Password Security, Authentication, and Session Attacks
Identity as a Security Control
Authentication Layers
Authentication can involve something you know, something you have, or something you are. Strong systems use layered controls, rate limiting, and secure recovery processes to reduce account takeover risk.
Authentication Terms
Password Testing Must Be Authorized
Credential attacks, even in a lab, require explicit permission and careful scope control because they can disrupt accounts or trigger alerts.
Common Weaknesses
Weak password policy, reused passwords, poor reset flows, exposed session tokens, predictable token generation, and missing MFA are common causes of compromise.
Why is hashing passwords better than storing them in plain text?
Hashing means the original password is not stored directly, reducing exposure in a breach.
Correct answer: It helps protect them if the database is exposed
What is the purpose of MFA?
MFA reduces the chance that one stolen secret is enough for access.
Correct answer: To require more than one factor to authenticate a user.
Session Management Risks
Sessions and Tokens
Once a user authenticates, the application often issues a token or cookie to track that session. If tokens are exposed, predictable, long-lived, or insufficiently protected, attackers may impersonate users.
Which issue most directly threatens session security?
Predictable tokens can be guessed or reused, undermining session integrity.
Correct answer: A predictable token
Why should session tokens be protected in transit and at rest on the client?
Session tokens are effectively temporary keys to the account.
Correct answer: Because token theft can let an attacker impersonate the user.