Dev Training

# Dev Training
### Broken Authentication

## Overview

### Authentication

* Process of verifying the identity of a user
    * Username and password
    * Username, password and SMS
    * Electronic ID
    * SSO
* Extensive topic
* Sensitive and mission-critical part of applications

## Types of authentication

### Something you know

* Password
* PIN
* Security question
* Token

### Something you have

* Hardware/software token
* Certificate
* Email
* Phone (SMS or phone call)

### Something you are

* Biometrics
    * Fingerprint
    * Facial recognition
    * Iris scan
    * Handprint scan

## Passwords

### Complexity

* Enforce a minimum length of at least 8 characters
    * Don't require special characters
* Maximum length usually dictated by hashing algorithm
* Include a password strength meter
* Allow the use of all Unicode characters

### Help the user

* Educate the user about using password managers
* If password manager is not used, hint at using passphrases
* Check if provided passwords have been in any known leaks
    * [';--have i been pwned?](https://haveibeenpwned.com/)

## Multi-factor authentication

### What is it

* Use of more than one type of authentication
    * Two factors of the same type are not strictly considered MFA
    * **Any MFA is better than no MFA**

### Choosing a second factor

### First choice: FIDO2 devices

* Strong second factor
* Mitigates against phishing
* Usually use USB or NFC
* Can include biometrics
* Examples
    * Yubikey
Note: portable hardware devices that are separate from users' client device

### Second choice: TOTP

* Time-based pseudo-random password (PIN)
* Usually involve an authenticator app
    * Can also be dedicated hardware
* Examples
    * Google authenticator
    * FreeOTP
    * RSA (hardware)
Note: Time based one time password

### Third choices: SMS

* Server generates PIN
    * Use at least 6 digit/letter PIN
* PIN should be generated using cryptographically secure RNG
* Invalidate PIN after three attempts
    * Don't rely on rate limiting!

## Fourth choice: Email

* Same principles as SMS
* Weak second factor if password recovery is done through email
    * Compromised email implies compromised account

## Password reset

### Reset tokens

* Generated using a cryptographically secure RNG
* Long enough to withstand brute force attack
* Short lived
* Invalidated after use

## Session management

### Session token

* If used, should be at least 16 bytes
* Generated using a cryptographically secure RNG
* Session cookie
    * Set with Secure, SameSite and HttpOnly attributes

### Duration

* Depends on the purpose of application
* Very sensitive data
    * 15-60 minutes

### Logout

* Sessions must be invalidated when user logs out
    * Not enough to remove it from user's local storage
    * Can be difficult if auth tokens are used

### Session fixation

* Do not allow users to specify their own session tokens
* When logging in
    * Ignore provided session token
    * Always generate a new one
Note: Session Fixation is an attack that permits an attacker to hijack a valid user session.

### Cookies vs. Local storage

### State of affairs

* Cookies appear to be losing their cool factor
* Auth headers are becoming more popular
    * Especially in SPAs
    * Very common pattern with JWTs
Note: Single page application

### Pros and cons - Cookies

* Have had many years of hardening
* Are designed to be used as session storage
* Have protection against
    * XSS (`HttpOnly`)
    * CSRF (`SameSite`)
    * Man-in-the-middle (`Secure`)
* Can be cumbersome to use across domains

### Pros and cons - Local storage

* Usually used for some sort of auth tokens
* Easy to use across domains
* Protect against CSRF
* Have no protection against XSS

## Credential Stuffing

### Overview

Attack Type|Description
-----------|-----------
Brute Force| Multiple password attempts for one account
Credential Stuffing| User/pass pairs from a breach tested
Password Spraying| Single weak password tested for multiple accounts

### Mitigations

### Multi-factor authentication

* By far the best solution
* Protects against all stuffing attacks
* To improve usability
    * Only if login is from a new IP
    * Many login attempts have been made from IP

### Other

### Recaptcha

* Recaptcha on login page can slow down attacks significantly
* Mitigation against brute force and password spraying

### Account lockout

Lock out users for a set amount of time if wrong password has been entered a certain number of times within a specified period

* Can be efficient to prevent brute forcing
* Needs to be carefully implemented so that it can't be used to perform DoS attacks against users

## Misc

### Re-authentication

When sensitive features are used, require re-authentication or additional authentication (e.g., PIN)

## Electronic IDs

### Auðkenni's EIDs

* Great idea
* Execution has some flaws
* Current implementation is susceptible to
    * Phishing
    * Timing attacks
* Auðkenni's new app offers mitigations to attacks

## Epilogue

### Further reading

* [OWASP - Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)
* [OWASP - Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html)
* [OWASP - Forgot Password Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Forgot_Password_Cheat_Sheet.html)
* [OWASP - Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)

### Hall of fame

* [Sign in with Apple generated JWTs for any Email](https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-apple/)