Read more about this topic in OWASP’s free Authentication Cheat Sheet 4 5 6 7 Authentication Authentication Authentication Authentication Sebastien can easily identify user Javier can use default, test or Sven can reuse a temporary Cecilia can use brute force and names or can enumerate them easily guessable credentials to password because the user does dictionary attacks against one or authenticate, or can use an old not have to change it on first use, many accounts without limit, or account or an account not or it has too long or no expiry these attacks are simplified due to necessary for the application insufficient complexity, length, expiration and re-use requirements for passwords 8 9 10 J
Read more about this topic in OWASP’s free Authentication Cheat Sheet Authentication 4 Authentication 5 Authentication 6 Authentication 7 Sebastien can easily identify user names or can enumerate them Javier can use default, test or easily guessable credentials to authenticate, or can use an old account or an account not necessary for the application Sven can reuse a temporary password because the user does not have to change it on first use, or it has too long or no expiry Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords 8 9 10 J
20130918180752%21OWASP-Cornucopia-Ecommerce_Website.docx