GENERAL KNOWLEDGE /
AUTHENTICATION

Authentication: a process which is a way to prove the identity of an entity.

1. PASSWORD AUTHENTICATION

Password authentication: data or account protected by username-password credentials.

Password attacks and defending against them:

• guessing (strong password)

• phising: via scamming (making careful considerations)

• spear phising: targeted phising (making careful considerations)

• brute-forcing: computer-aided mass-guessing (strong password)

• stuffing: trying found password on other services (using unique passwords on different services)

• malware: especially via keyloggers (antivirus softwares, good settings of browsers)

Generally, upon entering a password:

• check secure connection (a lock icon next to the URL marks HTTPS)

• do not speak sensitive data aloud

• block physical visibility of the keyboard and the screen (shoulder surfers)

Strong password:

• irregular: no rules within

• complex: long, upcase and lowcase letters, numbers and special characters

• single-use: one password per service

Ways to create a strong password:

• create an initialism: make a full expression shorter and use symbolism

• combine unrelated words together

• use a password manager

JUMP TO TOP

2. MULTI-FACTOR AUTHENTICATION

Authentication requires you to present evidence to prove your identity. This evidence comes in three common forms:

• evidence based on knowledge (something you know): password, PIN code

• evidence based on possession (something you have): bank card, phone, key, security token

• evidence based on inherence (something you are): fingerprint, voice, face (facial recognition)

The factors are well-separated and should not contain parts from other factors.

Attackers can steal these factors of authentication to obtain unauthorized access to an account. Depending on the location of the attacker, certain forms of evidence are easier to steal than others. Attacking more evidences from one factor means the same difficulty (e.g. stealing a password and a PIN), but in case of more factors the success rate of attacks falls significantly, for automated attacks it tends to zero.

The multi-factor authentication (MFA) combines minimum two of three factors.

The most popular form of MFA uses two factors; two-factor authentication (2FA):

• password and phone-generated code (or an app-generated code on the phone; weak if both are checked and entered on the same device e.g. on the phone)

• password and code sent via email (weak if both are checked and entered on the same device e.g. on the phone)

• bank card and PIN code

• password and security token inserted into the keyboard

• security token and fingerprint

Many 2FA systems make the second-factor code expire, and the need of generating another code after that.

A system can make the user to present evidence from time to time to keep the session open (e.g. bank applications).

It is possible to use 3FA or 4FA etc. but even together with the need of re-authentication in time would make the user suffer. Therefore, such systems can be found only at places with the highest security.

If the used factors are stored on the server, it would make other security concerns to rise. Better to use one-time generated codes as the second factor.

JUMP TO TOP

3. USER CHECKING

Many services are available for human interactions only (e.g. knowledge testing sites, webshops). In the age of automatism, there can be a need for checking whether the user is human. In such case, an other factor is added to the authorization process:

• evidence based on comprehension (what you see and-or combine)

This is a task inserted between factors which must be seen, understood and executed altogether to prove that the user is human. Popular tasks:

• type in what characters you see in a chaotic area

• type in what you hear

• select objects by similarity (physical interaction)

• solve an easy puzzle (physical interaction)

• slide a slide control (physical interaction)

Because today an AI could finish these tasks, the task expires after which a new task is shown.

JUMP TO TOP