logo

Database

Description

The application's credential policy does not enforce the technical parameters required to resist guessing attacks: it allows passwords or passphrases below the recommended minimum length (or caps them below the recommended maximum), does not reject weak, word-based, previously breached, or context-specific credentials (e.g., username, app name), issues temporary passwords or OTPs (e.g., for account recovery, first login, or MFA) that are short-lived or short in name only, without sufficient entropy or length, and/or allows credentials to be shared or reused across multiple users or accounts.

Impact

Increase the chances of an attacker obtaining valid credentials through brute-force, dictionary, or credential-stuffing attacks, including via temporary passwords or OTPs issued during account recovery, onboarding, or MFA challenges.

Recommendation

- Require passphrases of at least four words or passwords of at least 20 characters, rather than short, word-based passwords, and do not impose an arbitrarily low maximum length that would reject strong passphrases. - Reject passwords found in known breach databases (e.g., via the HaveIBeenPwned API) and passwords built from context-specific words (e.g., username, service name) at creation and change time. - Generate temporary passwords and OTPs (recovery, first login, MFA, admin-issued) with sufficient entropy (temporary passwords: minimum 12 characters, mixed case, digits, and symbols; OTPs: minimum 6 digits) and force expiry after first use or within a short window (e.g., 15 minutes). - Require each user or system to have a unique, non-shared credential; reusing or sharing credentials across accounts prevents individual accountability and multiplies the impact of a single compromise. - Do not enforce arbitrary periodic password expiration without evidence of compromise: per NIST SP 800-63B, mandatory rotation leads users to choose weaker, predictable passwords. Enforce expiration only upon detected compromise, or per an applicable compliance requirement, and require MFA for all privileged accounts.

Threat

Anonymous attacker from the Internet.

Expected Remediation Time

⏱️ 30 minutes.