Web Penetration Testing with Kali Linux - Third Edition

Authentication guidelines

The following is a list of authentication guidelines:

• Usernames or user identifiers must be unique for each user and be case insensitive (user is the same as User).
• Enforce a strong password policy that prevents the use of the following as passwords:
  • Username as password
  • Short (that is, less than eight characters) passwords
  • Single case passwords, that is, all lowercase or all uppercase
  • Single character set, such as all numbers, all letters, and no use of special characters
  • Number sequences (123456, 9876543210)
  • Celebrities, TV shows, movies, or fictional characters (Superman, Batman, Star Wars)
  • Passwords in public dictionaries, such as the top-25 most common passwords

• Always use secure protocols, such as TLS, ...