Access Control-Passwords Flashcards
What is user authentication?
Used to determine the identity of an individual accessing the system.
What are the three approaches for user authentication?
- Knowledge-based
- Token-based
- Biometric
What is knowledge-based authentication?
Users prove their identity through something they know, e.g. a shared secret, password.
What is token-based authentication?
Users prove their identity through something they possess. E.g. passport
What is biometric authentication?
Users prove their identity through a unique physiological characteristic e.g. fingerprint
What are the advantages of passwords?
- Easy to use
- Require no special equipment
- Offer an adequate degree of security in many environments.
What are the disadvantages of passwords?
- Users tend to choose passwords that are easy to guess.
- Many password-cracking tools are available.
How do we protect password tables?
Store the hashed password as opposed to the original password.
What are password tables prone to?
Dictionary attacks.
What is a dictionary attack?
Attacker compiles a dictionary of several thousand common words and computes hash for each one. Uses the dictionary to look for matches between the dictionary and the password table.
What is a better solution to ordinary password tables?
Add salt.
What is salting?
Where password tables append the salt to the password and hashes the result and stores it.
What are rainbow tables?
They involve computing chains. Chains start with some plaintext, and then is hashed and reduced repeatedly. The beginning and the end of the chain is stored.
