Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Internet and Web Security > Videos > Flashcards

Videos Flashcards

1
Q

What HTTP response message is returned with a ‘curl -I http://192.168.100.11/’ if the user is not logged in?

A

HTTP/1.1 401 Unauthorised

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the 401 (Unauthorised) response message used by the server for?

A

To challenge the authorisation of a user.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What additional information must the server also add to its response?

A

What resource is requested to authorise the request.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What header field must the response include?

A

WWW-Authenticate

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Give an example of a WWW-Authenticate header field.

A

WWW-Authenticate: Basic realm=”VM Realm”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does the WWW-Authenticate header field contain?

A

At least one challenge applicable to the resource requested.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Explain the syntax shown in ‘WWW-Authenticate: Basic realm=”VM Realm”’

A

header-field: authentication-scheme secured-domain-for-which-authentication-is-required

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Can you provide username and password directly with curl?

A

Yes.
Using ‘curl -I -u user:hello http://192.168.100.11’.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What HTTP response is returned if the user is authorised?

A

HTTP/1.1 200 OK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Is the Basic authentication scheme a secure method of user authentication?

A

No.
The Basic authentication scheme is not a secure method of user authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Why does the Basic authentication scheme have poor protection?

A

There is no way to protect the entity that is transmitted in cleartext across the physical network used as a carrier.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Why should Basic authentication NOT be used to protect sensitive or valuable information.

A

Because Basic authentication involves the cleartext transmission of passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How can Basic authentication be used to protect sensitive or valuable information?

A

With enhancements such as HTTPS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Where does the danger in using Basic authentication arise?

A

From naive users that frequently reuse a single password to avoid the task of maintaining multiple passwords.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Why is reusing a single password frequently dangerous?

A

The threat is not only UNAUTHORISED ACCESS to documents on the server but also to any other resources on OTHER SYSTEMS that the user protects with the same password.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

HTTPS is an encrypted protocol. [T/F]

A

T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the alternate approach to Basic authentication called?

A

HTTP Digest Access Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How does HTTP Digest Access Authentication differ to Basic Authentication?

A

Instead of passing a string containing the password
* Client submits H1: a hash of username:realm:password
* Use cryptography hash eg. SHA-256
* Server only needs to keep a copy of H1 for authorised users

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Why is HTTP Digest Access Authentication more secure than Basic Authentication?

A

It uses a cryptographic hash to encrypt username:realm:password rather than Base-64.
The cryptograph hash is NOT reversible.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Give an example of a cryptographic hash.

A

SHA-256

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Where is the cryptographic hash passed?

A

HTTP header field.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Why is HTTP Digest Access Authorisation not secure?

A

Vulnerable to dictionary attacks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a dictionary attack?

A

When an attacker exhausts passwords in dictionary until there is success.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What kinds of passwords SHOULD HTTP Digest Access Authentication ONLY be used for?

A

Passwords that have a reasonable amount of entropy.
i.e. long password, lots of different characters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Can Digest Authentication be used over HTTP?

A

No. It SHOULD be over a secure channel like HTTPS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Digest Authentication provides a strong authentication. [T/F]

A

F

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Digest Authentication does not provide a strong authentication. [T/F]

A

T

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

In the physical world, organisations have processes to check user’s identity and issue “identity cards”.
Give two examples of identity checks.

A
  • Government passport/driving licence
  • Student card
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

In the online world, where must users provide their identity?

A
  • on Facebook/Google/etc
  • with their employers/university
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the client-side limitations of HTTP Simple Access Authentication?

A
  • Credentials passed in plain text (vulnerable to dictionary attacks)
  • No checking that this is indeed the user
  • No time limit
  • No specific purpose
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the server-side limitations of HTTP Simple Access Authentication?

A
  • Makes authorization decision
  • Challenge with the management of sensitive information
  • Compliance with regulations
  • To be repeated with every service
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

In the motivating printing scenario, what must the end-user not share with the printing service?

A

Username and password.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What must the end-user do instead?

A

Authenticate directly with a server trusted by the photo-sharing service which issues delegation-specific credentials to the printing service.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the printing service in this scenario? (terminology)

A

App/Client

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the photos in this scenario? (terminology)

A

Resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What is the Photo sharing service in this scenario? (terminology)

A

Resource server

37
Q

What is the end-user in this scenario? (terminology)

A

Resource owner

38
Q

What are the delegation credentials in this scenario? (terminology)

A

Access token

39
Q

What is OAuth 2.0?

A

A standard protocol for authorisation.

40
Q

What is the aim of OAuth 2.0?

A

To provide specific authorisation flows for web applications, desktop applications, mobile phones, and living room devices.

41
Q

What is OAuth developed within?

A

The IETF OAuth Working Group.

42
Q

What is the other standard protocol used for authorisation?

A

OpenID Connect

43
Q

OpenID Connect 1.0 is an ______ layer on top of ______.

A

identity
OAuth 2.0.

44
Q

What is the aim of OpenID Connect?

A

1) To allow Clients to verify the identity of the End-User based on the authentication performed by an Authorisation Server.
2) To obtain basic profile information about the End-User in an interoperable and REST-like manner

45
Q

What is an ID token similar to?

