Stress Testing Authentication and Session Management

If an attacker can find or act like a legitimate user and the application believes him, then no amount of downstream protection can prevent illicit operation. In Chapter 8, Exploiting Trust Through Cryptography Testing, we saw how attackers can intercept and with some effort--proxy or decrypt information on the fly. A lot of things need to happen to make those attacks work, and the attacker runs the risk of being noticed by network defenses or aware users. The authentication applications use is another story. Users are constantly pressuring web application and security teams to streamline and improve the login experience, and this pressure often runs in direct conflict to the security of the application. Because the application owners are hesitant to push users to use newer hardware and software, experience any interruptions...