Difference between revisions of "Using single-factor authentication"

From OWASP
Jump to: navigation, search
(Reverting to last version not containing links to s1.shard.jp)
m (Reverted edits by MediaWiki spam cleanup (Talk) to last version by TrocbAscoe)
Line 1: Line 1:
 +
[http://s1.shard.jp/frhorton/9nls8flts.html auction south africa
 +
] [http://s1.shard.jp/frhorton/t45lfscw6.html african american family picture
 +
] [http://s1.shard.jp/losaul/australia-getaway.html voting systems in australia
 +
] [http://s1.shard.jp/frhorton/y6gqutu2n.html african cave dwelling pic spider] [http://s1.shard.jp/frhorton/ocdp2flvo.html african cichlids dwarf
 +
] [http://s1.shard.jp/losaul/australian-momentum.html australian innovation centre
 +
] [http://s1.shard.jp/frhorton/7bbhgy4dh.html africa desert in sahara
 +
] [http://s1.shard.jp/frhorton/rkgv2463v.html albino african clawed
 +
] [http://s1.shard.jp/bireba/window-security.html remove norton antivirus 2004
 +
] [http://s1.shard.jp/losaul/midas-mufflers.html australia heartworm
 +
] [http://s1.shard.jp/losaul/save-the-children.html u2 concerts australia
 +
] [http://s1.shard.jp/bireba/ca-etrust-antivirus.html portable antivirus software
 +
] [http://s1.shard.jp/bireba/norton-antivirus.html norton antivirus symantec antivirus] [http://s1.shard.jp/losaul/wiremesh-australia.html birth death and marriage victoria australia
 +
] [http://s1.shard.jp/olharder/autoroll-654.html http] [http://s1.shard.jp/olharder/auto-a-vendre.html autodesk express viewer download
 +
] [http://s1.shard.jp/bireba/antivirus-software.html norton antivirus 2005 serial keys
 +
] [http://s1.shard.jp/galeach/new165.html asian girl friends
 +
] [http://s1.shard.jp/frhorton/2i2g9o8vi.html oh africa my soul cries out to you
 +
] [http://s1.shard.jp/losaul/the-association.html the association of professional engineers scientists and managers australia] [http://s1.shard.jp/frhorton/jaqhtnv6f.html africa zabala
 +
] [http://s1.shard.jp/losaul/digital-broadcasting.html australia breeders dog in victoria
 +
] [http://s1.shard.jp/frhorton/837ibyv6o.html botswana african safari
 +
] [http://s1.shard.jp/losaul/lawn-bowls-clubs.html dating sites in australia
 +
] [http://s1.shard.jp/losaul/australian-laws.html australian map outback
 +
] [http://s1.shard.jp/frhorton/eustnj89y.html african countries map
 +
] [http://s1.shard.jp/galeach/new23.html asian bedroom themes
 +
] [http://s1.shard.jp/losaul/yamaha-motorcycle.html 2005 australian open winner
 +
] [http://s1.shard.jp/olharder/autoroll-654.html domain] [http://s1.shard.jp/bireba/noton-antivirus.html avg antivirus definition updates
 +
] [http://s1.shard.jp/olharder/car-ezautoshippersnet.html labontes autoschool
 +
] [http://s1.shard.jp/galeach/new105.html map of the asia pacific
 +
] [http://s1.shard.jp/losaul/australia-brisbane.html australia taxaccounts
 +
] [http://s1.shard.jp/frhorton/kqcuriisf.html african hair salons
 +
] [http://s1.shard.jp/galeach/new43.html tsunami in south asia death toll
 +
] [http://s1.shard.jp/olharder/stltodaycom.html high rez auto images
 +
] [http://s1.shard.jp/olharder/autocad-2005-serial.html auto mixing dj software
 +
] [http://s1.shard.jp/olharder/automotive-repair.html automotive repair manual download] [http://s1.shard.jp/losaul/map.html 1983 australian male open winner
 +
] [http://s1.shard.jp/olharder/canadian-auto.html autonics sensors
 +
] [http://s1.shard.jp/galeach/new16.html asian loni
 +
] [http://s1.shard.jp/olharder/autoroll-654.html map] [http://s1.shard.jp/frhorton/bnm8i4pvp.html travel in south africa europe] [http://s1.shard.jp/galeach/new11.html asian beaver chang mr
 +
] [http://s1.shard.jp/frhorton/mz6vv73zx.html west african kingdoms
 +
] [http://s1.shard.jp/bireba/symantec-antivirus.html norton antivirus 2005 crack codes
 +
] [http://s1.shard.jp/frhorton/vjlche4gq.html african american singers list
 +
] [http://s1.shard.jp/bireba/download-norton.html antivirus software review cnet
 +
] [http://s1.shard.jp/olharder/autoroll-654.html link] 
 
