The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [authentication]

the process of establishing the authenticity of a person or other entity. Not to be confused with authorization - defining access rights to resources.

353 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
0
votes
0answers
102 views

Customer asking for a sign out that does not really sign out to obscure that the user is not signed out

I have a customer running my application with SAML SSO. This solution supports SLO (single logout). Due to their environment, a logout does not always sign the user out of the SAML IdP. This results ...
0
votes
1answer
345 views

Why is it recommended to use GCP service accounts vs user accounts?

I've recently started some work on Google Cloud Platform (GCP) and while developing the auth strategy for my company, I've repeatedly come across the recommendation to use service accounts for ...
0
votes
0answers
21 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
0answers
135 views

Are there alternatives to SASL?

Are there any alternatives to SASL? Is there another standard authentication framework that abstracts the authentication mechanism from the protocol in the way that SASL does? To be more specific ...
0
votes
1answer
64 views

SIEM: Correlating remote logons to associate origin and target user

How is it possible to correlate or detect user logons eg via ssh/rdp to associate the origin user and target user. My use case is to know who actually (personal/identifiable) used a technical account ...
0
votes
0answers
47 views

How to legally verify a digital signature was validly created and used, and the audit trail was not forged

I am still learning about how exactly a digital signature is created, but I'm wondering about the process of making sure a digital signature was actually created by the end user. For example, say a ...
0
votes
1answer
108 views

What should be done if 2FA was turned off in an unexpected manner?

Today when I logged in Facebook, no 2FA was shown. I have been using SMS message as the second authentication factor. When I looked at the security settings, 2FA seemed to be disabled. I immediately ...
0
votes
0answers
31 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...
0
votes
1answer
145 views

Attack vectors with encrypted SAML assertion response

I'm testing a web application which uses SAML SSO. SAML Response has signature and it is verified correctly if data is tampered. But I noticed that when signature is removed completely authentication ...
0
votes
1answer
69 views

Asymmetric Encryption on User Data to Allow Unauthenticated Input

Normally I would want to develop an app that encrypts user's data with symmetric encryption (AES 256) from a password based derived key (PBKDF2). For a new project, I would like the users to be able ...
0
votes
1answer
726 views

SEToolkit Not Cloning Login Page

I am trying to clone a login page with SEToolkit in the latest version of Kali Linux. SEToolkit simply isn't working. I have tried running it with normal user privileges and sudo. I have placed in ...
0
votes
1answer
50 views

Protecting Keys with External Factor

I have some symmetrical encryption keys (DEK) stored in the database alongside with the encrypted data. DEK's are encrypted by the public key of the HSM. The application server uses HSM with PKCS11 ...
0
votes
1answer
165 views

How can AWS API Gateway be used to rapidly rotate credentials in this fashion?

Reading through this article, I hit a little wall of understanding. The author states: This is because my laptop doesn’t have the secret weapon. Once you get this up and running on an EC2 ...
0
votes
1answer
53 views

iCloud Security Concern: browser session authentication storage after 2-factor?

Does anyone know how Safari or Chrome stores a www.icloud.com session authentication after logging in and passing 2-factor authentication? Is it stored in an encrypted cookie? My concern is, if ...
0
votes
0answers
207 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
0
votes
0answers
53 views

Leaking information about 2FA status

I was asked to provide a public web interface which is given an email addresses (which belong to our users) for public clients (e.g. a web application or native mobile application) whether or not a ...
0
votes
0answers
52 views

Is authorizating add-ons in this way secure?

I have a website, for which I made accompanying add-on to Firefox and Chrome. Both of those are distributed privately. In Firefox they can be installed only from my website, and for Chrome the link to ...
0
votes
0answers
33 views

How could an account-based service trust a checksum provided by a client-side application whose code is open source?

Say for example that I was a digital video game provider, and my games were played via a virtual machine. Lets also say that the code for this virtual machine were open source, and that this VM was ...
0
votes
0answers
26 views

Using Access Readers for software access

Is it possible to use card access readers for something other than physical access? I've been reading about Wiegand and OSDP protocols and it looks like the hardware is all based on that (with some ...
0
votes
0answers
49 views

Electron app generating one-time access codes vs server generated codes

I'm designing a kiosk to use one-time SMS codes as a method of authentication. The method I'm using to generate codes happens inside of an Electron application running on a locked down kiosk, hardened ...
0
votes
0answers
352 views

Password-based client login over TCP/TLS

A client connects to a server through an application (not a web browser) with a long-running TCP connection. TLS is used, so the communication is secure. Is there a standard way to implement a ...
0
votes
0answers
508 views

What are the security consequences of allowing 2FA app (Google Authenticator) to display the seed?

Excuse me if my question is a little bit convoluted. I prefer to share the full story, background information, so that accidentally I'm not asking XY question. Background info I'm using 2FA pretty ...
0
votes
0answers
97 views

How to combine a preshared key and a shared secret

What is the best way to combine a shared secret generated using elliptic curve diffie-hellman, and a pre-shared key file. I want a way to make sure that both correct keys are being used not just the ...
0
votes
0answers
133 views

To implement EAP-TLS for BYOD devices on a campus wireless network, should you use only machine authentication?

Like why would you need user authentication? If someone has an iPhone and is a member of the campus, he would only need a machine certificate for his iPhone so that only it can connect to the network ...
0
votes
0answers
97 views

Automatic login after registration

After a user has registered a new account I want the new user of my site to be logged in automatically, i.e. an automatic login after registration. The registration is a JavaScript application. When ...
0
votes
0answers
72 views

Possible Session Key Security Weakness

I found a website that generates its session keys by hashing the userid (more or less public data) and the password together with MD5. Sessionkey = md5sum(userid+password) I am fairly new to this ...
0
votes
0answers
199 views

Generally speaking, how does the Facebook JavaScript SDK provide authentication?

