Cybersecurity - User Authentication Flashcards
User Authentication
User authentication is the process of proving your identity before accessing a system. It makes sure that only the right person gets access.
📌 Example: When logging into Facebook, you enter your email and password to prove it’s really you.
User Access Control
Access control decides who can access what based on their identity and permissions.
📌 Example: At work, only IT staff can access server settings, while regular employees can’t.
Authentication Factors
There are three main ways to prove identity:
1️⃣ Something you know – Passwords, PINs, security questions.
2️⃣ Something you have – Smart card, security token, OTP (One-Time Password).
3️⃣ Something you are – Fingerprints, facial recognition, iris scan.
📌 Example: Bank apps use two-factor authentication (2FA), asking for a password + OTP.
Multi-Factor Authentication (MFA)
MFA uses two or more authentication factors for extra security.
📌 Example: Logging into Google with a password + phone verification code.
Biometrics
Biometrics uses unique physical traits to identify a person. Examples:
Fingerprint scanner on your phone.
Face ID to unlock iPhones.
📌 Example: Airports use facial recognition for passport checks.
Tokens
A token is a physical or digital item that proves your identity.
Physical token: A smart card or USB key.
Digital token: A one-time password (OTP) generated by an app.
📌 Example: YubiKey is a USB security token used for high-security logins.
Cognometrics
Cognometrics is authentication using how you think or remember things.
📌 Example: Answering security questions like “What is your pet’s name?” when resetting a password.
Single Sign-On (SSO)
SSO allows you to log in once and access multiple services.
📌 Example: Using your Google account to log into YouTube, Gmail, and Drive.
Brute-Force Attack
A brute-force attack tries every possible password until it finds the right one.
📌 Example: A hacker automatically tests millions of passwords to break into an account.
Wordlist Attack
A hacker uses a list of common passwords instead of testing all possible combinations.
📌 Example: Trying “password123” or “qwerty” because many people use them.
Password Stuffing
A hacker takes leaked passwords from one website and tries them on others.
📌 Example: If your LinkedIn password was hacked, a hacker might try it on Facebook.
Throttled vs. Unthrottled Guessing
Throttled Guessing – Slow attacks because login attempts are rate-limited.
Unthrottled Guessing – Fast attacks, usually done offline with a stolen password file.
📌 Example: A login form might block users after 5 wrong attempts to prevent brute-force attacks.
Secure Password Storage
Passwords should be stored safely using hashing, salting, and peppering.
📌 Example: Websites use bcrypt hashing to protect passwords so hackers can’t read them.
Password Complexity Rules
Complexity rules require users to create strong passwords (mixing letters, numbers, symbols).
📌 Example: Websites force passwords like “P@ssw0rd!” instead of “123456”.
Password Expiry
Forcing users to change passwords regularly to prevent long-term access by attackers.
📌 Example: Some companies require password changes every 3 months.
Intrusion Detection Systems (IDS)
An IDS monitors network activity and alerts admins when something suspicious happens.
📌 Example: If someone logs in from Russia, but they usually log in from Denmark, the system raises an alert.
Social Engineering
Hacking people instead of systems by tricking them into revealing passwords.
📌 Example: A hacker pretends to be IT support and asks an employee for their login details.
Phishing
Fake emails, messages, or websites trick users into entering passwords.
📌 Example: A fake “PayPal” email asks you to click a link and log in, but it’s a scam.
Shoulder Surfing
Watching someone enter their password by looking over their shoulder.
📌 Example: A hacker at a café watches you type your laptop password.
Smudge Attack
Using fingerprint marks on a touchscreen to guess a password pattern.
📌 Example: A hacker checks your phone screen to see the lock pattern you use.
Network Sniffing
Capturing data being sent over the network to steal unencrypted passwords.
📌 Example: Public WiFi without encryption lets hackers steal login details.
TLS & HTTPS
TLS (Transport Layer Security) encrypts website traffic to prevent network sniffing.
📌 Example: Google Chrome warns you if a website is not secure (HTTP instead of HTTPS).
Certificate Pinning
Prevents hackers from impersonating a website by checking the site’s real certificate.
📌 Example: Banking apps use certificate pinning to stop fake login pages.
Alternative Authentication (Side-Channel Attacks)
Hacking an account using password recovery methods instead of the actual password.
📌 Example: Resetting someone’s email password by answering their security question.
