How to do it...

General application principles for securely authenticating users apply to mobile applications as well. A great reference is OWASP's Authentication Cheat Sheet (https://www.owasp.org/index.php/Authentication_Cheat_Sheet). Common authentication controls and best practices consist of:

  • Proper password strength controls
    • Password length
      • 10 characters or more
    • Password complexity policies
      • 1 uppercase, 1 lowercase, 1 digit, 1 special character, and disallowing 2 consecutive characters such as 222
    • Enforce password history
      • Disallow the last three used passwords (password reuse)
  • Transmitting credentials only over encrypted communications (TLS)
    • Send credentials over an HTTP POST body
  • Re-authenticate users for sensitive ...

Get IoT Penetration Testing Cookbook now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial