Preventing Authentication Vulnerabilities

Front

What are the important techniques used to prevent authentication attacks?

Back

1. Secure handling of user credentials 2. Avoiding trust in users 3. Preventing username enumeration 4. Preventing password brute-forcing 5. Implementing proper MFA 6. Additional prevention techniques.

Front

What is the importance of auditing authentication code?

Back

Auditing authentication code is crucial to identify and fix logic flaws that can lead to vulnerabilities.

Front

What should be avoided in the handling of user credentials?

Back

1. Tokens containing user credentials 2. Disclosure of usernames and emails on public pages 3. Sending sensitive data over unencrypted connections.

Front

What is the recommended approach for password policies according to NIST 800-63-b?

Back

1. Allow long passphrases with spaces 2. Avoid unnecessary forced password changes.

Front

How can username enumeration be prevented?

Back

By using identical generic error messages for incorrect credentials and ensuring consistent HTTP status codes.

Front

What is a measure to prevent password brute-forcing?

Back

Implementing strict IP-based rate limiting and using CAPTCHA after a certain number of failed attempts.

Front

What is the risk associated with SMS-based 2FA?

Back

The risk of SIM swapping or message interception.

Front

What should be done with default credentials?

Back

Default credentials must always be changed.

Front

What type of requests should be used to transmit credentials?

Back

Only POST requests should be used; GET requests should be avoided as they expose credentials in URLs.

Front

What additional functionalities related to authentication should be audited?

Back

Reset of forgotten password, password change, and new account creation functionalities.