{% extends 'core/Identification and Authentication Failures/IA-Failures.html' %}
{% load static %}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
{% block inside-content %}
    <div class="bg-white nav-item flex-grow bg-opacity-20 backdrop-filter backdrop-blur-md w-4/5 problems-container">
        <h1 class="text-center text-white font-bold pb-5">Preventing Identification and Authentication Failures</h1>
        <h1 class="text-white font-bold pb-3">1. Preventing Credential Stuffing</h1>

        <p class="text-white pb-3">
            The most reliable way to prevent credential stuffing is two-step verification. Meaning every time somebody
            connects to
            a selected account from a new location or device, the website asks for confirmation via email or other
            means. Or you can
            compare incoming passwords with libraries or APIs of pwned passwords. For example
            <a href="https://haveibeenpwned.com/" class="font-bold underline">haveibeenpwned.com</a>
        </p>

        <h1 class="text-white font-bold pb-3">2. Preventing Brute Force Attacks</h1>

        <p class="text-white">
            There are many ways you can limit and make brute force attacks harder. There is no way to stop them
            completely, but you can make them nearly impossible. First a foremost is not to allow weak passwords. Let's
            see an exemplary code in python and how you could do that.
        </p>

        <div class="flex flex-grow pt-3 pb-3">
            <pre><code class="python rounded-lg">import re

def check_password(password):
    errors = []
    usable = True;

    if len(password) < 8:
        errors.append("Password must be longer than 8 characters")
        usable = False
    if not re.search('[a-z]',password):
        errors.append("Password must contain at least one small letter")
        usable = False

    if not re.search('[A-Z]',password):
        errors.append("Password must contain at least one big letter")
        usable = False

    if not re.search('[0-9]',password):
        errors.append("Password must contain atleast one number")
        usable = False

    if usable:
        return
    else:
        for error in errors:
            print(error)
        return False

print(check_password("123"))
Password must be longer than 8 characters
Password must contain at least one small letter
Password must contain at least one big letter

print(check_password("123asdaa"))
Password must contain at least one big letter

print(check_password("Asj32rsdf3kd"))
None</code></pre>
        </div>

        <p class="text-white pb-3">
            This approach is a very simple way to check for password safety. To be even more secure, you can compare the
            passwords with a list of the most commonly used passwords. Another security layer would be to kick users out
            after a certain amount of requests in a specified time.
        </p>

        <h1 class="text-white font-bold pb-3">3. Preventing exposed session identifiers in the URLs</h1>

        <p class="text-white">
            In most cases, frameworks have session ID hiding already implemented. Frameworks use the method of hiding
            session
            IDs in the cookies. An example is csrf_token in Django. Another example is .NET which has to store in
            cookies
            inaccessible by client scripts set by default. Therefore, nowadays, you do not need to worry about exposed
            session IDs.
        </p>

        <p class="text-white pt-3">
            If you are curious, you can also look at your session ID. The process is as follows:
        </p>

        <ol class="list-decimal text-white pl-5 pt-3">
            <li>In the web of your choosing press <span class="font-bold">F12</span></li>
            <li>In the upper bar navigate to <span class="font-bold">Application</span></li>
            <li>In the storage category find <span class="font-bold">Cookies</span></li>
        </ol>

        <p class="text-white pt-3 pb-3">
            And there you are, depending on the web you are using, there might be none, one, or much information to
            see.<BR>
            For example:
        </p>

        <div class="bg-gray-900 flex-grow m-auto pt-5 pb-5 px-4 rounded-xl" style="background-color: #2b2b2b">
            <img class="rounded-xl" src="/static/img/cookie.png" alt=""/>
        </div>

    </div>
{% endblock %}
</html>