4 ms·

This is one of the main things I test when doing application security assessments. I look at the various clients/interfaces and test each of them to see how th

This is one of the main things I test when doing application security assessments. I look at the various clients/interfaces and test each of them to see how their controls compare. It's quite often that certain clients or interfaces have far less security on them than others because it simply isn't convenient. One example would be two-factor on a VPS administration page. It's on the main site, but if you download the mobile app it's password only. Which means...it's password only (assuming you know how to use a proxy like Burp). So important to ensure that all interfaces to your app have the same minimum requirements for security.

iheartmemcache 11y ago
Are you sure the app wasn't internally using the UUID of the device as the second token? This[1] shows an analysis of the efficacy on Android 5.x even with rooted phones/malicious end-users. 99.5% isn't as good as an RSA SecurID but it's not too shabby. I'd imagine iOS has something similar too. If not, good catch, that's a glaring issue and a great attack vector as you could likely script away emulating the traffic of the device, and you've got a decent chance that since they're using a different authentication method, maybe rate limiting wouldn't be factored in as well. Out of curiosity, what else do you audit? [1] http://stackoverflow.com/questions/2785485/is-there-a-unique-android-device-id/5626208#5626208 http://stackoverflow.com/questions/2785485/is-there-a-unique...