Merge branch 'master' of gitlab.science.ru.nl:mlubbers/ssproject1617

[ssproject1617.git] / report / v2_authentication.tex

diff --git a/report/v2_authentication.tex b/report/v2_authentication.tex
index 9c559e1..eb512cc 100644 (file)
--- a/report/v2_authentication.tex
+++ b/report/v2_authentication.tex
@@ -18,7 +18,7 @@ public (principle of complete mediation).
 \fail{}
 Verify that forms containing credentials are not filled in by
 the application. Pre-filling by the application implies that
-credentials are stored in plaintext or a reversible format,
+credentials are stored in plain-text or a reversible format,
 which is explicitly prohibited.
 
 \begin{result}
@@ -40,7 +40,7 @@ server side.
 \begin{result}
     All authentication controls (login credentials and client cookies) are
     enforced by the application. Note however item~\ref{auth:6}, about the
-    security of these controls in the immplementation.
+    security of these controls in the implementation.
 \end{result}
 
 \setcounter{enumi}{5}
@@ -65,8 +65,8 @@ attackers cannot log in.
 \item
 \pass{}
 Verify password entry fields allow, or encourage, the use
-of passphrases, and do not prevent password managers,
-long passphrases or highly complex passwords being
+of pass-phrases, and do not prevent password managers,
+long pass-phrases or highly complex passwords being
 entered.
 
 \begin{result}
@@ -219,14 +219,14 @@ services external to the application are encrypted and
 stored in a protected location.
 
 \begin{result}
-    The database credentials are hardcoded in \code{config.php}. While it
+    The database credentials are hard-coded in \code{config.php}. While it
     would be better to pass secrets as environment variables, this is not
     really bad practice.
 
     However, the installation instructions state the following:
     \begin{verbatim}
 Change the file permissions to allow all users write access to the
-folder you extracted testcms to.
+folder you extracted TestCMS to.
     \end{verbatim}
     This implies making the configuration file readable for all users on the
     system. This information should not be accessible for any user other than
@@ -291,7 +291,7 @@ transaction signing is in place for high value transactions.
 \item
 \fail{}
 Verify that measures are in place to block the use of
-commonly chosen passwords and weak passphrases.
+commonly chosen passwords and weak pass-phrases.
 
 \begin{result}
     No password strengthening measures are implemented. The app should
@@ -351,12 +351,12 @@ untrusted parties.
 
 \item
 \pass{}
-Browser autocomplete, and integration with password
+Browser auto-complete, and integration with password
 managers are permitted unless prohibited by risk based
 policy.
 
 \begin{result}
-    Browser autocomplete functionality is not restricted in any way.
+    Browser auto-complete functionality is not restricted in any way.
 \end{result}
 
 \end{enumerate}