The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

Use Strong Credentials

■■

Suitable minimum password quality requirements should be enforced.

These may include rules regarding: minimum length; the appearance of

alphabetical, numeric, and typographical characters; the appearance of

both uppercase and lowercase characters; the avoidance of dictionary

words, names, and other common passwords; the prevention of a pass-

word being set to the username; and the prevention of a similarity or

match with previously set passwords. As with most security measures,

different password quality requirements may be appropriate for differ-

ent categories of user.

■■

Usernames should be unique.