Authentication Systems

Systems of Authentication

User Authentication: Main concept of access control.

User identifies themselves with a credential and is verified by the system.

Common Auth Methods

Password: Something you know.

e.g., codeword, pin

Token: Something you have.

e.g., physical card with chip/magnetic stripe.

Biometric: Something you are.

e.g., fingerprint, blood, iris

Multifactor: Combination of something you know/have/are.

Needs at least 2 factors

Password Strengthenthing

Salting

A salt is a thing which is added to the password, usually:

saltedhash(password) = hash(password + salt), or
saltedhash(password) = hash(hash(password) + salt)

(All the system stores is saltedhash and salt)

The salt is then stored along-side the password. Even better if the salt is unique to each user.

This makes attacks that use precomputed tables (e.g., rainbow table attacks) impossible (e.g., a precomputed table of common tables, or telling when users have the same password)

Allow High-Entropy Passwords

There is no reason passwords should be needlessly restricted other than physical UI limitations (e.g., physical keypad on an ATM).

“You need this case, these special characters, etc.” makes users make predictable passwords that attackers can hone-in on.

UI is extremely important for communicating password limitations and requirements.

Users should be allowed to paste-into password fields (for password managers)

Example: Bad UI: Password Strength Bars

Even just a faulty “password strength” bar that gives a user false sense of security can encourage terrible passwords.

Unless your password strength bar can detect happiness!@#$%^, check against HaveIBeenPwned, and compare against known info (name, email, etc.), you shouldn’t even have it.

SSO

Single Sign On: One set of credentials gives access to a host of services.

e.g., college SSO gives access to email, Canvas, bookstore, library, enrollment, et cetera. - notice no single person provides everything (Instructure, Oracle PeopleSoft, Microsoft).

Remember: SSO isn’t the same as MFA, but generally we really want to secure SSO so we usually secure SSO with MFA.