Lesson test: The account lifecycle

Sign in

Libre University uses your GitHub account. Signing in is only needed to sit a final test, so the score is kept on your profile.

The account lifecycle

1.[3p]
Which properties must a password reset token have?

Select all that apply

At least 128 bits from a cryptographic generator, derived from nothing

Correct

Stored as a hash, so a leaked table yields no usable tokens

Correct

Consumed on first use, in the same transaction that changes the password

Correct

Encrypted rather than hashed, so support staff can read it back

The answer is: At least 128 bits from a cryptographic generator, derived from nothing, Stored as a hash, so a leaked table yields no usable tokens, Consumed on first use, in the same transaction that changes the password

2.[3p]
Why must completing a password reset invalidate every existing session for that user?

The commonest reason to reset is suspected compromise, and a surviving attacker session makes the reset pointless

Correct

Sessions created before a reset use an older signing key

The answer is: The commonest reason to reset is suspected compromise, and a surviving attacker session makes the reset pointless

Otherwise the reset token cannot be marked as used

The answer is: The commonest reason to reset is suspected compromise, and a surviving attacker session makes the reset pointless

Browsers refuse to accept a new cookie while an old one is live

The answer is: The commonest reason to reset is suspected compromise, and a surviving attacker session makes the reset pointless

3.[2p]
A completed password reset should sign the user straight in, since they proved control of the mailbox.

True

The answer is: False

False

Correct

4.[3p]
Verification links are sometimes consumed before the user clicks. What is doing it, and what is the fix?

A mail scanner fetching every URL in the message, so verify on a POST from a button rather than on the GET

Correct

The mail client caching the page, so add a no-store header

The answer is: A mail scanner fetching every URL in the message, so verify on a POST from a button rather than on the GET

The user's browser prefetching, so make the token longer

The answer is: A mail scanner fetching every URL in the message, so verify on a POST from a button rather than on the GET

A retry in the mail queue, so send the message only once

The answer is: A mail scanner fetching every URL in the message, so verify on a POST from a button rather than on the GET

5.[3p]
A stuffing run has 1,000,000 credential pairs spread over 50,000 proxy addresses. How many attempts does each address make?

CorrectNot quite: 20

6.[3p]
Backoff starts at 1 second and doubles each failure. What is the total accumulated delay, in seconds, across ten consecutive failures?

CorrectNot quite: 1023

7.[3p]
Why is hard account lockout after five failures a poor control?

An attacker sends five wrong passwords per account and locks out the whole user base

Correct

It resets the password hash parameters

The answer is: An attacker sends five wrong passwords per account and locks out the whole user base

It stops legitimate users only after the attacker has already succeeded

The answer is: An attacker sends five wrong passwords per account and locks out the whole user base

It cannot be applied before the password hash runs

The answer is: An attacker sends five wrong passwords per account and locks out the whole user base

8.[3p]
Match each counter to the attacker it actually catches.

Per account, with backoff
Per credential pair
Global failed-to-successful ratio
Per IP address

a stolen pair replayed across many services
someone guessing hard at one particular person
a single machine brute forcing on its own
a stuffing campaign spread over thousands of addresses

Show the answer

Per account, with backoff: someone guessing hard at one particular person Per credential pair: a stolen pair replayed across many services Global failed-to-successful ratio: a stuffing campaign spread over thousands of addresses Per IP address: a single machine brute forcing on its own

9.[2p]
Changing the email address on an account moves what, which is why it must be gated on the current password? One word.

CorrectNot quite: recovery

1.[3p] Which properties must a password reset token have?

2.[3p] Why must completing a password reset invalidate every existing session for that user?

3.[2p] A completed password reset should sign the user straight in, since they proved control of the mailbox.

4.[3p] Verification links are sometimes consumed before the user clicks. What is doing it, and what is the fix?

5.[3p] A stuffing run has 1,000,000 credential pairs spread over 50,000 proxy addresses. How many attempts does each address make?

6.[3p] Backoff starts at 1 second and doubles each failure. What is the total accumulated delay, in seconds, across ten consecutive failures?

7.[3p] Why is hard account lockout after five failures a poor control?

8.[3p] Match each counter to the attacker it actually catches.

9.[2p] Changing the email address on an account moves what, which is why it must be gated on the current password? One word.

1.[3p]
Which properties must a password reset token have?

2.[3p]
Why must completing a password reset invalidate every existing session for that user?

3.[2p]
A completed password reset should sign the user straight in, since they proved control of the mailbox.

4.[3p]
Verification links are sometimes consumed before the user clicks. What is doing it, and what is the fix?

5.[3p]
A stuffing run has 1,000,000 credential pairs spread over 50,000 proxy addresses. How many attempts does each address make?

6.[3p]
Backoff starts at 1 second and doubles each failure. What is the total accumulated delay, in seconds, across ten consecutive failures?

7.[3p]
Why is hard account lockout after five failures a poor control?

8.[3p]
Match each counter to the attacker it actually catches.

9.[2p]
Changing the email address on an account moves what, which is why it must be gated on the current password? One word.