Knock knock, who's there?
Authentication is the art of determining who someone is, and to do so with certainty. Since the advent of the web, this process has become treacherous as the implications of mishandling this process can compromise the rest of the environment. This risk, despite the potential impact, is often lost on non-security personnel--the user's convenience once again causing relaxation in security. OWASP lists it as the number 2 most pressing threat in web security, and characterizes the threat as having a severe impact, as seen in the following screenshot:
OWASP Summary for broken authentication and session management
Does authentication have to be hard?
Most authentication approaches start with the premise that there are valid users, usually with different privilege levels associated with them that need access to something. Now, how do we confirm they are who they say they are? These so-called credentials are very much analogous to physical security measures. The right person...
