The account lifecycle
1.[3p] Which properties must a password reset token have?
Which properties must a password reset token have?
Select all that apply
The answer is: At least 128 bits from a cryptographic generator, derived from nothing, Stored as a hash, so a leaked table yields no usable tokens, Consumed on first use, in the same transaction that changes the password
2.[3p] Why must completing a password reset invalidate every existing session for that user?
Why must completing a password reset invalidate every existing session for that user?
The answer is: The commonest reason to reset is suspected compromise, and a surviving attacker session makes the reset pointless
The answer is: The commonest reason to reset is suspected compromise, and a surviving attacker session makes the reset pointless
The answer is: The commonest reason to reset is suspected compromise, and a surviving attacker session makes the reset pointless
3.[2p] A completed password reset should sign the user straight in, since they proved control of the mailbox.
A completed password reset should sign the user straight in, since they proved control of the mailbox.
The answer is: False
4.[3p] Verification links are sometimes consumed before the user clicks. What is doing it, and what is the fix?
Verification links are sometimes consumed before the user clicks. What is doing it, and what is the fix?
The answer is: A mail scanner fetching every URL in the message, so verify on a POST from a button rather than on the GET
The answer is: A mail scanner fetching every URL in the message, so verify on a POST from a button rather than on the GET
The answer is: A mail scanner fetching every URL in the message, so verify on a POST from a button rather than on the GET
5.[3p] A stuffing run has 1,000,000 credential pairs spread over 50,000 proxy addresses. How many attempts does each address make?
A stuffing run has 1,000,000 credential pairs spread over 50,000 proxy addresses. How many attempts does each address make?
6.[3p] Backoff starts at 1 second and doubles each failure. What is the total accumulated delay, in seconds, across ten consecutive failures?
Backoff starts at 1 second and doubles each failure. What is the total accumulated delay, in seconds, across ten consecutive failures?
7.[3p] Why is hard account lockout after five failures a poor control?
Why is hard account lockout after five failures a poor control?
The answer is: An attacker sends five wrong passwords per account and locks out the whole user base
The answer is: An attacker sends five wrong passwords per account and locks out the whole user base
The answer is: An attacker sends five wrong passwords per account and locks out the whole user base
8.[3p] Match each counter to the attacker it actually catches.
Match each counter to the attacker it actually catches.
Per account, with backoff
Per credential pair
Global failed-to-successful ratio
Per IP address
a stolen pair replayed across many services
someone guessing hard at one particular person
a single machine brute forcing on its own
a stuffing campaign spread over thousands of addresses
Show the answer
Per account, with backoff: someone guessing hard at one particular person Per credential pair: a stolen pair replayed across many services Global failed-to-successful ratio: a stuffing campaign spread over thousands of addresses Per IP address: a single machine brute forcing on its own
9.[2p] Changing the email address on an account moves what, which is why it must be gated on the current password? One word.
Changing the email address on an account moves what, which is why it must be gated on the current password? One word.