Fixing authentication and authorization
summary
API-backed apps fail mostly at authorization: broken object-level authorization, mass assignment and fragile layered logic lead to IDORs that let attackers iterate invoice IDs or flip admin=true in JSON. Attackers leverage leaked credentials — roughly 2.5 billion leaked credentials — and k-anonymity checks from haveibeenpwned wordlists for password spraying. SMS 2FA breaks via SS7 access for €500 and SIM swap; phishing proxies like evil-nginx phishing proxy capture passwords and TOTP. Fixes: use U2F/FIDO2, validate auth in each service, avoid localStorage for JWTs, consider Apache Shiro or Open Policy Agent for centralized policies.
AI-written summary · about
chapters (33)
- 0:00Introduction
- 1:12Why this should be interesting
- 2:18Googles vulnerabilities program
- 3:13Common misconceptions
- 4:33Password dumps
- 5:11Unique identities
- 5:29Password spraying
- 7:20Have I Been Poned
- 8:31Attack Surface
- 9:52Enumeration
- 11:33Authentication and authorization
- 12:01SMS interception
- 15:32How it works
- 16:33Phishing
- 17:10Security keys
- 18:16ToF
- 19:20Authorization
- 21:51Business logic
- 23:19API endpoint
- 24:22Open Policy Agent
- 25:52Shiro
- 26:44Instancelevel permission checks
- 27:46OpenPolls Agent
- 28:57OPA
- 29:45JWTs
- 30:29Common failures
- 32:05Out of order requests
- 33:08Microservices
- 33:35Common Scenario
- 34:13Common Mistake
- 35:49Tokens
- 37:22SPS
- 38:09Questions
related talks
39mAPI = Authentication’s Poorly Implemented
30mInsecurity protocols: an overview of modern authentication
29mAPI Security in 2017
37mCustomer Identity for Modern Apps and APIs
01h 00mSEVEN things about API security
47mLet’s stop blaming our users for getting hacked when it is our problem to solve
33mYour Identity Is Mine: Techniques & Insights From OS Identity Providers Research
53mGetting API Security Right