[Clarification/For Discussion] Default credentials mean in 2.10.2 #764
Assignees
Milestone
Comments
|
My bad, this was assigned to me and I've stalled. Originally it was just as you said, for example, admin/admin123, and in hindsight, I can now see how this is actually not helpful in the way it was written. I'd really like to see how you'd make it better, so yeah please submit a PR |
|
If there are no more ideas, then alright will submit a PR later today. I think there's a way we could make this better. |
csfreak92
added a commit
to csfreak92/ASVS
that referenced
this issue
Oct 9, 2020
Suggestion to make 2.10.2 better. This Pull Request relates to issue OWASP#764 as per discussed.
|
@danielcuthbert, I analyzed it more about this requirement. It looks like this is about service authentication, though this ASVS requirement is still vague so I created a PR to make it better. Let me know your thoughts on it. |
|
thank you @csfreak92 ill check it this weekend! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
ASVS 4.0 - 2.10.2 verification requirement is:
Verify that if passwords are required, the credentials are not a default account.I would like to clarify from the community/maintainers of this project regarding the term
default credentialsmean on this control? Doesdefault credentialsstand for some applications that have default credentials after installation? The way I interpreted this is if an application is deployed/installed and there are default credentials it fails this verification requirement (e.g. phpmyadmin application has "root", "admin" or something similar default credentials that comes with the installation of the application).If my assumption and thinking is correct, I'll create a Pull Request to link this issue, else please help me understand this control better. This confuses our team a lot of times.
The text was updated successfully, but these errors were encountered: