Mistake Review

Question 1

Problem with SSNs

Answer 1

• no separation between authentication and authorization –> conceptually broken
• can’t easily change SSN if it is exposed

Question 2

How to measure password security?

Answer 2

Entropy! (predictabiity)
- strong passwords are not vulnerable to dictionary attacks (do not use common words)
- strong passwords are LONG (length is more important than using numbers and special characters)

Question 3

Where to validate input?

Answer 3

on the server

Question 4

Risk of improper error handling

Answer 4

• broad category of issues that manifest when web applications do not detect or handle error conditions properly.
• common results in leakage of sensitive info: leak software and version information, leak code and system architecture details, facilitate attacks
• defenses: check and handle all error conditions & give simple, consistent, generic error messages

Question 5

Origin

Answer 5

Origin = <protocol, hostname, port>

Question 6

What does a Hash, MAC, and Signature give you?

Answer 6

HASH: Integrity
MAC: Integrity, Authentication
Signature: Integrity, Authentication, Non-repudiation