Authenticating users Flashcards
Authentication
It is the process of determining whether someone (or something) is, in fact, who or what it declares itself to be.
Authentication factor
a category of evidence that a person has to present to prove they are who they say they are.
what are the 3 authentication factors
- Knowledge Factor –something you know, e.g., password
- Possession Factor –something you have, e.g., smart card
- Inherence Factor –something you are, e.g., fingerprint
Authentication vs authorisation
- Authentication is the process of validating the identity of a registered user before allowing access to
protected resources. - Authorisation is the process of validating that the authenticated user has been granted permission to
access the requested resources.
User authentication process
- Create and render a user login form.
- Retrieve the login credentials (e.g., username & password) from the submitted user login form.
- Query database for an existing user with the submitted username (Assume usernames are unique).
- Ask user to enter login credentials again or register for an account if:
a. no existing user with submitted username exists.
OR
b. user with submitted username does exist, but submitted password does not match existing password. - When login credentials match those of an existing user:
a. Log user into application (we will look at this later).
b. Redirect user to protected area (landing page).
Authentication vulnerabilities
authentication vulnerabilities occur when an attacker is successful
This can happen for instance:
* When the attacker can guess the credentials, or brute force them.
* When the credentials are leaked, and the attacker gets access to them.
* We have seen how to hash and encrypt data.
Brute force attack
*A Brute Force search (or exhaustive search) is a problem-solving technique that consists of trying all possible solutions to a problem until a correct solution (if it exists) is found.
*A Brute Force Attack primarily consists in an attacker configuring predetermined values (username/password combinations), making requests to a server using those values, and then analysing the response for success or failure.
how to prevent brute force attacks
- A strong password policy
- Biometrics
- Notification of unrecognised login
unrecognised device, location or IP address. - Comprehensive login process
- Limiting login attempts
Strong Secondary Authentication Factors
- One-time password (OTP) –A unique password which can only be used once.
- Time-based PIN –A sequence of digits which have to be entered within a short window, typically 30 to 60 seconds.
- Digital (PKI) certificates –A digital certificate, issued by a trusted certificate authority, is installed on the device or in the user’s browser.
CAPTCHA
*CAPTCHA stands for the Completely Automated Public Turing test to tell Computers and Humans Apart.
*It is an automated tool used to differentiate between real users and automated users, such as bots.
*CAPTCHAs provide challenges that are difficult for computers to perform but relatively easy for humans.
- Three main categories: text- based, image-based, and audio
reCAPTCHA
- Free CAPTCHA software by google
Drawbacks of CAPTCHA
- Disruptive and frustrating for users.
- May be difficult to understand or use for some audiences.
- Some CAPTCHA types do not support all browsers.
- Some CAPTCHA types are not accessible to users who view a website using screen readers or assistive devices.
- There is a range of automated technologies, including APIs, browser plug-ins and extensions that enable attackers to
bypass or solve CAPTCHA challenges.
Limiting authentication attempts
*One way to block brute force attacks is to lock out accounts after a defined number of incorrect authentication
attempts.
*Note however, account lockout is not always the best solution, because someone could easily abuse the
security measure and lock out hundreds of user accounts.
sessions
- A session is an object that allows you to store information specific to a user (browser) from one request to the next.
- A session persists state across requests.
- A session may take the form of a client side cookie or a server side token
authentication vs login
*Users are only being authenticated at this point.
*Our applications so far cannot distinguish between different multiple users.
* Need to create an identifiable web session for each user so their requests can be distinguished from other users.
