Preventing Password Guessing Attacks

Smart cards are similar in shape and size to a driver's license.

A password is vulnerable if it is short and easy to guess, like a birthday or a child's name.

To prevent guessing, it is recommended to use a long and randomly generated password.

Smart cards have an integrated microprocessor that allows them to perform calculations on stored data.

Smart cards can only store information but cannot perform any calculations.

A dictionary attack involves trying all possible combinations of characters to crack a password.

In password-based authentication, the system stores user names along with the plain-text passwords in a file.

The transformation function F applied to the password makes it easy to compute the original password.

One of the advantages of passwords is that they do not need to be memorized by the user.

Eavesdropping refers to the act of physically stealing a password.

Stealing a password can be prevented if the user writes it down instead of committing it to memory.

Accessing a file where passwords are stored is an example of an attack on passwords.

The microcomputer of a smart-card performs a two-way transformation on the PIN.

The mathematical function (f) used in the smart-card transformation can be easily determined.

The smart card's microcomputer chip compares the entered PIN with the stored PIN to authenticate the user.

Biometrics systems can identify users based on either physiological or behavioral characteristics.

One of the properties of a biometric characteristic is that it should be constantly changing over time.

Circumvention means that it should be easy to fool the system by fraudulent techniques.

User Authentication is the process of verifying that the user's claimed-identity is valid.

Message Authentication ensures that the receiver knows the sender's identity and that the message is not sent by an imposter.

User Authentication can be based on something the user knows, such as a fingerprint or voice scan.

Biometrics like iris scan, retina scan, or hand geometry fall under the category of 'Something the user knows' for authentication.

Password-based Authentication involves using a protected string of characters to authenticate an individual.

Message Authentication primarily focuses on verifying the user's identity before granting access to system resources.

Behavior-based biometrics is one of the two parts into which biometrics is divided.

During enrollment, the user introduces their biometric information to the device for the first time.

Matching in biometric authentication involves comparing the live template with the stored template to generate a biometric score.

In multi-factor authentication, at least three authentication techniques are combined for stronger assurance.

Two-factor authentication (2FA) allows presenting three pieces of evidence when logging in.

Live presentation in biometric authentication refers to extracting fingerprint features.