Identification and Authentication Failures
Weaknesses in verifying user identity: weak passwords, leaked sessions, or unlimited brute-force attempts.
What are Authentication Failures?
This category covers every weakness in confirming that 'you are really you'. It includes weak password policies, no protection against repeated guessing (brute-force), poor session management, and missing multi-factor authentication (MFA). The two most practical gaps, brute-force and weak passwords, are available to try in the demo tabs.
Brute-force: guessing until it breaks
If the server doesn't limit login attempts, an attacker can automatically try thousands of common passwords until one matches. The defenses are layered: temporary lockout after several failures, increasing delays, CAPTCHA, and most powerfully, MFA. Compare the unlimited version against the lockout version in the demo tabs.
Weak passwords: an easy door to open
Passwords like '123456' or 'password' sit at the top of every attacker's guess list. An app that allows weak passwords simply widens the door for brute-force. Encourage long, unique passwords, check them against known breached-password lists, and recommend a password manager.
Impact & prevention
Authentication failures lead to mass account takeover (credential stuffing) and even admin account compromise. Combine MFA, a healthy password policy, rate limiting, and proper session management so user identity is genuinely protected.