Skip to main content
48 votes
Accepted

What is the point of entering numbers in the two-factor authentication app?

A Challenge/Response mechanism provides mutual authentication. The request needs to be validated on both sides and it is a more positive overt action. For MFA notification-based 2FA, all one needs to ...
schroeder's user avatar
  • 131k
43 votes
Accepted

How to best obfuscate a built-in key in an application?

Hard-coded credentials are considered a vulnerability. Cisco gets caught time and time again, and have to issue a fix to remove them every time. No matter how many layers of obfuscation you employ, ...
ThoriumBR's user avatar
  • 54.6k
33 votes

Is there a problem with having a combined login/register screen?

Obviously you'd be able to enter a bunch of emails and check whether or not they are registered on our system but is that a problem? We have 2FA for registered accounts as well as complex password ...
Steffen Ullrich's user avatar
32 votes

What is the point of entering numbers in the two-factor authentication app?

This is to prevent multi-factor authentication fatigue attack and other situations where the victim erroneously approve the authentication attempt. From Advanced Microsoft Authenticator security ...
Sjoerd's user avatar
  • 31.8k
31 votes
Accepted

Is it impossible to protect an API from data redistribution?

It's not something you can do with technology. As soon as the data leaves your server, it isn't your data anymore. There are several ways a malicious user can extract data from your application: ...
ThoriumBR's user avatar
  • 54.6k
25 votes

Why do some websites require logging in twice? Not two steps, but two full username/password entries

In addition to the other answers, it's possible that you have bookmarked a logout link, so every time you try to access the app, you are first propmpted to authenticate, and then sent to the logout ...
atk's user avatar
  • 2,426
22 votes

How to receive large files guaranteeing authenticity, integrity and sending time

If it's actually important that you can provide legal evidence, then you should discuss this with a (specialized) lawyer. While we can come up with all kinds of technical approaches, that doesn't mean ...
Ja1024's user avatar
  • 11.8k
21 votes

Is it impossible to protect an API from data redistribution?

This is a classical Digital Rights Management (DRM) problem. There are no definite solutions, not even in your particular scenario. DRM techniques can make it more difficult to distribute data, but ...
Ja1024's user avatar
  • 11.8k
20 votes

Is there a problem with having a combined login/register screen?

Allowing anybody to check whether a particular e-mail address is registered at your site is both a privacy and a security issue. The privacy impact of this information of course depends on how ...
Ja1024's user avatar
  • 11.8k
20 votes

How to receive large files guaranteeing authenticity, integrity and sending time

The more complicated you make it technically, even if perfectly correct and tamper-proof, the more you have the problem that a judge will need to listen to one sides "technical expert" and ...
nvoigt's user avatar
  • 1,863
15 votes
Accepted

Doubts about Bluetooth Secure Authentication

The information in this publication seems to be wrong. Specifically it states Step 4. The slave returns the most significant 32 bits of the h5 output as the computed response, the Signed Response (...
Steffen Ullrich's user avatar
14 votes

Why do some websites require logging in twice? Not two steps, but two full username/password entries

It may happen when the apparent application is shared among different sub-applications. When this happens, the various sub-applications should be able to share some information, at least the fact that ...
Serge Ballesta's user avatar
12 votes

Is storing authentication tokens in local storage with a strong CSP safe?

... prohibits all JS except the one I bundle my app, XSS attacks should be essentially impossible This assumes that your (trusted) JS is free from exploitable bugs. ... is there still a security ...
Steffen Ullrich's user avatar
10 votes

Is there a problem with having a combined login/register screen?

You've defined your threat model as: An attacker gaining a list of registered users in your system. Irrespective of your UX/UI decision to combine login/register into one page or keep them separate, ...
MonkeyZeus's user avatar
9 votes

Do passkeys allow an attacker to gain account access by accessing a single device?

