,
5 tweets,
3 min read
Read on Twitter
Old practice 2.32 wanted you to make sure administrative interfaces weren’t accessible to untrusted networks. This may have been removed because it becomes more difficult in a cloud-hosted world, or maybe because some apps use the same login interface for admins and normal users.
Finally, gone is the old 2.18 requirement to verify that username enumeration isn’t possible in login or account recovery functions. While preventing account enumeration is good, it tends to provide little value at the expense of the user experience: security.stackexchange.com/questions/6266…
I created a Google spreadsheet to compare the section 2 authentication requirements of the ASVS 4.0 and 3.0 side by side. You can access it here: docs.google.com/spreadsheets/d…
I want to thank the OWASP organizers and volunteers who developed this standard and made the tough decisions about what practices to include/exclude. Project leads include @vanderaj @JoshCGrossman @dcuthbert @m8urnett & @manicode
Link back to the parent tweet thread which I should have linked in the first tweet of this thread...
