Securing Authentication
Implementing a secure authentication solution involves attempting to simultaneously meet several key security objectives, and in many cases trade off
Read moreAttacking Authentication
Defects in Multistage Login Mechanisms
Some applications use elaborate login mechanisms involving multiple stages. For example: ■ Entry of a username and password. ■ A
Read moreImplementation Flaws in Authentication
Even a well-designed authentication mechanism may be highly insecure due to mistakes made in its implementation. These mistakes may lead
Read moreForgotten Password Functionality
Like password change functionality, mechanisms for recovering from a forgotten password situation often introduce problems that may have been avoided
Read morePassword Change Functionality
Surprisingly, many web applications do not provide any way for users to change their password. However, this functionality is necessary
Read moreVulnerable Transmission of Credentials
If an application uses an unencrypted HTTP connection to transmit login credentials, an eavesdropper who is suitably positioned on the
Read moreAttacking Authentication
On the face of it, authentication is conceptually among the simplest of all the security mechanisms employed within web applications.
Read moreHandling Client-Side Data Securely
Transmitting Data via the Client Many applications leave themselves exposed because they transmit critical data such as product prices and
Read more