The short answer in this case is "yes"; one would only need to steal one device instead of two. But be careful not to jump to erroneous conclusions from this fact. You state the passkey ...
schroeder's user avatar
  • 131k
8 votes

How to best obfuscate a built-in key in an application?

log into a website using built-in credentials. Going over HTTP(S) is always going to be an enormous hurdle to any obfuscation, especially if the website you are logging into has a regular username/...
le3th4x0rbot's user avatar
  • 3,299
7 votes
Accepted

Where are wifi passwords stored?

In general, passwords can only be hashed on the server side, because hashing algorithms are one-way algorithms. The client must be able to present the password and the server compares the calculated ...
Esa Jokinen's user avatar
  • 19.1k
6 votes

Is storing authentication tokens in local storage with a strong CSP safe?

I would not place that much trust in CSP to be honest. I'm currently trying to tighten the CSP headers on a reasonably complex project. Some issues I'd worry about: Third party components may require ...
marcelm's user avatar
  • 1,008
6 votes
Accepted

Offline, multi-machine, 2-factor authentication information vault?

If you consider carrying a USB stick around convenient, then a VeraCrypt container is a good starting point. You could additionally use hardware encryption, but I wouldn't rely on it alone. Open-...
Ja1024's user avatar
  • 11.8k
5 votes
Accepted

How effective is re-entering your password to enable high-risk functions on your account when autofill is always available?

The password manager of the browser is a client-side feature which websites have no control over. Whether or not you use it is your own choice. So if a website asks for re-authentication, and you “...
Ja1024's user avatar
  • 11.8k
4 votes

How to form the IV and Additional Data for TLS when encrypting the plaintext

Is iv[0:3] the fixed IV established from the handshake and iv[4:11] are the current (write) sequence number + 1? Mostly not. In TLS1.2, the GCM nonce is 4 bytes generated from the handshake plus 8 ...
dave_thompson_085's user avatar
4 votes
Accepted

Is using the computer for MFA safe?

Can computers with MFA programs meet this requirement? They meet this requirement as long as they can keep the secret for the MFA sufficiently private to the physical device and can make ...
Steffen Ullrich's user avatar
4 votes

How to best obfuscate a built-in key in an application?

Don't bother with the app - check the data instead (if you need to) Really, the only use case where you'd care about this kind of login is if the server has to trust the data produced by the app - and ...
Graham's user avatar
  • 671
4 votes

Is storing authentication tokens in local storage with a strong CSP safe?

Assuming that you set a strong Content Security Policy, is there still a security advantage of storing credentials/sessions in cookies over local storage? The advantage isn't that significant to ...
tim's user avatar
  • 29.7k
4 votes

Doubts about Bluetooth Secure Authentication

Found the answer. Section 4.2.1.4 of the Bluetooth Core Specification (Version 5.4): they are two different values that are computed independently by each device. In other words, the document explains ...
StefanoTrv's user avatar
4 votes

Authenticating a device for remote motor control

With regard to: As far as I can tell (maybe I'm wrong), any authentication scheme (even TLS?) I've found so far could be defeated if an attacker simply listens on the network, notices that some ...
mti2935's user avatar
  • 23.7k
4 votes
Accepted

How to verify hostname of certificate? and Is it mandatory if client knows the certificate?

Hostname verification checks the hostname you connect to against the hostname in the certificate. If you connect to security.stackexchange.com, it should present a certificate issued to security....
Sjoerd's user avatar
  • 31.8k
4 votes

Is it impossible to protect an API from data redistribution?

While you can hardly prevent the user from reusing and retransmitting any such data, beyond the measures given in the other answers, one thing you can do is monitor usage patterns and/or limit usage. ...
jcaron's user avatar
  • 3,675
4 votes

Security doubts around the refresh token and how it works

You're mixing parts of the OAuth specification with implementation details and personal opinions from a user of a forum. This isn't very helpful when trying to understand the concepts of the OAuth ...
Ja1024's user avatar
  • 11.8k
3 votes

is mTLS authentication alone considered secure for authentication

Yes, mutual TLS (mTLS) is sufficient for client authentication. With mutual TLS, the client knows it is actually talking to the server, and the server is actually talking to the client. Both parties ...
Sjoerd's user avatar
  • 31.8k

Only top scored, non community-wiki answers of a minimum length are eligible