43
votes
Accepted
How to best obfuscate a built-in key in an application?
Hard-coded credentials are considered a vulnerability. Cisco gets caught time and time again, and have to issue a fix to remove them every time.
No matter how many layers of obfuscation you employ, ...
- 53.6k
39
votes
Enabling a user to revert a hacked change in their email
Your scheme completely defeats the purpose of changing the e-mail address. When a user wants to change their address, there's a good chance they're doing it because they no longer control the old ...
- 3,438
26
votes
Why do some websites require logging in twice? Not two steps, but two full username/password entries
In addition to the other answers, it's possible that you have bookmarked a logout link, so every time you try to access the app, you are first propmpted to authenticate, and then sent to the logout ...
- 2,436
15
votes
Enabling a user to revert a hacked change in their email
Maybe you work for a big company like Facebook where the number of users is so huge that you have to automate the process of recovery. But I assume you are not working for such a company and that the ...
- 7,847
15
votes
Why do some websites require logging in twice? Not two steps, but two full username/password entries
It may happen when the apparent application is shared among different sub-applications. When this happens, the various sub-applications should be able to share some information, at least the fact that ...
- 26.5k
8
votes
Show if email exists and if password was incorrect on our login screen?
I work for a medium size financial company with close to a hundred thousand clients and we decided a long time ago that trying to hide the fact that an email is already in our database futile and ...
- 2,572
8
votes
How to best obfuscate a built-in key in an application?
log into a website using built-in credentials.
Going over HTTP(S) is always going to be an enormous hurdle to any obfuscation, especially if the website you are logging into has a regular username/...
- 3,139
7
votes
Accepted
Where are wifi passwords stored?
In general, passwords can only be hashed on the server side, because hashing algorithms are one-way algorithms. The client must be able to present the password and the server compares the calculated ...
- 18.7k
6
votes
Enabling a user to revert a hacked change in their email
(Not a direct answer to OP's question, which I believe deserves its own proper answer without being turned into an X-Y thing, but this is too long for a comment:
Using a link to revert the email ...
- 3,946
5
votes
Accepted
When signing with server public key, how do I prove server key is trustworthy?
My understanding is that LetsEncrypt certificates are considered self-signed, and not as trusted as CA-generated certificates.
No. The CA certificate of Let's Encrypt is issued and signed by CA "...
- 12.2k
5
votes
Show if email exists and if password was incorrect on our login screen?
Usually, the less information you give the attacker, the better. Having a generic "username or password incorrect" gives the lowest amount of information while still informing the user that ...
- 53.6k
4
votes
Can a security system detect there are multiple copies of a single-issued fob?
There have been different methods of detecting cloned RFID fobs developed over the years depending on the complexity of the system:
a random number added to the fob that gets changed with every ...
- 128k
4
votes
Oauth: native UI for internal / first party apps
Your requirements contradict to each other. You say OAuth was chosen because it provides:
session sharing across different applications
On the other hand:
... don't want to redirect the user
... ...
- 12.2k
4
votes
Accepted
Automatic Certificate Signing Request (CSR) Validation
A CSR by itself is valid if the signature on the CSR fits the public key in the CSR. Anything else is subject to use case specific constraints, i.e. depend on what the certificate should be used for.
...
- 199k
4
votes
How to form the IV and Additional Data for TLS when encrypting the plaintext
Is iv[0:3] the fixed IV established from the handshake and iv[4:11] are the current (write) sequence number + 1?
Mostly not. In TLS1.2, the GCM nonce is 4 bytes generated from the handshake plus 8 ...
- 10.6k
4
votes
Accepted
Is using the computer for MFA safe?
Can computers with MFA programs meet this requirement?
They meet this requirement
as long as they can keep the secret for the MFA sufficiently private to the physical device
and can make ...
- 199k
4
votes
How to best obfuscate a built-in key in an application?
Don't bother with the app - check the data instead (if you need to)
Really, the only use case where you'd care about this kind of login is if the server has to trust the data produced by the app - and ...
- 621
3
votes
Using localStorage to keep the user logged in in PWA
This is significantly less secure than properly implemented cookie-based authentication.
It's highly vulnerable to cross-site scripting attacks, as the OWASP points out. Any XSS vulnerability ...
- 3,438
3
votes
2FA implementation security
I'm not going to touch on the Duo/Eset thing except to note that a very large number of authentication/authorization systems depend on trustworthy third parties. How much of your personal or corporate ...
- 46.4k
3
votes
Security of password managers vs. risk of losing access
Password change policies are enforced to limit the amount of time an attacker can use a leaked password, or limit the amount of time an attacker have to crack a hash or decrypt it. As the vast ...
- 53.6k
3
votes
is mTLS authentication alone considered secure for authentication
Yes, mutual TLS (mTLS) is sufficient for client authentication.
With mutual TLS, the client knows it is actually talking to the server, and the server is actually talking to the client. Both parties ...
- 29.6k
3
votes
How to best obfuscate a built-in key in an application?
How do I best obfuscate this key so that it isn't visible in a file dump of the executable? Are there best practices for that as well?
There is a system where you encrypt your key using AES, and the ...
- 29.6k
3
votes
How to best obfuscate a built-in key in an application?
Security becomes more challenging in this area, but this is a legitimate question. You should look very carefully at the scenario to see whether additional user or device authentication are possible; ...
- 193
3
votes
Why do some websites require logging in twice? Not two steps, but two full username/password entries
This has little to do with two-factor authentication (2FA) nor is it a replacement for it.
Reauthentication as part of regular authentication process is unlikely and uncommon to my knowledge. However, ...
- 6,661
2
votes
How does a single mobile banking app implement a two factor authentication?
It depends. A mobile app may or may not implement 2FA. One factor can be password. Another factor can be device ID. Important is, how the device is bound to your account. Can anyone who knows your ...
- 12.2k
2
votes
Is using WebAuthn alone considered as two factor authentication?
WebAuthn by itself, no. WebAuthn is simply a public-key-based authentication method with some requirements for how the proof of ownership occurs. You can, for example, use WebAuthn with a hardware ...
- 46.4k
2
votes
Accepted
Authentication using JWT signature, without header and payload
The short version: Technically yes, I suppose, but it's a terrible idea! You'd have to store each user/client's entire JWT in the server (not just the headers and payloads) or else authenticating a ...
- 46.4k
2
votes
How would you enforce user to only connect on a given network?
User PC automatically connects to a given VPN. All traffic is routed through that. Thus, the "physical" networks to which the PC is connected are only used for the VPN client connection (for ...
- 18.8k
Only top scored, non community-wiki answers of a minimum length are eligible