What is Identification and Authentication failure?
Identification and Authentication failure is when applications' confirmation of users' identity,
authentication, or session management is implemented incorrectly. These attacks can lead to significant data
loss and even access blocking. We can split the attacks into a few categories:
- Credential Stuffing - The attacker already knows the login credentials of users gain through other means
- Brute Force Attacks - As the name suggests, these attacks try to get access through brute force: stuffing
login fields with dictionaries of the most used passwords and usernames or credentials based on some
algorithm. However, this type of attack is very straining on attackers' processing power. This attack is
most efficient against weak passwords.
- Session Identifiers exposed in the URL and Session Fixation - Session IDs are generated upon connection to
the website. These IDs can then be found by attackers and used to access a website as a valid login.
Therefore, emitting session IDs from the URL is a must.
Breaches due to these types of attacks are usually the result of weak and unchecked passwords and sessions.
Here we will look at how to prevent brute force attacks and explain how to go about preventing the other
two.
{% endblock %}