Authentication Flashcards
1
Q
What ist “access control”
A
authentication + authorisation
2
Q
Attacks against passwords?
A
- Guess
- phishing, spoofing, keylogging
- social engineering
3
Q
What are the risks of reusing a password?
A
Using the same or related passwords on multiple accounts means that one compromised system or account can lead to compromise of other accounts
4
Q
how to avoid password reuse?
A
- Generating service-specific passwords from one master password
- Password wallet
5
Q
Countermeasures against password guessing?
A
- limit login attempts
- prevent reuse of old passwords
- Password aging, i.e. mandatory periodic password changes
6
Q
difference between offline and online attack?
A
offline attack: cracking password from known hash of the password -> attacker can perform brute force
online attack: attacker tries to og in many times->System can limit number of login attempts
7
Q
How should you store passwords on a database?
A
- store as hash
- use a slow hash function
- include random account-specific “salt”
8
Q
What is biometric authentication?
A
verifying some physical feature of the user
