AWS Cloud Developer:Full-Stack -Security and Auth

Question 1

Difference between Authorization and Authentication

Answer 1

Authentication: Who is asking?
Authorization: Can they ask?

Question 2

How should passwords be stored?

Answer 2

Passwords should never be stored.

Question 3

Data in transit should always be encrypted using …

Answer 3

ssl or tsl

Question 4

What kind of encryption should be used to encrypt passwords?

Answer 4

One Way Hash

With OWH, the server compares hashes not passwords

Reversible encryption algorithms allow anyone with the key to decrypt a password

Question 5

One way hashing algorithms

Answer 5

bcrypt
scrypt
SHA-1
MD5

Question 6

What is one way of defeating a One Way Hashing algorithms, and how can we make it more secure?

Answer 6

Rainbow tables

This can be prevented by using Salts

Question 7

What are Salts?

Answer 7

A random string added to the beginning of a password before it is passed through a One Way Hashing Algorithm. This is to ensure that the same password never outputs the same hash string, making it difficult to decrypt using rainbow tables

Question 8

What is the gold standard for storing passwords?

Answer 8

As salted, hashed strings using bcrypt

Question 9

Bcrypt salt rounds

Answer 9

the password is passed through the salted hashing function, and the output is again passed through the hashing function in a loop. The more times we iterate on the hashing function, the more we can guard against brute force attacks that try to guess the password. The salt rounds decide how many times to go through this loop. Settings salt rounds to 10 means we iterate on this hashing function 2^10 times.

Question 10

How to avoid having to having to provide user password with every request?

Answer 10

Session ids stored on user’s browser, which are then provided in Request headers