New answers tagged authentication
0
votes
VPN vs Authentication Proxy to restrict access to internal network/application
There is no generic "VPN is more/less secure to an authentication proxy". It depends on the actual implementations and how they are deployed.
An authentication proxy might provide more ...
- 198k
0
votes
Accepted
Is it secure to use session ID as authentication token received from an HTTP header?
If implemented correctly, sure, that's secure. Not sure why you went with a custom header rather than Authorization: Bearer, which is a well-established pattern, but it doesn't matter for security. ...
- 46.3k
0
votes
How long should 2 factor authentication codes be?
"Should", of course is subjective. And what "should" happen depends on things like the standard you want to meet, the restrictions you have, what restrictions your users have, and, ...
- 128k
-2
votes
How long should 2 factor authentication codes be?
My vote is on 4 digits being ideal for many systems.
The extra inconvenience to the average user of 6 digits is not insignificant (and enough to result in some users disabling 2FA. Disabled 6-digit ...
- 267
0
votes
Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?
In your example you can indeed say that is 2FA. But the possible (and very likely) issues are:
unless enforced by some company policy or by phone owners/vendors, you cannot assume that a PIN code or ...
- 154
0
votes
Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?
Provided that every user secures their phone with a PIN – which is "something they know"
If you're in an environment where you can guarantee this then you might be able to make that ...
- 9,277
1
vote
Accepted
Are JWT's needed when implementing passwordless magic link authentication?
You certainly don't need JWTs for this, and in many ways they're a bad choice because there are lots of different ways that they can go wrong if you're not careful, and you also have to think about ...
- 9,277
0
votes
Accepted
Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?
If you're using a magic link via email, then you can actually probably just continue using that in place of the MFA verification. You're already using an external service to authenticate, so why ...
1
vote
Securing access to SAC from Windows EMS
At least according to Wikipedia, for EMS specifically, it says:
EMS is enabled per default in case BIOS serial console redirection is supported and enabled beforehand
I don't know if that ...
- 11
0
votes
Bloom filter to prevent replay attacks in signed HTTP requests
Instead of the nonce being a randomly generated UUID value, perhaps the nonce could be the next value in an HOTP or TOTP sequence. This would prevent replay attacks, without requiring the server ...
- 22.7k
0
votes
Accepted
What happens at a low level when authenticating server certificates?
Regarding the TLS 1.3 Handshake Protocol:
What you ask is not specific to TLS 1.3. Certificate validation is used for all the other TLS versions too and is also used outside of TLS, for example in S/...
- 198k
1
vote
Accepted
What's the relation between Mathematica's authentication keys called MathID, activation key, and password?
The details are likely proprietary and not open. But from the description the MathID is specific to the system and might be derived from some system properties so the the license cannot be simply ...
- 198k
0
votes
Is WIFI that is 'open' but requires a password to access the internet safe?
No, it is not. First of all, the local network traffic itself will be unencrypted, meaning any device on the network can easily read all traffic sent or received over it, and with a little effort can ...
- 46.3k
1
vote
Is WIFI that is 'open' but requires a password to access the internet safe?
Any network which is not under your full control or under the full control of somebody you can trust should be considered potentially compromised or even malicious. This does not matter if this is an ...
- 198k
0
votes
Accepted
token leak by copying cookie
If I were to take this exact token and use it in another web browser, I would be logged into my own account.
And this would not only be true to you, but also for the attacker.
However, how could ...
- 198k
1
vote
Isn't there a critical built-in vulnerability in OAuth's Implicit flow?
First of all, the implicit flow is deprecated. it should not be used.
(it has been replaced with the PKCE flow)
The way the implicit flow works is by matching a known URI, source and client ...
- 8,753
1
vote
Login/Registration: why is not telling the users they got their username wrong during login, if registration already hint username existence?
The way to mitigate that would be to not give away this information during the registration process, but when your registration form is only email + password, you can not really do that ?
If you're ...
- 9,277
0
votes
OAuth2 - using Id Token for authentication to a backend service
There is probably a reason why this hasn't been mentioned that I'm missing, but another solution is for the API to get the id_token from the /userinfo endpoint using the access_token:
Since in many ...
- 487
Top 50 recent answers are included