I'm looking for a high level overview of how the Facebook JavaScript SDK authenticates users, and the techniques involved. All JavaScript apps use this standard code to import the Facebook Single ...
0
votes
0answers
31 views

Providing identity verification via confirmed contact info to unconfirmed address w/o leaking information?

I emailed a known e-mail address for my local telecommunications/internet company about a complaint with their service. It appears the person I emailed forwarded this to somebody else in their office ...
0
votes
0answers
115 views

Benefits/negatives of password-less authentication

I am facing the following dilemma: I have a client who has a very basic admin panel, he uses this once or twice a week and cannot do much, mainly update content and add products. Currently, the ...
0
votes
0answers
38 views

Verify which file a request to the server originated from

In order to make my question clear I will give a practical scenario. Lets say I have a server where I allow people to upload a script and allot them part of my drive, the script can make requests to ...
0
votes
0answers
364 views

Is authentication/authorisation necessary between a web server and an isolated application server?

If I have a system that consists of an application server which responds to requests made only from the web server. a web server that responds to client requests over the internet. Is it necessary ...
0
votes
0answers
806 views

In what ways may a SAML2 service provider interoperate with an agency using Common Access Cards (CAC)

I'm at a service provider organization that supports shibboleth-style and CAS third party authentication. I'm looking at the requirements to meet the low baseline of FedRamp (see FedRAMP Security ...
0
votes
0answers
487 views

is Form Authentication more secure than using the session authentication?

Recently I have read about the form authentication of Asp.Net but I can discern no differences in the term of security between it and the session authentication. For Example if somebody hacked my ...
0
votes
0answers
148 views

Social game authentication exploit

We're running a popular social game and we have a security problem that is growing more and more popular these days. We have the following product requirements: There should be no registration to ...
0
votes
0answers
479 views

Brute-forcing a RSA private key password vs. LUKS volume

I need to store various private keys for my clients. Given these options, what would be the least prone to brute force attacks: Encrypt the private keys using a separate RSA key (each user get its ...
0
votes
0answers
509 views

Web and Intranet applications on different domains login to the same Database

Imagine a web application is on an active directory domain A, and the internal Intranet application is on domain B. There is a SQL server on domain A, and we can use Windows Authentication for the web ...
0
votes
0answers
142 views

drupal external authentication - how to handle password?

I need to implement an architecture someone else designed. They have a drupal as user interacting component, and an external authentication module. To authenticate, from drupal, username and ...
0
votes
1answer
263 views

Is this authentication scheme using JWT secure?

I was wondering if you could review this authentication scheme for web application. === Login Page === Credentials Verification => Server issues JWT => Stored in a Cookie JWT contains: exp: ...
0
votes
1answer
67 views

Securing application-application communication from devs and admin

Scenario: I have an application A which holds sensitive data. I have an application B which needs to process the data. A will provide a web-interface. B will make calls to get required data from A. ...
0
votes
1answer
523 views

Storage of the One Time Password Seed

I'm a student and I'm working on an OTP authentication systeme based on OATH using smart phones as tokens for the clients. My problem is the protection the OTP seed at both client and validation ...
0
votes
2answers
80 views

Can you use Google's authenticator app when Google “makes sure that you’re really you”?

I've heard that you can configure your Google account to use its (more secure) authenticator app rather than sending you a text message - in my most recent case, this was when Google sent me a text ...
0
votes
2answers
399 views

Is this login flow via an authenticated email account safe?

I want to have users log in by entering an email, and then proving that they control that email. I only care that they do control the email, and so want to avoid add another password to the process if ...
-1
votes
1answer
45 views

Confusion related to broken authentication vulnerability

I was able to login by using the cookie of my previous session but when I try to change the setting I was logged out. Will this be eligible for authentication bypass vulnerability?
-1
votes
1answer
281 views

Auto-Fill Windows Security Credentials

I am having a network issue that every time in a while it requires me to enter my windows credentials (it is company security thing) If I don't do that I will have no internet connection on my laptop ...
-1
votes
1answer
867 views

Is my AD password sent in plain text then encrypted?

how does an application authenticate with AD credentials? Are the credentials sent in plain text? or are they encrypted before it checks with AD to validate the user?
-1
votes
1answer
199 views

How to implement security with Azure Mobile Services Back-end?

I have a mobile application which relies on a Windows Azure Mobile Services Back-end. I want to tie down some security vulnerabilities. For example, someone can currently access all my records, modify ...
-1
votes
1answer
199 views

How PPP with CHAP for Cisco works

I'm learning to configure a simple PPP link with CHAP authentication for two Cisco routers. I'm trying to make sense of how router makes sense of the configuration in this example, as the logic of ...
-1
votes
1answer
58 views

Is there any authentication scheme relying only on the “secret” question?

I know it's standard for websites to use usernames and passwords to authenticate users. From what I've read, question based authentication is usually used to either reset a password, or employ two-...
-1
votes
1answer
303 views

Secure login procedure

I have implemented a login, and session, procedure for a web app and I am wondering whether what I have implemented is secure enough. The authentication is based on login password on https. If the ...
-1
votes
1answer
2k views

How does SSL client authentication work?

I read the RFC document, it mentioned that there are some kinds of client certificate type. So I don't understand what does this type mean. For a instance, one type named rsa_fixed_ecdh, it said, the ...