A

An identity card.

46
Q

What format is an ID token in?

A

A standard JWT format

47
Q

What does the ID token consist of when decoded?

A

1) Header
2) Payload
3) Verify Signature

48
Q

What is an ID token signed by?

A

The OpenID Provider (OP)

49
Q

How can an application obtain an ID token?

A

By redirecting the user to their OpenId Provider with an authentication request.

50
Q

What does JWT stand for?

A

JSON Web Token

51
Q

The ID Token asserts the _________ of the user with the _____ field in the payload.

A

identity
sub

52
Q

The ID Token specifies the _______ ________ with the ______ field in the payload.

A

issuing authority
iss

53
Q

An ID token is generated for a particular _________________ that is specified with the _____ field in the payload.

A

client/audience
aud

54
Q

What is a nonce in cryptography?

A

An arbitrary Number that can be used only ONCE in a cryptographic communication.
It is often a random or pseudo-random number issued in an authentication protocol to ensure that old communications cannot be reused in replay attacks.

55
Q

An ID token may contain a _____ specified in the ______ field in the payload.

A

nonce
nonce

56
Q

An ID token has an ______ ( ______ field in the payload) and ________ ______ ( ____ field in the payload).

A

issue
iat
expiration time
exp

57
Q

An ID token may include additional requested details about the subject. Give two examples.

A

Name
Email address

58
Q

Why is an ID token digitally signed?

A

So it can be verified by the intended recipients.

59
Q

Briefly describe the Auth 2.0 authorisation framework process.

A

1)
The Client Application requests an Access Token from the Authorisation Server.
2)
The Authorisation Server asks the user for permission to grant access to the Client Application.
3)
The user grants permission.
4)
The Authorisation Server generates an Access Token and returns it to the Client Application (with issue).
5)
The Client Application requests access to a resource from the Resource Server using the Access Token.

60
Q

Where is the protocol supporting the OAuth 2.0 Authorisation Framework standardised?

A

The IETF OAuth Working Group.

61
Q

What five participants are involved in the OAuth 2.0/OpenID Connect Protocol?

A

Browser - user agent
App - relying party
IdP - Identity provider
OP - OpenId Provider
RS - Resource Server

62
Q

What is OpenID Connect?

A
  • An open standard for decentralised authentication.
  • Used by Google, Facebook and Twitter.
  • It is a workflow used to authenticate users.
63
Q

What is the output artefact of OpenID Connect?

A

ID Token.

64
Q

What is an ID Token encoded as?

A

A JWT.

65
Q

What three parts does an ID Token consist of?

A

Header
Payload/body
Signature

66
Q

What is the Audience property of an ID token defining?

A

The application meant to be the final recipient of an ID token.
In most cases, a Client Application.

67
Q

What are Access Tokens designed to do?

A

Allow access to a resource, e.g. file, database, API.

68
Q

Where do Access Tokens come from?

A

OAuth 2.0

69
Q

What is OAuth 2.0 designed to do?

A

Allow an application to access specific resources on behalf of a user.

70
Q

What format are Access Tokens required to be in?

A

Trick question! Any format. There is no required format.

71
Q

What format are Access Tokens often in?

A

JWT (although this is not required).

72
Q

What is the intended audience of an Access Token?

A

A Resource Server.
(to access a resource)

73
Q

What is an ID token NOT intended for?

A

Authorisation.

74
Q

ID tokens should NOT be sent to an API. [T/F]

A

T

75
Q

Do ID tokens have authorisation information?

A

No.

76
Q

What is an Access token NOT intended for?

A

Authentication.

77
Q

ID tokens = Authentication
Access tokens = Authorisation
[T/F]

A

T

78
Q

Can an access token guarantee that a user is logged in?

A

No.

79
Q

ID Token = Authentication
Access Token = Authorisation [T/F]

A

T

80
Q

Why does an Access token have to be configured?

A

So it knows about an Authorisation server that it can trust.

81
Q

Describe the steps involved in an Authentication sequence with OpenID Connect.

A

1)
User connects with App.
2)
User redirected to login page with OpenId provider… potentially via a 3rd party identity provider.
3)
A single usage token is returned by OpenId Provider.
4)
The Client/user is redirected to the App. User callback with single usage token (passed as query parameter into a callback URL to return to App).
5)
App converts the single usage token to Identity Token and Access Token.
6)
User granted access by App.
5)
App requests resource access using Access Token.
6)
Resource server checks Access Token is valid.

82
Q

ID Token is not visible to the _______, but to the ______.

A

browser
App

83
Q

OAuth 2.0/OpenID Connect exploit ______ interaction patterns ( ______, ______).

A

HTTP
callbacks
redirects

84
Q

What does the Browser obtain?

A

Only the single usage token

85
Q

What does the OP sign?

A

ID token

86
Q

Is there a backchannel between RS and OP?

A

Yes

87
Q

Is revocation possible?

A

Yes

88
Q

What permissions are supported?

A

read, write
(approved by user during interaction with Authorisation service).

Internet and Web Security (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions