new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

authentication/adaptive_authentication

2 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Adaptive authentication based on environmental attributes

Advanced applications can require different authentication stages depending on environmental and contextual attributes including: sensitivity of data being accessed; time of day; user location; IP address; device fingerprint. Examples: require MFA for first login from particular device but not subsequent logins from same device; allow single sign-on with login valid for a day but require reauthentication for sensitive areas; allow low-risk access with device identification but gradually require stronger authentication for more sensitive operations.

Adaptive authentication implementation design questions

When implementing adaptive authentication, consider: Are policies aligned with corporate and regulatory requirements? Which user/device attributes (IP, geolocation, fingerprint, time-of-day, behavioral biometrics) to monitor at session start? Which signals need refreshing during active session and at what cadence? How to ensure signal accuracy and handle missing/low-confidence data? What scoring model (weights, thresholds, ML, rule-based, hybrid) converts signals to risk tier? Where runs model (edge, API gateway, central service) and latency budget? What action maps to each risk tier (allow, CAPTCHA, step-up MFA, block, revoke session)? What user-facing messages and error codes accompany actions? At which code/platform layers invoke risk engine (login controller, middleware, API gateway, service mesh)? How propagate decisions across web, mobile, API clients? How mutate/extend/revoke tokens/cookies when mid-session check escalates? How synchronize state across concurrent devices/browser tabs? What monitoring/alerting for suspicious activity and user notification?

Give your agent this brain