Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Internet and Web Security > Videos > Flashcards

Videos Flashcards

1
Q

What HTTP response message is returned with a ‘curl -I http://192.168.100.11/’ if the user is not logged in?

A

HTTP/1.1 401 Unauthorised

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the 401 (Unauthorised) response message used by the server for?

A

To challenge the authorisation of a user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What additional information must the server also add to its response?

A

What resource is requested to authorise the request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What header field must the response include?

A

WWW-Authenticate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Give an example of a WWW-Authenticate header field.

A

WWW-Authenticate: Basic realm=”VM Realm”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does the WWW-Authenticate header field contain?

A

At least one challenge applicable to the resource requested.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Explain the syntax shown in ‘WWW-Authenticate: Basic realm=”VM Realm”’

A

header-field: authentication-scheme secured-domain-for-which-authentication-is-required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Can you provide username and password directly with curl?

A

Yes.
Using ‘curl -I -u user:hello http://192.168.100.11’.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What HTTP response is returned if the user is authorised?

A

HTTP/1.1 200 OK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Is the Basic authentication scheme a secure method of user authentication?

A

No.
The Basic authentication scheme is not a secure method of user authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Why does the Basic authentication scheme have poor protection?

A

There is no way to protect the entity that is transmitted in cleartext across the physical network used as a carrier.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why should Basic authentication NOT be used to protect sensitive or valuable information.

A

Because Basic authentication involves the cleartext transmission of passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How can Basic authentication be used to protect sensitive or valuable information?

A

With enhancements such as HTTPS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Where does the danger in using Basic authentication arise?

A

From naive users that frequently reuse a single password to avoid the task of maintaining multiple passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Why is reusing a single password frequently dangerous?

A

The threat is not only UNAUTHORISED ACCESS to documents on the server but also to any other resources on OTHER SYSTEMS that the user protects with the same password.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

HTTPS is an encrypted protocol. [T/F]

A

T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the alternate approach to Basic authentication called?

A

HTTP Digest Access Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How does HTTP Digest Access Authentication differ to Basic Authentication?

A

Instead of passing a string containing the password
* Client submits H1: a hash of username:realm:password
* Use cryptography hash eg. SHA-256
* Server only needs to keep a copy of H1 for authorised users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why is HTTP Digest Access Authentication more secure than Basic Authentication?

A

It uses a cryptographic hash to encrypt username:realm:password rather than Base-64.
The cryptograph hash is NOT reversible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Give an example of a cryptographic hash.

A

SHA-256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Where is the cryptographic hash passed?

A

HTTP header field.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Why is HTTP Digest Access Authorisation not secure?

A

Vulnerable to dictionary attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a dictionary attack?

A

When an attacker exhausts passwords in dictionary until there is success.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What kinds of passwords SHOULD HTTP Digest Access Authentication ONLY be used for?

