GoConqr hat ein neues Design! Sag uns, wie es dir gefällt.

Kostenlos registrieren

Quiz

10b Authentification

Yawen Hou 16 Fragen

Quiz starten

Dieses Quiz enthält Fragetypen, die sich im gewohnten Player öffnen.

Fragen in diesem Quiz (16)

  1. 1Access only make sense when we can [blank_start]authenticate[blank_end] subjects.
    3 common factors of authentification:
    > something you [blank_start]know[blank_end]: password, pin codes
    > something you [blank_start]own[blank_end]: paper card, smartphone
    > something you are: [blank_start]biometrics[blank_end]
    1. Abiometrics
    2. Bown
    3. Cknow
    4. Dauthenticate
  2. 2C[blank_start]redential[blank_end] [blank_start]stuffing[blank_end]:

    > List of usernames and pwd are published / sold on internet.
    > Hackers try the same credentials on different sites.
    1. Astuffing
    2. Bredential
  3. 3What can you do to store securely your passwords?
    > use [blank_start]password manager[blank_end]
    > need only to remember the [blank_start]master[blank_end] [blank_start]password[blank_end] to decrypt the credentials
    > you can choose a offline (local-file) [blank_start]password manager[blank_end], or an online (cloud) [blank_start]password manager[blank_end], but you need to trust them not to steal your password. The best is to use an [blank_start]open[blank_end] [blank_start]source[blank_end] server that you can host where you want.
    1. Apassword manager
    2. Bpassword manager
    3. Cpassword manager
    4. Dopen
    5. Esource
    6. Fmaster
    7. Gpassword
  4. 4The "something you own" is called a [blank_start]token[blank_end].
    > ex. Bingo cards
    -- prove that user owns the card, but can be easily photocopied
    > [blank_start]One[blank_end]-[blank_start]time[blank_end] [blank_start]password[blank_end] (OTP) [blank_start]token[blank_end]s
    -- OATH standard
    -- password change with time / click    Bild zu Frage 4
    1. AOne
    2. Btime
    3. Cpassword
    4. Dtoken
    5. Etoken
  5. 5The "something you own" is called a token.
    > [blank_start]TAN[blank_end] [blank_start]generators[blank_end]
    -- a calculator that generates an [blank_start]number[blank_end] based on [blank_start]input[blank_end] of the user
    -- can be used to [blank_start]sign[blank_end] a [blank_start]transaction[blank_end]
    -- proves the user owns the generator
    -- based on a smart card (bank card)

    > [blank_start]Smartphones[blank_end]
    -- [blank_start]OTP[blank_end] is sent by Sms or generated by App
    -- prove that user owns the phone / sim-card
    1. AOTP
    2. Bsign
    3. Ctransaction
    4. DTAN
    5. Egenerators
    6. FSmartphones
    7. Gnumber
    8. Hinput
  6. 6The "something you own" is called a [blank_start]token[blank_end].
    > a [blank_start]private[blank_end] [blank_start]key[blank_end] in a hardware token
    -- token [blank_start]signs[blank_end] a [blank_start]challenge[blank_end]
    -- proof that user owns [blank_start]token[blank_end]
    -- universal [blank_start]2nd[blank_end] [blank_start]factor[blank_end] standard
    1. A2nd
    2. Bfactor
    3. Ctoken
    4. Dsigns
    5. Echallenge
    6. Fprivate
    7. Gkey
    8. Htoken
  7. 7[blank_start]OATH[blank_end] is a standard for the generation of [blank_start]One[blank_end]-[blank_start]time[blank_end] password tokens.
    [blank_start]Counter[blank_end] based:
    hotp(seed, c) = truncate( hmac-sha1(seed, c))

    [blank_start]Time[blank_end] based:
    totp([blank_start]seed[blank_end], t) = hotp(k, t - t0 / x)
    1. AOATH
    2. BCounter
    3. CTime
    4. Dseed
    5. EOne
    6. Ftime
  8. 8Universal 2nd Factor is a standard usage of private keys.

    Each app generate a [blank_start]key[blank_end] [blank_start]pair[blank_end] and give the server the [blank_start]public[blank_end] key.
    On login, server sends a random [blank_start]challenge[blank_end] to client
    Client signs the [blank_start]challenge[blank_end] + name of the [blank_start]domain[blank_end] of the server + signature [blank_start]counter[blank_end]
    client sends the data and signature to server
    server verifies the [blank_start]signature[blank_end]
    1. Asignature
    2. Bchallenge
    3. Cdomain
    4. Dcounter
    5. Echallenge
    6. Fkey
    7. Gpair
    8. Hpublic
  9. 9Why do 2nd factor need the application to sign the domain + counter of the server as well?

    Domain: To prevent from [blank_start]phishing[blank_end] [blank_start]attacks[blank_end].
    Counter: To prevent [blank_start]cloning[blank_end] of the [blank_start]private[blank_end] [blank_start]key[blank_end]. (Detect not steady increment, aka the hacker increments one time more / less the counter).
    1. Aphishing
    2. Battacks
    3. Ccloning
    4. Dprivate
    5. Ekey
  10. 10[blank_start]FIDO2[blank_end] standardises the use of [blank_start]U2F[blank_end] within the browser with Javascript, called WebAuthn.

    [blank_start]FIDO2[blank_end] also make uses of [blank_start]Client[blank_end] to [blank_start]Authenticator[blank_end] Protocol to access to the signature.

    CTAP: describes how an [blank_start]app[blank_end] can ask an [blank_start]authenticator[blank_end] to generate a [blank_start]signature[blank_end].
    Authenticator: usb token/ smartphone

    The assertions asserts whether the user was:
    - [blank_start]present[blank_end] (clicked the button)
    - [blank_start]verified[blank_end] (had the right pin / fingerprint)
    1. AFIDO2
    2. BU2F
    3. CFIDO2
    4. DClient
    5. EAuthenticator
    6. Fapp
    7. Gauthenticator
    8. Hsignature
    9. Ipresent
    10. Jverified

Informationen

Beschreibung
- Information security (10 Access control, Authentication & protocols) Quiz am 10b Authentification, erstellt von Yawen Hou am 04/06/2019.
Sprache
English
Aufrufe
0
Bewertung
Noch keine Bewertungen
Bewerte dieses Quiz
Bewerte dieses Quiz

Feedback

Worum geht es?

Wie gefällt dir das neue Design?

Dein Eindruck