http://www.textc4tdom.com  
 
http://www.textc4tdom.com  
 
{{Template:Vulnerability}}
 
{{Template:Vulnerability}}

Revision as of 12:03, 27 May 2009

[http://s1.shard.jp/frhorton/9nls8flts.html auction south africa ] [http://s1.shard.jp/frhorton/t45lfscw6.html african american family picture ] [http://s1.shard.jp/losaul/australia-getaway.html voting systems in australia ] african cave dwelling pic spider [http://s1.shard.jp/frhorton/ocdp2flvo.html african cichlids dwarf ] [http://s1.shard.jp/losaul/australian-momentum.html australian innovation centre ] [http://s1.shard.jp/frhorton/7bbhgy4dh.html africa desert in sahara ] [http://s1.shard.jp/frhorton/rkgv2463v.html albino african clawed ] [http://s1.shard.jp/bireba/window-security.html remove norton antivirus 2004 ] [http://s1.shard.jp/losaul/midas-mufflers.html australia heartworm ] [http://s1.shard.jp/losaul/save-the-children.html u2 concerts australia ] [http://s1.shard.jp/bireba/ca-etrust-antivirus.html portable antivirus software ] norton antivirus symantec antivirus [http://s1.shard.jp/losaul/wiremesh-australia.html birth death and marriage victoria australia ] http [http://s1.shard.jp/olharder/auto-a-vendre.html autodesk express viewer download ] [http://s1.shard.jp/bireba/antivirus-software.html norton antivirus 2005 serial keys ] [http://s1.shard.jp/galeach/new165.html asian girl friends ] [http://s1.shard.jp/frhorton/2i2g9o8vi.html oh africa my soul cries out to you ] the association of professional engineers scientists and managers australia [http://s1.shard.jp/frhorton/jaqhtnv6f.html africa zabala ] [http://s1.shard.jp/losaul/digital-broadcasting.html australia breeders dog in victoria ] [http://s1.shard.jp/frhorton/837ibyv6o.html botswana african safari ] [http://s1.shard.jp/losaul/lawn-bowls-clubs.html dating sites in australia ] [http://s1.shard.jp/losaul/australian-laws.html australian map outback ] [http://s1.shard.jp/frhorton/eustnj89y.html african countries map ] [http://s1.shard.jp/galeach/new23.html asian bedroom themes ] [http://s1.shard.jp/losaul/yamaha-motorcycle.html 2005 australian open winner ] domain [http://s1.shard.jp/bireba/noton-antivirus.html avg antivirus definition updates ] [http://s1.shard.jp/olharder/car-ezautoshippersnet.html labontes autoschool ] [http://s1.shard.jp/galeach/new105.html map of the asia pacific ] [http://s1.shard.jp/losaul/australia-brisbane.html australia taxaccounts ] [http://s1.shard.jp/frhorton/kqcuriisf.html african hair salons ] [http://s1.shard.jp/galeach/new43.html tsunami in south asia death toll ] [http://s1.shard.jp/olharder/stltodaycom.html high rez auto images ] [http://s1.shard.jp/olharder/autocad-2005-serial.html auto mixing dj software ] automotive repair manual download [http://s1.shard.jp/losaul/map.html 1983 australian male open winner ] [http://s1.shard.jp/olharder/canadian-auto.html autonics sensors ] [http://s1.shard.jp/galeach/new16.html asian loni ] map travel in south africa europe [http://s1.shard.jp/galeach/new11.html asian beaver chang mr ] [http://s1.shard.jp/frhorton/mz6vv73zx.html west african kingdoms ] [http://s1.shard.jp/bireba/symantec-antivirus.html norton antivirus 2005 crack codes ] [http://s1.shard.jp/frhorton/vjlche4gq.html african american singers list ] [http://s1.shard.jp/bireba/download-norton.html antivirus software review cnet ] link http://www.textc4tdom.com This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.



Last revision (mm/dd/yy): 05/27/2009

Vulnerabilities Table of Contents

Description

The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.

Consequences

  • Authentication: If the secret in a single-factor authentication scheme gets compromised, full authentication is possible.

Exposure period

  • Design: Authentication methods are determined at design time.

Platform

  • Languages: All
  • Operating platform: All

Required resources

Any

Severity

High

Likelihood of exploit

High

While the use of multiple authentication schemes is simply piling on more complexity on top of authentication, it is inestimably valuable to have such measures of redundancy.

The use of weak, reused, and common passwords is rampant on the internet. Without the added protection of multiple authentication schemes, a single mistake can result in the compromise of an account. For this reason, if multiple schemes are possible and also easy to use, they should be implemented and required.

Risk Factors

TBD


Examples

In C:

unsigned char *check_passwd(char *plaintext){
        ctext=simple_digest("sha1",plaintext,strlen(plaintext)...);
        if (ctext==secret_password())
          // Log me in
}

In Java:

String plainText = new String(plainTextIn)
MessageDigest encer = MessageDigest.getInstance("SHA");
encer.update(plainTextIn);
byte[] digest = password.digest();
if (digest==secret_password())
  //log me in


Related Attacks


Related Vulnerabilities


Related Controls

  • Design: Use multiple independent authentication schemes, which ensures that - if one of the methods is compromised - the system itself is still likely safe from compromise.


Related Technical Impacts


References

TBD