ...
1
vote
0answers
35 views

GPG RSA Authenticity Mechanism Minimum Requirement

The GPG/PGP based RSA authenticity signing mechanism is based on 3 parts to ensure authenticity: the public key the signature the fingerprint of the public key Assuming that the author keeps his ...
1
vote
0answers
62 views

What current methods are there to gain access to Azure?

I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance. So far I haven't found much in the way ...
1
vote
0answers
394 views

Micro Service - Outh2 Workflow with a SPA, Facebook Login and JWT

Introduction We are currently trying to figure out a way to implement token based authentication and authorisation with Facebook Connect combined with maybe JWT within the micro service architecture. ...
1
vote
0answers
632 views

Is it safe to implement JWT auth with cookies, token versioning, and no refresh tokens?

I have some questions about my implementation of bearer token security (JWT to be specific) in an asp.net core 2.0 project that I'm working on. The bearer token is used when the frontend web app talks ...
1
vote
0answers
108 views

How do Google, Microsoft and Yahoo mask or hash passwords on the client side?

I'm making recommendations to improve our user authentication (login). Our approach thus far is to ensure we (and libraries we use) are following all of the the OWASP guidelines. I have also been ...
1
vote
1answer
315 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
1
vote
0answers
70 views

Mutual auth client certs for a pool of requesting servers behind a proxy

I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our ...
1
vote
0answers
57 views

Can we send a forms auth token back from an HMAC API?

We have an ASP.NET MVC application used by people from other organisations. Some of the features are accessible via a forms login. Other features are accessible as SHA256-HMAC-authenticated API ...
1
vote
0answers
495 views

Developping an authentication system between client, server, and CouchDB database

I'm creating a self hosted application which relies on CouchDB to store its data. The client (react) might access the database, which is proxied by the express server to myapp.com/database. The server ...
1
vote
0answers
111 views

No fields captured in BurpSuite

I am using burpsuite to bruteforce my routers login form, but I have encountered an issue... When I enter something into the password field, BurpSuite shows the request, but not what was entered. For ...
1
vote
0answers
567 views

SSO - Client Certificate vs SAML

For me SSO is sign on where one need not type the password explicitly. I see one of the possible way to achieve it is by using Certificates loaded in browser. SAML/OAuth delegates the job of ...
1
vote
0answers
61 views

Is this system of tracking users via Wi-Fi secure?

I am trying to make an app which will be used to track the presence of the users in a location, using the Wi-Fi hotspot of the location. The purpose is to know which user was at the location for how ...
1
vote
0answers
64 views

Are there vulnerabilities/advantages associated with a VPN service that uses only an account number, no password for authentication

The VPN service mullvad has an interesting (let's call it that) form of authentication, namely that all you receive is an account number, which you can pay for to receive a certain amount of time to ...
1
vote
0answers
53 views

Can malicious app read private variable from my App?

I have a local object "Login" (with a password and id) in my activity and I would like to know if I launch a fragment and use a setter to initialized the fragment, is it secured ? Can a malicious app ...
1
vote
0answers
62 views

Secure upload/download design with malicious storage server

Assume we have a malicious storage server (a user-agnostic key-value store, supporting server.put(key, value) and server.get(key)) that we want to use for per-user based secure file storage. The two ...
1
vote
0answers
44 views

How to submit scores securely from app that uses only Facebook login?

Our android app only has Facebook login. Here's what happens on the server: A user is created when a POST request is sent using Facebook's user access token in the body. Whenever a user gets created ...
1
vote
0answers
220 views

JWT refresh flow generally secure?

I will be using JWT for authentication for my REST API. I am using third party cloud services and database write are very expensive so I am trying to avoid writing to the database as much as I can. ...
1
vote
0answers
3k views

Secure a page in iFrame from being used outside

In a secured area of a partner site we would like to embed an iFrame. The partner will generate a hash (accessToken) that will form a part of iFrame's src, e.g. <iframe src="our-domain.com?hash={...
1
vote
0answers
36 views

A query with message block and gray code in LightMAC

In lightMAC the message is divided in to M[1] M[2] and so on eg: M[1]M[2]···M[l] ←− M If we consider AES block cipher 128-bit then I am wondering is the size of individual message block is 128-bit ...
1
vote
0answers
332 views

How to cache auth credentials to speed up authentication

I'm developing some REST API that requires a HTTP basic auth to access. The APIs are written in Django, and the auth is based on Django auth middleware that is: it checks against the DB, the username ...
1
vote
0answers
47 views

Is it possible to integrate 302 based auth with 401 based auth?

I'm looking at securing endpoints with a technique similar to HAWK which returns a 401 authentication with OAuth which uses 302 based redirection How can I combine two different authentication ...
1
vote
0answers
119 views

How can I audit the modules and stage markers in OWIN's authentication pipeline?

ASP.NET's OWIN (in MVC4 and Katana) allows for various objects to be added to the HTTP processing pipeline. I want to ensure that there are no rogue Nuget packages no hard to find partial classes ...
1
vote
0answers
706 views

Is it enough to check the Audience of OAuth2 Access tokens?

I am investigating using Social Login for a web service fronted by Web-based portals and Mobile applications. The idea is to "Authenticate" the user and let the service create an "API-Key" once the ...
1
vote
0answers
237 views

Logout from IdP, where should user end up?

When a user clicks Logoff on my website, it executes the following .NET code: public ActionResult SLOService() { // Receive the single logout request or response. // If a request is received ...
1
vote
0answers
325 views

What is the difference in implementation between HybridAuth and OpenID Connect?

