Understanding Authentication Methods

Authentication

• Authentication verifies a user’s identity.
• The primary purpose of authentication is to confirm a user is legitimate.
• Single-factor authentication uses a knowledge factor, like a password.
• Two-factor authentication combines two different types of factors.

Authentication Factors

• Knowledge-based factors involves something you know.
• Possession-based factors involves something you have.
• Inherence-based factors involves what you are.
• Temperature is not an authentication factor.
• A PIN is an example of a knowledge-based factor.
• A security token is an example of a possession-based factor and is a physical object.
• An iris scan is an example of an inherence-based factor and uses a biometric trait.

Multi-Factor Authentication (MFA)

• MFA stands for Multi-Factor Authentication.
• MFA uses two or more different factors.
• Two-factor authentication is more secure than single-factor authentication because it adds an extra security layer.
• The client submits login credentials first in the authentication flow.
• The server verifies credentials by checking a database.
• After a successful match, the server generates access and refresh tokens for session continuation.
• Two-factor authentication combines factors from different categories.
• Three-factor authentication involves using three different factors and requires three distinct proofs

Authentication Methods

• Single-factor authentication uses a single credential and one barrier.
• Remote user authentication verifies users over networks and challenge-response protocol.

Security Vulnerabilities and Attacks

• Passwords are common targets for phishing attacks.
• An offline dictionary attack compares password hashes to common ones and uses known hash values to guess passwords.
• A specific account attack targets a specific account repeatedly and focuses on one account.
• A popular password attack tests well-known passwords across many accounts using common passwords
• Password guessing involves guessing based on personal details.
• Attackers use personal information to guess passwords in password guessing.
• Temperature is not used as a factor.
• Workstation hijacking exploits an unattended workstation and involves taking over an unattended computer.
• Writing down a system-assigned password increases vulnerability.
• The vulnerability that arises from using default passwords makes it easier for attackers because defaults are well known.
• Reusing a password across devices increases vulnerability and it raises the risk if one is compromised.
• Storing passwords in plain text leads to data breaches because it is easily compromised.
• If a password file is compromised, attackers can run cracking programs leading to brute-force attempts.

Countermeasures and Policies

• Protecting the password file reduces the risk of offline dictionary attacks.
• Account lockout limits repeated login attempts and blocks further attempts.
• Enforcing strong password policies increases security by making passwords hard to guess.
• Unique password policies prevents password reuse across devices and reduces risk.
• Intrusion detection systems (IDS) monitors for suspicious activity and detects unauthorized access attempts.
• Guidelines for strong password creation. helps users to create strong passwords.
• Using salt in hashing helps defend against dictionary attacks because salt complicates pre-computation.

Hashing and Encryption

• A salt value in password hashing adds random data and randomizes the hash output, diversifying the hash output.
• The UNIX crypt(3) function, used for password hashing, is based on DES.
• The UNIX password hashing scheme performs 25 iterations.
• Hashed password storage is vulnerable to guessing attacks allowing attackers to run cracking programs.
• Using a hashed password scheme slows down attackers and uses salt and a slow hash function.
• Hashed passwords secures stored data.
• Cryptographic hashing provides one-way encryption in authentication producing irreversible hashes.
• Encrypted communication links secures data in transit and secures password file transmission.
• The term "hashed password" means that a password has been processed by a hash algorithm.
• Multiple iterations of encryption slow down attackers and improves password security in UNIX systems.
• A nonce creates a unique session and defends against replay attacks in remote authentication.

Tokens

• A security token is a physical device for authentication and is a tangible authentication tool.
• Tokens allow session continuation.
• Access tokens allow continued access and maintain the session.
• A refresh token extends the session securely and renews session access.
• A memory card token type contains electronic memory inside.
• A smartcard token type includes a built-in processor and processes data internally.
• Tokens generated by the server manage the session and control session continuity.
• A stolen security token may allow access if unaccompanied by another factor.

Biometrics

• Biometric authentication uses unique physical traits and relies on physical characteristics.
• Fingerprint and facial recognition are two common biometric examples and and are physical traits.
• Iris scan is biometric and an inherence-based factor.
• A common risk of biometric authentication is privacy issues as it may raise privacy concerns.
• Biometric systems may be affected by environmental factors.
• A biometric system registers biometric traits during the enrollment process and compares presented biometric data with stored templates during verification.
• The biometric system matches the biometric template.
• A biometric method, like fingerprint scanning, requires a sensor to capture data.
• Identification biometric system relies solely on biometrics and does not need extra credentials.
• Biometric templates are compared during authentication serve as references.

ATM Security

• A dedicated data connection in ATM systems secures the connection and isolates sensitive data.
• Connecting ATM systems over internet-linked networks increases ATM vulnerability because Internet connectivity raises risks.
• When ATM data crosses an unsecured network, data can be captured by attackers, leading to data interception.
• Vulnerability that affects ATM transactions, data is exposed to interception, leading to confidentiality and integrity risks.

Replay Attacks

• A nonce creates a unique session.
• A replay attack reuses valid messages maliciously and entails reusing captured authentication messages.

Authentication Systems

• The advantages of multi-factor authentication requires multiple proofs.
• The key weakness of single-factor authentication is that only one barrier exists so it relies on a single proof.
• An authentication system grants access when a password is verified and it allows entry upon verification.
• The ultimate goal of user authentication is to confirm identity and it aims to verify who you are.