Security Checklist for Login Module

While a programmer is proceeding towards architecture of login module design and development, following checklist is quite important not only in terms of security but also to avoid frequent updation in the architecture of login system.

1. On password reset, all Login Remember must be removed automatically 
2. On password reset, user must be notified on his mail that his/her password has been reset.
3. On logout, blockage of pressing backward and again sending login credential information must be taken care.
4. User can check remember me option, but a special variable must be saved instead of password or user id as cookie in the browser. 
5. User can be asked to enter password of at least 6 characters.
6. After a gap of few months users can be prompted to update their password credentials based on their record over the frequency of invalid password entries.

While sending login details to the user, the data must be sent as POST method. When a login credentials are being sent using normal post method, it is necessary to disable back button or clear previous history.

However with the usage of ajax post method, this browser security mishaps are easily avoidable.

Password Security

Password security is one of the headache for all the organizations. Now each organization are using IT services, so top level management have sleepless nights when they start thinking over security and firewall settings for their office.

However when thinking of  password security unknowingly they indulge in such practices that in fact makes their data more prone to attacks from the potential risks and hack.

In fact small ?/ unique passowrds pay more to the risks encapsulation and security than the lots of bad practices used / prevalent in lots of the companies. In making the system more robust, people with incomplete technical know-about are most likely to add to the potential risks. The best option is to have the username and password to be unique and the most you can do.... one can follow these steps to make your system more robust:

• Create unique Username/Passowrd.
• Take everything into the session.
• Keep a note of the username which has been accessed more number times with wrong passowrd and use a third option as a field of input, if user enters incorrect passowrd authentication consecutively for three times.
• Here using smart scripts using Cookie... one can use AI to find the fault skewness for each userID and place with the userID so that it can be regularly updated keeping it average for the user response to the login for his/her ID. This scripts can know whether to block the login to the user or not and next time when he logs in you can tell the user itself that your login authentication was challenged. So that they can change the passowrd in that case.

Security has a lots more than only login. Changing the Password or recovery email ID is much more cumbersome than the hacking of user details. The smart scripts using AI can be better programmed to find if the user trying to change his her recovery emailID must be allowed or not. These fields can be decided on a lots of factors:

• Scripts must save the user's preferences his nature of moves when logs
• Even if user changes the recovery password, his old email ID must be attached there only for atleast some time until the actual user re-enters the ID.
• How long a user takes to reach his account can be better calculated with the smart scripts and data trends for the individual IDs.

        New Natkhat Club