Authentication, Authorization and Trust

• Comparing Classes by Name
• Failure to Drop Privileges When Reasonable
• Failure to Check Whether Privileges Were Dropped
• Reflection Attack in an Authentication Protocol
• Capture-Replay
• Trusting Self Reported IP Address
• Trusting Self Reported DNS Name
• Using Referrer Field for Authentication
• Using Single-factor Authentication
• Use of Hard-coded Password
• Weak Password Systems
• Not Allowing Password Aging