Slide 6 · The Attackers
Who breaks authentication — and how.
Three different skill levels. All of them succeeding.
🤖
The Script Runner
Downloads a list of 380 million username/password pairs from a breach database and runs them against your login API. No coding skill required — the tools are free, the credential lists are cheap, and most APIs don't rate-limit login attempts.
🦾
The Token Thief
Finds a way to intercept or steal a valid auth token — via XSS, a crafted OAuth redirect, a URL that leaks the token into server logs, or phishing. Then uses the token directly. No password needed.
🧠
The Token Forger
Studies how the API issues JWT tokens. Discovers the signature isn't verified, or uses a weak secret, or accepts {"alg":"none"}. Crafts a token for any user ID they want. The API accepts it as legitimate.
The common thread
None of these attackers need to know your password. They bypass, steal, or forge the proof of identity. Broken authentication means the lock has multiple ways to open that were never intended.