What factors besides implementation issues can lead to broken authentication?

Automated attacks (credential stuffing, brute force), social engineering (phishing), and poor design (weak passwords, no rate limiting) all break auth even when the code itself is correct.

1. Automated attacks

   • Credential stuffing (using leaked password lists)
   • Brute force attacks

2. Social Engineering

   • Phishing, pretexting
   • Tricking users into revealing credentials

3. Poor design

   • Weak password requirements
   • No rate limiting
   • Predictable session IDs

4. Implementation vulnerabilities

   • SQL injection in login
   • Timing attacks
   • Insecure password storage

Key insight: Security is only as strong as the weakest link - technical controls alone aren't enough.