Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [hardware-token]

The tag has no usage guidance.

7
votes
2answers
2k views

How to handle refresh tokens

I'm trying to wrap my head around JWT (JSON Web Token) based authentication for securing API endpoints using access tokens. I'm protecting these endpoints by requiring the user to have a valid access ...
3
votes
1answer
215 views

Good practices for protecting a machine certificate against extraction

Consider the following scenario: You are providing VPN access for a number of machines running Windows 10. The machines are configured and hardened according to company standards. You rely on machine ...
0
votes
1answer
289 views

can a token be used for sql injection

I have a token that is restricted to read only access. If someone obtains that token, can they use it to do a sql injection attack? Given that the token is permissioned for read only, can someone ...
2
votes
2answers
1k views

Why is an HSM required to protect CA certificates (rather than a regular USB token)?

Typical USB tokens (Nitrokey, YubiKey...) allow an everyday user to store PGP keys and use them to encrypt email, harddrives and so on. The same vendors also offer distinct products called HSMs (...
3
votes
1answer
470 views

Create certificate without private key or using USB eToken

Considering this thread: Create certificate without private key with OpenSSL I have a very similar situation. I have a USB eToken 5110 JC (Aladdin) which has an inaccessible private key, since it's ...
0
votes
3answers
408 views

Token FIPS 140-2 level 3 with support for Android, iPhone and Web

I'm testing a SafeNet 5100 token FIPS 140-2 level 3. It comes with programs to access and manage it, but only for desktop machines. I would like to create applications that use level 3 tokens. Is ...
3
votes
1answer
71 views

Is there a benefit to setting up a security key on an account that already has phone-based 2FA?

I'm looking at 2FA options for my Google account, and I noticed they now allow you to add a security key to your account. I'm a bit of a novice to infosec, but I'm struggling to see the benefit for me....
3
votes
4answers
2k views

What are dedicated TOTP devices called?

I would like to buy a device that can be provisioned with a secret seed and then displays a time based authentication token without ever revealing the seed. As terms like 2FA, TOTP and Authenticator ...
0
votes
1answer
84 views

One time password with Hardware Token

I am researching software authentication methods that are easy yet secure to implement in my own projects. IDEAS: Steps to authenticate apps The application is running from a USB drive as it is ...
8
votes
5answers
2k views

Hardware token vs Fingerprint based software token

I'm given a choice between two banks's authentication procedures and I need help choosing the most secure and convenient option. Option "hardware token": Authentication into the web platform is done ...
2
votes
0answers
750 views

How do security properties of Trezor's FIDO U2F differ from Yubikey?

Aside from being a bitcoin wallet, the Trezor supports FIDO U2F and seems to offer some unique benefits over a Yubikey: The keys are always generated on the device and never rely on the manufacturer ...
3
votes
2answers
423 views

Two Factor Authentication with PIN - Does where/how you enter a PIN matter?

Say I have two websites with 2FA mechanisms that are otherwise identical. Mechanism 1 You have to enter a PIN into your Token Generator in order to retrieve your One Time Password. On the website, ...
1
vote
1answer
102 views

inherent drawbacks of browser based OTP solutions?

We already have two sorts of OTP generators in place: (a) as hardware (token) (b) as software (e.g. Google authenticator, RedHats freeOTP) Now I saw browser based solutions like SecureAuth OTP which ...
1
vote
0answers
761 views

How safe are the password prompts of the SafeNet eToken 5110 or similar cryptographic hardware tokens?

I'll need to use an hardware token, specifically the SafeNet eToken 5110 that comes with DigiCert's EV certificates, for code-signing on Windows. I know that they issue a prompt to manually enter the ...
1
vote
0answers
63 views

Implement 2-factor authentication with digital certificate [closed]

How can I implement digital certificate to do 2 factor authentication to a web application? I have a web application under Apache server. I want the application to require a digital certificate once ...
6
votes
6answers
382 views

When should I issue more than one multi-factor device to a user? Is it OK to give several active tokens vs none at all?

Most of the conventional IT.Sec thinking I've seen says that a user can only have one multi factor authentication device. I'd like to challenge that defacto-thinking and ask if there is ever an ...