New answers tagged

0 votes

What are the security best practices to implement offline login of android apps?

Instead of using custom user sign in, you can use android system API that can perform in-app authentication backed by Trusted Execution Environment (TEE). It supports both biometric and device ...
user avatar
  • 6,051
4 votes
Accepted

Would storing the users IP address in a session token be more secure?

As always, when someone asks whether something is "more secure", the answer has to be "what is your threat model"? Because if you don't understand what you're trying to protect ...
user avatar
  • 3,571
0 votes

is it a standard best practice to *display* the last-logged-in user by default on an individual employee laptop?

If you mistakenly enter a password into the username field and press return with a blank password, that will be recorded in the Windows Security log as a failed login attempt. The username (actually ...
user avatar
  • 81
1 vote

I'm testing an app that uses only v4 UUIDs as a cookie for authentication. What are some attacks I can try?

A correctly generated v4 UUID is always cryptographically random, that's in the spec. Verifying this, short of looking at the source code, is difficult. There are tests you can run (e.g. Burp Suite's &...
user avatar
  • 38.7k
2 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Checksums and signatures have different purposes. Checksums are good for verifying data integrity. They verify that you have received what you expected to receive. I would not recommend CRC32 or MD5 ...
user avatar
  • 759
3 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

Checksums are typically easier to compute. If you're validating the signature on a given device anyways, that wont matter. But sometimes you may want to validate on one device and check for errors ...
user avatar
  • 9,206
3 votes
Accepted

Create a cryptographically secure random string for auth cookie in javascript

Is this safe enough or am I making a horrible mistake? Safe enough. Overkill, honestly. The most notable improvement I'd recommend here in particular is hashing the session token before storing it in ...
user avatar
  • 38.7k
1 vote

Create a cryptographically secure random string for auth cookie in javascript

Here is a simple html web page that uses the javascript Crypto.getRandomValues() function to create a random 32-byte hexadecimal string: <html lang="en"> <head> <meta charset=&...
user avatar
  • 19.5k
8 votes

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

It's not uncommon to have both. For example, developers of the Tails operating system sign their ISO's using GPG. See https://tails.boum.org/install/expert/index.en.html#verify for more info. But, ...
user avatar
  • 19.5k
20 votes
Accepted

Is signing a file better than issuing a checksum, and does it render a separate checksum useless?

I would say that you are completely correct, but also not correct at the same time. From the IoT device's point of view, I agree that checking the signature does everything the checksum does, and more....
user avatar
0 votes

AWS Service-To-Service authentication via Identity document

There's some useful information in this github thread. And you're right, the authentication can only be used once, and while it has no expiry it has a start datetime -- and the authenticating service ...
user avatar
  • 3,546
1 vote
Accepted

Using certificates for authentication in a web site

The website didn't show you anything. The server invoked a rarely-used option in the SSL/TLS protocol -- nowadays TLS1.2 RFC5246 7.4.4 or TLS1.3 RFC8446 4.3.2 -- asking the client, which is the ...
user avatar
0 votes

Can third-party authentication yield a static user-specific encryption key?

Unfortunately, this can't be done directly, certainly not if you want the server to never see or be able to derive the user's key even using ephemeral data. As you noted, identity provider / OAuth ...
user avatar
  • 38.7k
3 votes
Accepted

Creating secure website-based login for a desktop app

Rule #1: don't roll your own. It sounds like you are inventing your own version of the SAML or OIDC federated login protocols. I would suggest that you look into those and see if they fit rather than ...
user avatar

Top 50 recent answers are included