Karteikarten
Authentication
Karten in diesem Stapel (11)
- 1State 3 authentication techniquesSomething you: Have, Are, Know
- 2What is TOCTTOU?Time of check to time of use. How long a user is authenticated for. Longer periods may introduce security risks.
- 3Name 6 problems with passwords1. Can be forgotten 2. Can be guessed 3. Can be phished 4. Compromised password files 5. Keylogging 6. Weak passwords
- 4How can users be forced to choose stronger passwords?Password policies. Require upper/lower/special/digit characters, no dictionary words, change regularly, no reuse
- 5Discuss storing passwordsPlaintext = bad (admins, hacking). Store as hashes
- 6What is a shadow file?Where password hashes are stored in an OS. Typically read-only to prevent offline attacks.
- 7Describe the 2 password cracking attacks1. Offline: Hash is known, dictionary attack 2. Online: Against a live login service, typically achieved via phishing
- 8What is password salting?Append a random "salt" to passwords before hashing. Store the plaintext salt alongside the password hash
- 9What are the 2 benefits of salting?1. User passwords must be cracked one at a time 2. Prevents rainbow table attacks as password hashes cannot be precomputed
- 10Discuss Something You Have and give an exampleA physical object. Often combined with Something You Know (passwords). E.g. Two-factor Authentication
- 11Discuss Something You Are and give an exampleTypically refers to biometrics. Pro: Always with you. Neg: Cannot change, even if compromised. E.g. Fingerprint, iris, voice
Informationen
- Beschreibung
- Bachelors Degree Computer Science (Computer Security) Karteikarten am Authentication, erstellt von Alex Neves am 22/05/2016.
- Erstellt von
- Alex Neves
- Aufrufe
- 3
- Tags
- Bewertung