CPR101 QUIZ 5

Password Security

• Nymi band uses fingerprint, facial recognition, ECG, and heartbeat pattern for authentication.
• PINs are insecure, with most people using a date to make them memorable, resulting in a limited range of 700 possibilities.

Better Password Policies

• User ID should be impersonal, not an email address.
• Passphrase should be 8-10-12-15 characters in length, with no complexity rules.
• Password expiration should be based on risk, not time.
• Reusing passwords should not be allowed.
• Block simple dictionary, commonly used, and previously breached passwords.
• Require two-factor ID, such as Microsoft Authenticator or U2F.

Password Storage

• Store passwords in a salted and hashed format using a standard library with Argon2id or PBKDF2.
• Do not invent your own password storage method.
• Obscurity does not equal security.

Password Alternatives

• Use a passkey instead of a password, starting with Microsoft or Google FIDO2.
• Use a hardware-based passkey with biometric authentication.

Security and Privacy

• Authentication should use multi-factor authentication (MFA).
• A strong password can be long, memorable, and satisfy bad rules.
• Generate a long random passphrase and check its strength and entropy.

Password Defense

• Check if a password has been previously breached or leaked.
• Use an email alias for the UserID.
• Use a password manager to generate unique, long, random, and strong passwords.
• Use a Diceware passphrase generator for long, memorable, and random passwords.

Password Managers

• Use a password manager such as 1Password, BitWarden, or MS Authenticator.
• Password managers can generate unique, long, random, and strong passwords for each account.

Authentication

• OpenID Connect authenticates users to multiple sites via a single account.
• Read the permissions requested to the authorization account.

Weak Passwords

• Weak passwords are guessable or reused across sites.
• Top three weak passwords are 123456, admin, and 12345678.
• Credential stuffing and cracking are common attacks.

Password Recovery

• "I forgot my password" relies on the strength of the email account's security and password.
• Answer security questions with lies to protect your identity.

Password Edit Rules

• Bad password rules include length, strength, and complexity requirements.
• Good password rules include using a passphrase and limiting password changes.

Authorization

• Authorization is the process of granting access rights to users.
• Role-based access control (RBAC) grants minimum authority needed for job functions.
• Permissions should be specific for each role and server.

Internet and Browser Security

• Use a DNS service that blocks malware and malicious domains.
• Use a VPN when accessing public networks.
• Always use HTTPS for sign-on.
• Use browser extensions to block tracking and test browser security.

Social Engineering

• Social engineering is a common attack method that uses social media to guess passwords and security questions.
• Be cautious when sharing personal information online.
• Use two-factor authentication to protect against phishing and cracking.