Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions mappings/remediation_advice/remediation_advice.json
Original file line number Diff line number Diff line change
Expand Up @@ -1014,14 +1014,14 @@
"children": [
{
"id": "weak_password_policy",
"remediation_advice": "1. Allow all characters to be used for passwords to avoid shortening the key space for brute-force guessing.\n2. Do not impose character restrictions such as \"must have at least X number of specific character type\" in the password. This will shorten the key space for brute-force guessing.\n2. Disallow short password lengths. 8 characters is generally considered a good minimum password length.\n3. Allow for a large maximum password length.\n4. Do not advertise the maximum password length as this will shorten the key space for brute-force guessing.\n5. Disallow previous passwords from being used.\n6. Disallow the password being the same as the email or username.",
"remediation_advice": "1. Allow all characters to be used for passwords to avoid shortening the key space for brute-force guessing.\n2. Do not impose character restrictions such as \"must have at least X number of specific character type\" in the password. This will shorten the key space for brute-force guessing.\n3. Disallow short password lengths. 8 characters is generally considered a good minimum password length.\n4. Allow for a large maximum password length.\n5. Do not advertise the maximum password length as this will shorten the key space for brute-force guessing.\n6. Disallow previous passwords from being used.\n7. Disallow the password being the same as the email or username.",
"references": [
"https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md#implement-proper-password-strength-controls"
]
},
{
"id": "no_password_policy",
"remediation_advice": "1. Allow all characters to be used for passwords to avoid shortening the key space for brute-force guessing.\n2. Do not impose character restrictions such as \"must have at least X number of specific character type\" in the password. This will shorten the key space for brute-force guessing.\n2. Disallow short password lengths. 8 characters is generally considered a good minimum password length.\n3. Allow for a large maximum password length.\n4. Do not advertise the maximum password length as this will shorten the key space for brute-force guessing.\n5. Disallow previous passwords from being used.\n6. Disallow the password being the same as the email or username.",
"remediation_advice": "1. Allow all characters to be used for passwords to avoid shortening the key space for brute-force guessing.\n2. Do not impose character restrictions such as \"must have at least X number of specific character type\" in the password. This will shorten the key space for brute-force guessing.\n3. Disallow short password lengths. 8 characters is generally considered a good minimum password length.\n4. Allow for a large maximum password length.\n5. Do not advertise the maximum password length as this will shorten the key space for brute-force guessing.\n6. Disallow previous passwords from being used.\n7. Disallow the password being the same as the email or username.",
"references": [
"https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md#implement-proper-password-strength-controls"
]
Expand Down Expand Up @@ -1240,7 +1240,7 @@
},
{
"id": "clipboard_enabled",
"remediation_advice": "Ensure that copy/paste functionality is disabled on sensitive content like credit card numbers, social security numbers etc. as other apps on the same device can access data stored in clipboard.\nThe example below disables clipboard for the `textField` TextView in Android:\n```java\ntextField.setCustomSelectionActionModeCallback(new ActionMode.Callback() {\n public boolean onCreateActionMode(ActionMode actionMode, Menu menu) {\n return false;\n }\n\n public boolean onPrepareActionMode(ActionMode actionMode, Menu menu) {\n return false;\n }\n\n public boolean onActionItemClicked(ActionMode actionMode, MenuItem item) {\n return false;\n }\n\n public void onDestroyActionMode(ActionMode actionMode) {\n }\n});\ntextField.setLongClickable(false);\ntextField.setTextIsSelectable(false);\n```\nThe example below disables clipboard for UITextField in iOS:\n```swift\noverride public func canPerformAction(_ action: Selector, withSender sender: Any?) -> Bool {\n if action == #selector(copy(_:)) || action == #selector(paste(_:)) {\n return false\n }\n return true\n}\n```"
"remediation_advice": "Ensure that copy/paste functionality is disabled on sensitive content like credit card numbers, social security numbers etc. as other apps on the same device can access data stored in clipboard.\nThe example below disables clipboard for the `textField` TextView in Android:\n\n```java\ntextField.setCustomSelectionActionModeCallback(new ActionMode.Callback() {\n public boolean onCreateActionMode(ActionMode actionMode, Menu menu) {\n return false;\n }\n\n public boolean onPrepareActionMode(ActionMode actionMode, Menu menu) {\n return false;\n }\n\n public boolean onActionItemClicked(ActionMode actionMode, MenuItem item) {\n return false;\n }\n\n public void onDestroyActionMode(ActionMode actionMode) {\n }\n});\ntextField.setLongClickable(false);\ntextField.setTextIsSelectable(false);\n```\n\nThe example below disables clipboard for UITextField in iOS:\n\n```swift\noverride public func canPerformAction(_ action: Selector, withSender sender: Any?) -> Bool {\n if action == #selector(copy(_:)) || action == #selector(paste(_:)) {\n return false\n }\n return true\n}\n```\n\n"
},
{
"id": "auto_backup_allowed_by_default",
Expand Down