What logging in actually is
1.[3p] A signed-in user requests GET /invoices/4192, an invoice belonging to somebody else. Which check is missing?
A signed-in user requests GET /invoices/4192, an invoice belonging to somebody else. Which check is missing?
The answer is: Authorization, since the session proves who they are and says nothing about what they may reach
The answer is: Authorization, since the session proves who they are and says nothing about what they may reach
The answer is: Authorization, since the session proves who they are and says nothing about what they may reach
2.[3p] Match each operation to what it actually provides.
Match each operation to what it actually provides.
Hash
MAC
Encryption
Base64
concealment of the content from anyone without the key
a way of writing bytes down, reversible by anyone
proof that a holder of the key produced this exact message
a one way digest, with no key and no way back
Show the answer
Hash: a one way digest, with no key and no way back MAC: proof that a holder of the key produced this exact message Encryption: concealment of the content from anyone without the key Base64: a way of writing bytes down, reversible by anyone
3.[3p] A token is six characters drawn from a 32-character alphabet. How many bits of entropy does it carry?
A token is six characters drawn from a 32-character alphabet. How many bits of entropy does it carry?
4.[2p] How many random bytes must crypto.getRandomValues fill to produce a token with 128 bits of entropy?
How many random bytes must crypto.getRandomValues fill to produce a token with 128 bits of entropy?
5.[3p] Why is Math.random unacceptable for generating a session identifier?
Why is Math.random unacceptable for generating a session identifier?
The answer is: Its output is a deterministic function of a small state that can be solved for from a few observed values
The answer is: Its output is a deterministic function of a small state that can be solved for from a few observed values
The answer is: Its output is a deterministic function of a small state that can be solved for from a few observed values
6.[2p] Base64 encoding the contents of a cookie stops the user from reading and altering them.
Base64 encoding the contents of a cookie stops the user from reading and altering them.
The answer is: False
7.[3p] Comparing a secret with === leaks information. What exactly leaks, and to whom?
Comparing a secret with === leaks information. What exactly leaks, and to whom?
The answer is: The length of the correct prefix, to anyone who can time the response, because comparison stops at the first difference
The answer is: The length of the correct prefix, to anyone who can time the response, because comparison stops at the first difference
The answer is: The length of the correct prefix, to anyone who can time the response, because comparison stops at the first difference
8.[3p] An attacker steals your users table, with emails, salts, password hashes and session rows. Which defences still do useful work?
An attacker steals your users table, with emails, salts, password hashes and session rows. Which defences still do useful work?
Select all that apply
The answer is: Slow password hashing, which bounds how fast the stolen hashes can be guessed offline, Storing a hash of each session token rather than the token itself, A second factor, which the stolen table does not supply
9.[2p] Put the three questions in the order a request must answer them.
Put the three questions in the order a request must answer them.
Is the claim true?
May they do this particular thing?
Who is this claiming to be?
Show the answer
b, a, c