2017 OWASP Top 10: Broken Authentication

New 2021 OWASP Lightboard Series:

Video 2/10 on the 2017 OWASP Top Ten Security Risks.

John Wagnon discusses the details of the #2 vulnerability listed in this year's OWASP Top 10 Security Risks: Broken Authentication. Learn about this security risk and how to guard against it.

[Sam-rphy]

So, credential stuffing is like a dictionary attack and automated attack is more of a brute force.

[Wayne_Robinson]

Having a shirt with a mirrored logo so it looks correct after processing the video is great attention to detail! As a side benefit, it might be entertaining to see how many people notice when wearing the shirt in public.

[ricardoblikman]

This is a hard one, it is extremely difficult to stop multiple username password attack on microservices in parallel from multiple addresses.

[anselmleo]

Thanks for the amazing breakdown @F5 DevCentral. I was wondering where token authentications like jwt and passport come into play?

[Felix-ogpd]

how to solve?
credential stuffing
automated attacks
top 10000 passwords

how to break?
multifactor auth
password check (that not top 10000)
password complexity
firewall

[ELEchico]

Thank you for the quick and straightforward explanations :)

[staynjohnson]

8:41
if initial sessionID is thrown away and the server creates a brand new session id(that is not sent to the browser i suppose?) to interact with the client, how would the server now verify the client ?

[thifranzini]

Congrats for this video! It helped me a lot!

[fahimuel]

Would have been better, if John would suggest how F5 Web Application Firewall or any other F5 products protects from broken authentication problem or any other OWASP top 10 issues.

[Eric-nmff]

Stopped watching at "password complexity" being suggested as a solution to any problem.