owasp - Concept regarding authentication -


i need security validation on program, , 1 of things need answer, related authentication is" verify authentication decisions logged, including linear offs , soft-locks."

does knows linear off , soft-locks mean?

thank in advance,

thais.

i doing research on owasp asvs. linear back-of , soft-lock authentication controls used prevent brute force attacks , can against dos. linear back-of can implemented through algorithm blocking user/ip particular time , after every failed login attempt time increase exponentially e.g. first failed login block 5 minute, second failed login block 25 minute 3rd 125 min , on. per understanding have seen in articles , implemented in application oracle weblogic soft lock easier implement, ip address (which think helpful protect against dos , brute force using automated tools) or user name logged in database every failed login attempt , when threshold number of failed login attempts (e.g. 5) block ip address permanently. once account has been soft locked in application runtime, not try validate account credentials against backend system, preventing being permanently locked. asvs verification requirement clear on though. "verify resource governor in place protect against vertical (a single account tested against possible passwords) , horizontal brute forcing (all accounts tested same password e.g. “password1”). correct credential entry should incur no delay. example, if attacker tries brute force accounts single password “password1”, each incorrect attempt incurs linear off (say 5, 25, 125, 625 seconds) soft lock of 15 minutes ip address before being allowed proceed. similar control should in place protect each account, linear off configurable soft lock against user account of 15 minutes before being allowed try again, regardless of source ip address. both these governor mechanisms should active simultaneously protect against diagonal , distributed attacks."


Comments

Post a Comment

Popular posts from this blog

Android layout hidden on keyboard show -

i have strange problem layout. when tap on edittext , keyboard shown edittext stay on bottom , when tap on to hide keyboard , keyboard hides , edittext go should when want input text. when tap again, keyboard shown , edittext goes down behind keyboard... <relativelayout android:layout_width="match_parent" android:layout_height="match_parent" > <scrollview android:layout_width="match_parent" android:layout_height="fill_parent" android:above="@+id/rl_commands"> <textview android:layout_width="match_parent" android:layout_height="wrap_content"/> </scrollview> <relativelayout android:layout_width="match_parent android:layout_height="24dp" android:id="@+id/rl_commands" android:alignparentbottom="true">
Read more

google app engine - 403 Forbidden POST - Flask WTForms -

i have flask application running on google app engine. trying submit form built using wtform , keep getting following error. 403 forbidden: don't have permission access requested resource. either read-protected or not readable server. location.html (part of code) <form method=post action="/home/location"> .... <button type="submit" class="btn btn-primary" value="submit"> directions </button> </form> main.py @app.route('/home/location', methods=['post', 'get']) def location(): form = cfcdirections.direction(request.form) print(request.method) if request.method == 'post' , form.validate(): print("after if") directions = cfcdirections() street_no = directions.no street = directions.street suburb = directions.suburb postcode = directions.postcode
Read more

c - Why would PK11_GenerateRandom() return an error -8023? -

i looking through internet trying find source of pk11_generaterandom() function see why function fail. have program uses function when moved new flavor of linux, fails after forking ( fork() ) since not believe there problem nss, suspect doing incorrectly disregarded in older versions of linux new 1 there issue. the openssl package same on 'good' , 'bad' server: openssl 0.9.8e-fips-rhel5 01 jul nss rpm differs though. 'good' has nss-3.12.2.0-2.el5 and bas has version nss-3.15.3-4.el5_10 the 'good' server uses quite obsolete linux: linux 2.6.18-128.el5 #1 smp wed jan 21 08:45:05 est 2009 x86_64 x86_64 x86_64 gnu/linux enterprise linux enterprise linux server release 5.3 (carthage) red hat enterprise linux server release 5.3 (tikanga) the 'bad' server newer: linux bad 2.6.18-371.4.1.el5 #1 smp wed jan 29 11:05:49 pst 2014 x86_64 x86_64 x86_64 gnu/linux oracle linux server release 5.10 red hat enterprise linux server release
Read more