A

Passwords that have a reasonable amount of entropy.
i.e. long password, lots of different characters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Can Digest Authentication be used over HTTP?
No. It SHOULD be over a secure channel like HTTPS.
26
Digest Authentication provides a strong authentication. [T/F]
F
27
Digest Authentication does not provide a strong authentication. [T/F]
T
28
In the physical world, organisations have processes to check user’s identity and issue “identity cards”. Give two examples of identity checks.
* Government passport/driving licence * Student card
29
In the online world, where must users provide their identity?
* on Facebook/Google/etc * with their employers/university
30
What are the client-side limitations of HTTP Simple Access Authentication?
* Credentials passed in plain text (vulnerable to dictionary attacks) * No checking that this is indeed the user * No time limit * No specific purpose
31
What are the server-side limitations of HTTP Simple Access Authentication?
* Makes authorization decision * Challenge with the management of sensitive information * Compliance with regulations * To be repeated with every service
32
In the motivating printing scenario, what must the end-user not share with the printing service?
Username and password.
33
What must the end-user do instead?
Authenticate directly with a server trusted by the photo-sharing service which issues delegation-specific credentials to the printing service.
34
What is the printing service in this scenario? (terminology)
App/Client
35
What are the photos in this scenario? (terminology)
Resources
36
What is the Photo sharing service in this scenario? (terminology)
Resource server
37
What is the end-user in this scenario? (terminology)
Resource owner
38
What are the delegation credentials in this scenario? (terminology)
Access token
39
What is OAuth 2.0?
A standard protocol for authorisation.
40
What is the aim of OAuth 2.0?
To provide specific authorisation flows for web applications, desktop applications, mobile phones, and living room devices.
41
What is OAuth developed within?
The IETF OAuth Working Group.
42
What is the other standard protocol used for authorisation?
OpenID Connect
43
OpenID Connect 1.0 is an ______ layer on top of ______.
identity OAuth 2.0.
44
What is the aim of OpenID Connect?
1) To allow Clients to verify the identity of the End-User based on the authentication performed by an Authorisation Server. 2) To obtain basic profile information about the End-User in an interoperable and REST-like manner
45
What is an ID token similar to?
An identity card.
46
What format is an ID token in?
A standard JWT format
47
What does the ID token consist of when decoded?
1) Header 2) Payload 3) Verify Signature
48
What is an ID token signed by?
The OpenID Provider (OP)
49
How can an application obtain an ID token?
By redirecting the user to their OpenId Provider with an authentication request.
50
What does JWT stand for?
JSON Web Token
51
The ID Token asserts the _________ of the user with the _____ field in the payload.
identity sub
52
The ID Token specifies the _______ ________ with the ______ field in the payload.
issuing authority iss
53
An ID token is generated for a particular _________________ that is specified with the _____ field in the payload.
client/audience aud
54
What is a nonce in cryptography?
An arbitrary Number that can be used only ONCE in a cryptographic communication. It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.
55
An ID token may contain a _____ specified in the ______ field in the payload.
nonce nonce
56
An ID token has an ______ ( ______ field in the payload) and ________ ______ ( ____ field in the payload).
issue iat expiration time exp
57
An ID token may include additional requested details about the subject. Give two examples.
Name Email address
58
Why is an ID token digitally signed?
So it can be verified by the intended recipients.
59
Briefly describe the Auth 2.0 authorisation framework process.
1) The Client Application requests an Access Token from the Authorisation Server. 2) The Authorisation Server asks the user for permission to grant access to the Client Application. 3) The user grants permission. 4) The Authorisation Server generates an Access Token and returns it to the Client Application (with issue). 5) The Client Application requests access to a resource from the Resource Server using the Access Token.
60
Where is the protocol supporting the OAuth 2.0 Authorisation Framework standardised?
The IETF OAuth Working Group.
61
What five participants are involved in the OAuth 2.0/OpenID Connect Protocol?
Browser - user agent App - relying party IdP - Identity provider OP - OpenId Provider RS - Resource Server
62
What is OpenID Connect?
* An open standard for decentralised authentication. * Used by Google, Facebook and Twitter. * It is a workflow used to authenticate users.
63
What is the output artefact of OpenID Connect?
ID Token.
64
What is an ID Token encoded as?
A JWT.
65
What three parts does an ID Token consist of?
Header Payload/body Signature
66
What is the Audience property of an ID token defining?
The application meant to be the final recipient of an ID token. In most cases, a Client Application.
67
What are Access Tokens designed to do?
Allow access to a resource, e.g. file, database, API.
68
Where do Access Tokens come from?
OAuth 2.0
69
What is OAuth 2.0 designed to do?
Allow an application to access specific resources on behalf of a user.
70
What format are Access Tokens required to be in?
Trick question! Any format. There is no required format.
71
What format are Access Tokens often in?
JWT (although this is not required).
72
What is the intended audience of an Access Token?
A Resource Server. (to access a resource)
73
What is an ID token NOT intended for?
Authorisation.
74
ID tokens should NOT be sent to an API. [T/F]
T
75
Do ID tokens have authorisation information?
No.
76
What is an Access token NOT intended for?
Authentication.
77
ID tokens = Authentication Access tokens = Authorisation [T/F]
T
78
Can an access token guarantee that a user is logged in?
No.
79
ID Token = Authentication Access Token = Authorisation [T/F]
T
80
Why does an Access token have to be configured?
So it knows about an Authorisation server that it can trust.
81
Describe the steps involved in an Authentication sequence with OpenID Connect.
1) User connects with App. 2) User redirected to login page with OpenId provider... potentially via a 3rd party identity provider. 3) A single usage token is returned by OpenId Provider. 4) The Client/user is redirected to the App. User callback with single usage token (passed as query parameter into a callback URL to return to App). 5) App converts the single usage token to Identity Token and Access Token. 6) User granted access by App. 5) App requests resource access using Access Token. 6) Resource server checks Access Token is valid.
82
ID Token is not visible to the _______, but to the ______.
browser App
83
OAuth 2.0/OpenID Connect exploit ______ interaction patterns ( ______, ______).
HTTP callbacks redirects
84
What does the Browser obtain?
Only the single usage token
85
What does the OP sign?
ID token
86
Is there a backchannel between RS and OP?
Yes
87
Is revocation possible?
Yes
88
What permissions are supported?
read, write (approved by user during interaction with Authorisation service).

Internet and Web Security (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions