Password-based authentication

Question 1

What are the advantages of password-based authentication?

Answer 1

1. It is a very convenient way to authenticate a user trying to access a system.

Question 2

What are the disadvantages of password-based authentication?

Answer 2

1. It is vulnerable to brute force or dictionary attacks depending on the strength of the password.
2. It puts security in the hands of the user, so the strength of the security is dependent on the user choosing a strong password.

Question 3

How do you choose a good password?

Answer 3

1. Easy to remember but hard to guess.
2. Length of 6-9 characters.
3. A mix of letters, numbers and special characters.
4. Avoid dictionary words.
5. Use different passwords for different accounts.
6. Change passwords on a regular basis (maybe every 3 months).

Question 4

Why are password selection policies hard to enforce/why is password-based authentication the weakest link?

Answer 4

1. Humans have limited capacity for memory therefore it is natural to choose a password that is easy to remember. However, this is in conflict with the requirements of a strong password.
2. Passwords can be vulnerable to dictionary attacks depending on how strong the passwords are.
3. The user could be willfully ignorant of information security or complacent, and therefore ignore selection password policies.

Question 5

What is biometrics authentication?

Answer 5

It is the use of biological signatures to authenticate a person trying to access a system. It is verifying your identity based on what you are as opposed to what you know or what you possess.

Question 6

What are the 2 main types of biometrics authentication methods?

Answer 6

1. Behavioral (e.g. voice, signature)
2. Physiological (e.g. iris, fingerprint)

Question 7

What are the 2 processes involved in biometrics authentication?

Answer 7

1. Identification - Who are you? One-to-many comparison against biometric samples in database
2. Verification - Are you who you claim to be? One to one comparison against previous stored templates for the user.

Question 8

How long does it take to crack a password?

Answer 8

For a password of x length and y possible characters:

No. of combinations = y^x

Using a computer that can perform z operations per unit time:

Time taken to crack = (y^x)/z