I am installing a CMS login that is shared between two organizations, one a blog for community designed for ease of login and the other is a staff PHP application for a related nonprofit, to keep ...
1
vote
0answers
103 views

Finding Vuln in linux login console

I'm trying to find vulnerability on an appliance based on Ubuntu 12.0.4 and this is about console (COM port) section now. my findings: The password field is sensitive to large string. for example if ...
1
vote
0answers
183 views

Git Server with several repos

I'm not sure if I'm allowed to post and have one of my newly asked question on both security.stackexchange and unix.stackexchange or not, but I think it is appropriate to ask the question here too ...
1
vote
0answers
409 views

Same value of WSS_KeepSessionAuthenticated cookie for different users after login

There is an application that uses NTLM authentication. After you enter your credentials, you get three cookies. I logged in with three different browsers(IE, chrome and mozilla) and as three different ...
1
vote
0answers
73 views

Credential transport for networked game

I'm developing a networked game, and this game will require players to authenticate to the server. The both client and server are written in Java. I'm trying to find an efficient password transmission ...
1
vote
0answers
153 views

In kerberos will a key for a host prinicpal work if the keytab containing the key is stored somewhere inaccessible to that host?

I'm following the instructions here: https://www.freeipa.org/page/Windows_authentication_against_FreeIPA to try to allow a Windows machine to authenticate logins against a FreeIPA server on RHEL. I'...
1
vote
0answers
53 views

Should a unique CRA password salt travel the wire?

In an authentication method I am using an auth-framework which runs an implementation of CRA which forwards salt (with key length / iterations), challenge to the client. With this information the ...
1
vote
0answers
19 views

Do any visual editors exist for claims-based access control, with several parallel evaluators?

This MSDN video at marker 14:20, describes a scenario where an employee can access a building if They are a valid badge carrying FTE They are in possession of a "sticker of shame", temporary badge ...
1
vote
0answers
1k views

OAuth 2.0 with webhooks

I am implementing an OAuth2-like flow using webhooks between two webservices (no browser/user-agent involved). The authentication server will grant access based on the URL of the webhook to which the ...
1
vote
0answers
552 views

DMZ with Reverse Proxy for both Web and Email servers

I have both a web server and email server, instead of placing these two "public" servers in the DMZ, instead In the DMZ I was going to place a Reverse Proxy. for the Web Server: Firewall accepts port ...
1
vote
0answers
22 views

Account Connected Devices ignoring Credential changes

Hello People of Security, one of my accounts got attacked, so they(Provider) did expire my password. I'm currently not able to log into my account. So when I started an older PC of mine, I was still ...
1
vote
0answers
33 views

How to enumerate smartcard logon attempts in Windows?

I need to provide my users with feedback when they log on at their workstations. This feedback needs to include: Date/time and workstation id of last successful login Number of unsuccessful login ...
1
vote
0answers
46 views

Why do I need to redirect in order to send the external OAuth2 authentication token to the client?

In an OAuth2 scenario: user confirmed his identity, allows the app to access his details server got the external access token I intend to respond directly with a local access token as opposed to ...
1
vote
0answers
480 views

Mifare cards authentication

I have few questions about Mifare authentication: 1) Can you confirm me that the authentication between the reader and the tag is as follow: the reader send the correct key to the tag for the sector ...
1
vote
0answers
34 views

How strong is the state-of-the-art in real-world “implicit authentication” systems?

Years ago, I read a paper about how mobile devices made it possible to authenticate users without entering a password, simply by relying on behavior, habits, locations. Now, the DoD plans to use such ...
1
vote
0answers
204 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
1
vote
0answers
215 views

Dynamic Key Management in WPA through Radius server

Can anybody tell me in detail (or provide good links), how the dynamic key management is done by the authentication server in WPA? In other words, let's say I gave my credentials to the authentication ...
1
vote
0answers
289 views

Clarification of RSA Key Exchange (TLS 1.2) and AES for On-Going Message Excahnge

I'm trying to understand the full flow of key exchanges for secure communications. As a potentially incorrect premise, I am under the impression that RSA is a good asymmetric technique for ...
1
vote
0answers
373 views

Inserting XSRF header token in Hydra

I'm trying to break a login form with Hydra. The site is built with the Angular framework, and an XSRF token must be sent through the header and through the POST request. I notice that the XSRF ...
1
vote
0answers
83 views

Securing device communication with API back-end with no user interaction

We have remote devices programmed in Python that talk to our back-end to update our database with information gathered from sensors connected to our remote devices. The remote devices are not ...
1
vote
0answers
112 views

Migration problem between different machines using TrouSerS TPM library

My question coincides with the question posted by Maximiliano Ezequiel. Below is a question. I could make migration process work in one single machine. I can: Export SRK public key. ...
1
vote
0answers
201 views

Security flaws while storing auto-login token

I must to accomplish auto-login with a token on my website. Token is generated on back-end, on front-end (Single-Page Application) I have to store token in secure way. I'm using secured channels (...
1
vote
0answers
580 views

HMAC Token - Check Logic

I have a situation where I need a token that provides authentication. The common HMAC procedure I found is: Get Some key using login credentials Create Message, append key and other message data (...
1
vote
0answers
84 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
1
vote
0answers
231 views

Renewing certificates in web services using mutual (2-way) authentication

I have a web service (let's call it Service X) which multiple other web services (clients) depend on. Communication between the Service X and any of the clients is done via mutual authentication (2-...

1
3 4
5
6 7
9