Merge branch 'master' of gitlab.science.ru.nl:mlubbers/ssproject1617

[ssproject1617.git] / report / v2_authentication.tex

diff --git a/report/v2_authentication.tex b/report/v2_authentication.tex
index 9c559e1..eb512cc 100644 (file)
--- a/report/v2_authentication.tex
+++ b/report/v2_authentication.tex
@@ -18,7 +18,7 @@ public (principle of complete mediation).
 \fail{}
 Verify that forms containing credentials are not filled in by
 the application. Pre-filling by the application implies that
 \fail{}
 Verify that forms containing credentials are not filled in by
 the application. Pre-filling by the application implies that

-credentials are stored in plaintext or a reversible format,
+credentials are stored in plain-text or a reversible format,

 which is explicitly prohibited.
 
 \begin{result}
 which is explicitly prohibited.
 
 \begin{result}


@@ -40,7 +40,7 @@ server side.
 \begin{result}
     All authentication controls (login credentials and client cookies) are
     enforced by the application. Note however item~\ref{auth:6}, about the
 \begin{result}
     All authentication controls (login credentials and client cookies) are
     enforced by the application. Note however item~\ref{auth:6}, about the

-    security of these controls in the immplementation.
+    security of these controls in the implementation.

 \end{result}
 
 \setcounter{enumi}{5}
 \end{result}
 
 \setcounter{enumi}{5}


@@ -65,8 +65,8 @@ attackers cannot log in.
 \item
 \pass{}
 Verify password entry fields allow, or encourage, the use
 \item
 \pass{}
 Verify password entry fields allow, or encourage, the use

-of passphrases, and do not prevent password managers,
-long passphrases or highly complex passwords being
+of pass-phrases, and do not prevent password managers,
+long pass-phrases or highly complex passwords being

 entered.
 
 \begin{result}
 entered.
 
 \begin{result}


@@ -219,14 +219,14 @@ services external to the application are encrypted and
 stored in a protected location.
 
 \begin{result}
 stored in a protected location.
 
 \begin{result}

-    The database credentials are hardcoded in \code{config.php}. While it
+    The database credentials are hard-coded in \code{config.php}. While it

     would be better to pass secrets as environment variables, this is not
     really bad practice.
 
     However, the installation instructions state the following:
     \begin{verbatim}
 Change the file permissions to allow all users write access to the
     would be better to pass secrets as environment variables, this is not
     really bad practice.
 
     However, the installation instructions state the following:
     \begin{verbatim}
 Change the file permissions to allow all users write access to the

-folder you extracted testcms to.
+folder you extracted TestCMS to.

     \end{verbatim}
     This implies making the configuration file readable for all users on the
     system. This information should not be accessible for any user other than
     \end{verbatim}
     This implies making the configuration file readable for all users on the
     system. This information should not be accessible for any user other than


@@ -291,7 +291,7 @@ transaction signing is in place for high value transactions.
 \item
 \fail{}
 Verify that measures are in place to block the use of
 \item
 \fail{}
 Verify that measures are in place to block the use of

-commonly chosen passwords and weak passphrases.
+commonly chosen passwords and weak pass-phrases.

 
 \begin{result}
     No password strengthening measures are implemented. The app should
 
 \begin{result}
     No password strengthening measures are implemented. The app should


@@ -351,12 +351,12 @@ untrusted parties.
 
 \item
 \pass{}
 
 \item
 \pass{}

-Browser autocomplete, and integration with password
+Browser auto-complete, and integration with password

 managers are permitted unless prohibited by risk based
 policy.
 
 \begin{result}
 managers are permitted unless prohibited by risk based
 policy.
 
 \begin{result}

-    Browser autocomplete functionality is not restricted in any way.
+    Browser auto-complete functionality is not restricted in any way.

 \end{result}
 
 \end{enumerate}
 \end{result}
 
 \end{enumerate}