Difference between revisions of "Using single-factor authentication"

From OWASP
Jump to: navigation, search
(Reverting to last version not containing links to www.textc4tdom.com)
 
(10 intermediate revisions by 5 users not shown)
Line 1: Line 1:
 +
{{Template:Vulnerability}}
 
{{Template:SecureSoftware}}
 
{{Template:SecureSoftware}}
  
==Overview==
+
Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
  
 +
[[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]]
 +
 +
==Description==
 
The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.
 
The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.
  
==Consequences ==
+
'''Consequences'''
  
* Authentication: If the secret in a single-factor authentication scheme gets compromised, full authentication is possible.
+
* Authentication: If the secret in a single-factor authentication scheme gets compromised, full authentication is possible.
  
==Exposure period ==
+
'''Exposure period'''
  
* Design: Authentication methods are determined at design time.
+
* Design: Authentication methods are determined at design time.
  
==Platform ==
+
'''Platform'''
  
* Languages: All
+
* Languages: All
 +
* Operating platform: All
  
* Operating platform: All
+
'''Required resources'''
 
+
==Required resources ==
+
  
 
Any
 
Any
  
==Severity ==
+
'''Severity'''
  
 
High
 
High
  
==Likelihood   of exploit ==
+
'''Likelihood of exploit'''
  
 
High
 
High
  
==Avoidance and mitigation ==
+
While the use of multiple authentication schemes is simply piling on more complexity on top of authentication, it is inestimably valuable to have such measures of redundancy.
  
* Design: Use multiple independent authentication schemes, which ensures that - if one of the methods is compromised - the system itself is still likely safe from compromise.
+
The use of weak, reused, and common passwords is rampant on the internet. Without the added protection of multiple authentication schemes, a single mistake can result in the compromise of an account. For this reason, if multiple schemes are possible and also easy to use, they should be implemented and required.  
  
==Discussion ==
+
==Risk Factors==
  
While the use of multiple authentication schemes is simply piling on more complexity on top of authentication, it is inestimably valuable to have such measures of redundancy.
+
TBD
  
The use of weak, reused, and common passwords is rampant on the internet. Without the added protection of multiple authentication schemes, a single mistake can result in the compromise of an account. For this reason, if multiple schemes are possible and also easy to use, they should be implemented and required.
 
  
==Examples ==
+
==Examples==
  
 
In C:
 
In C:
Line 64: Line 66:
 
</pre>
 
</pre>
  
==Related problems ==
 
  
* [[Using password systems]]
+
==Related [[Attacks]]==
  
 +
* [[Attack 1]]
 +
* [[Attack 2]]
  
[[Category:Vulnerability]]
 
  
[[Category:Protocol Errors]]
+
==Related [[Vulnerabilities]]==
  
 +
* [[Using password systems]]
 +
 +
 +
==Related [[Controls]]==
 +
 +
* Design: Use multiple independent authentication schemes, which ensures that - if one of the methods is compromised - the system itself is still likely safe from compromise.
 +
 +
 +
 +
==Related [[Technical Impacts]]==
 +
 +
* [[Technical Impact 1]]
 +
* [[Technical Impact 2]]
 +
 +
 +
==References==
 +
 +
TBD
 +
 +
 +
__NOTOC__
 +
 +
 +
[[Category:OWASP ASDR Project]]
 +
[[Category:Vulnerability]]
 +
[[Category:Authentication Vulnerability]]
 
[[Category:OWASP_CLASP_Project]]
 
[[Category:OWASP_CLASP_Project]]

Latest revision as of 12:04, 27 May 2009

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.



Last revision (mm/dd/yy): 05/27/2009

Vulnerabilities Table of Contents

Description

The use of single-factor authentication can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme.

Consequences

  • Authentication: If the secret in a single-factor authentication scheme gets compromised, full authentication is possible.

Exposure period

  • Design: Authentication methods are determined at design time.

Platform

  • Languages: All
  • Operating platform: All

Required resources

Any

Severity

High

Likelihood of exploit

High

While the use of multiple authentication schemes is simply piling on more complexity on top of authentication, it is inestimably valuable to have such measures of redundancy.

The use of weak, reused, and common passwords is rampant on the internet. Without the added protection of multiple authentication schemes, a single mistake can result in the compromise of an account. For this reason, if multiple schemes are possible and also easy to use, they should be implemented and required.

Risk Factors

TBD


Examples

In C:

unsigned char *check_passwd(char *plaintext){
        ctext=simple_digest("sha1",plaintext,strlen(plaintext)...);
        if (ctext==secret_password())
          // Log me in
}

In Java:

String plainText = new String(plainTextIn)
MessageDigest encer = MessageDigest.getInstance("SHA");
encer.update(plainTextIn);
byte[] digest = password.digest();
if (digest==secret_password())
  //log me in


Related Attacks


Related Vulnerabilities


Related Controls

  • Design: Use multiple independent authentication schemes, which ensures that - if one of the methods is compromised - the system itself is still likely safe from compromise.


Related Technical Impacts


References

TBD