025 Identity and Privacy - 025.1 Identity and Authentication (weight: 3)

Digital Identities

• Importance of verifying identities when using digital services to protect personal data.
• Contract parties must be clearly identified for legal agreements.
• Public administrative services should only be accessed by authorized individuals.

Access Management Phases

• Authentication: Confirming a user or device’s identity through username, password, and a second factor.
• Authorization: Checking the permissions of a user or device after identity verification.
• Accounting: Logging actions taken by a user or device to monitor resource utilization.

Key Components of Digital Identities

• Access credentials (username and password) define a user's digital identity.
• Secure access credentials are critical for performing actions such as signing contracts or accessing personal data.

Identification Features

• Users typically have a username, often their email address, alongside a password for identification.
• Passwords should be known only to the user to validate requests safely.

Password Characteristics

• Passwords must avoid meaningful words or easily obtainable information (e.g., birthdays).
• Emphasizes the necessity of complex and random passwords to reduce the risk of password guessing.
• Regular password changes may lead to simpler password choices; unique passwords for different accounts are crucial.

Password Security Analysis

• Each additional character in a password exponentially increases possible combinations.
• For instance, a 10-character password using digits and letters yields over 430 trillion possibilities.

Password Attack Types

• Brute Force Attacks: Guessing passwords by trying all combinations; time-consuming and can involve predefined lists of common passwords.
• Dictionary Attacks: Using pre-compiled lists of words and common passwords combined with extensions or alterations.
• Credential Stuffing: Utilizing compromised credentials from one service to access others.

Risks Associated with Plaintext Passwords

• Storing passwords in plaintext makes them susceptible to theft and misuse.
• Advocates for hashing passwords to protect against unauthorized access.

Password Hashing and Security Methods

• Passwords should never be stored in plaintext; use hash functions to store hashed values instead.
• Rainbow Tables: Precomputed tables to reverse hash values into their original passwords, highlighting the need for secure password storage practices.
• Salted Hashes: To prevent recognition from rainbow tables, unique random characters (salts) are added to passwords before hashing.

Monitoring Leaked Passwords

• Numerous online services collect and allow users to check if their credentials have been compromised in data breaches.
• Example service: Have I Been Pwned.

Password Managers

• Tools designed to manage and store user credentials in an encrypted database.
• Generate complex passwords and help users maintain unique credentials across various services.
• Can be either offline (local storage) or online (cloud-based service) with respective pros and cons.

Multi-Factor Authentication (MFA)

• Combines multiple forms of verification: knowledge (password), possession (hardware token), and inherent traits (biometrics).
• Adds an additional layer of security against unauthorized access.

One-Time Passwords (OTP)

• Tokens that can only be used once, often generated by hardware tokens or authenticator apps.
• Two types include:
  • HOTP: Utilizes a counter and shared secret to generate a verifiable hash.
  • TOTP: Employs time-based values alongside a shared secret to continually refresh the authentication token.

Password Recovery Procedures

• Techniques for resetting passwords include security questions and recovery emails.
• Security questions are prone to guesswork due to their often publicly available answers.
• Recovery emails pose a risk if attackers gain access to the associated email accounts.

Conclusion

• The security of digital identities and credentials requires a multifaceted approach, highlighting strong passwords, effective user authentication methods, frequent monitoring, and solid password management practices.