GoConqr has a new look! Let us know what you think.

Sign up free

Quiz

10b Authentification

Yawen Hou 16 questions

Take the quiz

This quiz has question types that open in the usual player.

Questions in this quiz (16)

  1. 1Access only make sense when we can [blank_start]authenticate[blank_end] subjects.
    3 common factors of authentification:
    > something you [blank_start]know[blank_end]: password, pin codes
    > something you [blank_start]own[blank_end]: paper card, smartphone
    > something you are: [blank_start]biometrics[blank_end]
    1. Abiometrics
    2. Bown
    3. Cknow
    4. Dauthenticate
  2. 2C[blank_start]redential[blank_end] [blank_start]stuffing[blank_end]:

    > List of usernames and pwd are published / sold on internet.
    > Hackers try the same credentials on different sites.
    1. Astuffing
    2. Bredential
  3. 3What can you do to store securely your passwords?
    > use [blank_start]password manager[blank_end]
    > need only to remember the [blank_start]master[blank_end] [blank_start]password[blank_end] to decrypt the credentials
    > you can choose a offline (local-file) [blank_start]password manager[blank_end], or an online (cloud) [blank_start]password manager[blank_end], but you need to trust them not to steal your password. The best is to use an [blank_start]open[blank_end] [blank_start]source[blank_end] server that you can host where you want.
    1. Apassword manager
    2. Bpassword manager
    3. Cpassword manager
    4. Dopen
    5. Esource
    6. Fmaster
    7. Gpassword
  4. 4The "something you own" is called a [blank_start]token[blank_end].
    > ex. Bingo cards
    -- prove that user owns the card, but can be easily photocopied
    > [blank_start]One[blank_end]-[blank_start]time[blank_end] [blank_start]password[blank_end] (OTP) [blank_start]token[blank_end]s
    -- OATH standard
    -- password change with time / click    Image for question 4
    1. AOne
    2. Btime
    3. Cpassword
    4. Dtoken
    5. Etoken
  5. 5The "something you own" is called a token.
    > [blank_start]TAN[blank_end] [blank_start]generators[blank_end]
    -- a calculator that generates an [blank_start]number[blank_end] based on [blank_start]input[blank_end] of the user
    -- can be used to [blank_start]sign[blank_end] a [blank_start]transaction[blank_end]
    -- proves the user owns the generator
    -- based on a smart card (bank card)

    > [blank_start]Smartphones[blank_end]
    -- [blank_start]OTP[blank_end] is sent by Sms or generated by App
    -- prove that user owns the phone / sim-card
    1. AOTP
    2. Bsign
    3. Ctransaction
    4. DTAN
    5. Egenerators
    6. FSmartphones
    7. Gnumber
    8. Hinput
  6. 6The "something you own" is called a [blank_start]token[blank_end].
    > a [blank_start]private[blank_end] [blank_start]key[blank_end] in a hardware token
    -- token [blank_start]signs[blank_end] a [blank_start]challenge[blank_end]
    -- proof that user owns [blank_start]token[blank_end]
    -- universal [blank_start]2nd[blank_end] [blank_start]factor[blank_end] standard
    1. A2nd
    2. Bfactor
    3. Ctoken
    4. Dsigns
    5. Echallenge
    6. Fprivate
    7. Gkey
    8. Htoken
  7. 7[blank_start]OATH[blank_end] is a standard for the generation of [blank_start]One[blank_end]-[blank_start]time[blank_end] password tokens.
    [blank_start]Counter[blank_end] based:
    hotp(seed, c) = truncate( hmac-sha1(seed, c))

    [blank_start]Time[blank_end] based:
    totp([blank_start]seed[blank_end], t) = hotp(k, t - t0 / x)
    1. AOATH
    2. BCounter
    3. CTime
    4. Dseed
    5. EOne
    6. Ftime
  8. 8Universal 2nd Factor is a standard usage of private keys.

    Each app generate a [blank_start]key[blank_end] [blank_start]pair[blank_end] and give the server the [blank_start]public[blank_end] key.
    On login, server sends a random [blank_start]challenge[blank_end] to client
    Client signs the [blank_start]challenge[blank_end] + name of the [blank_start]domain[blank_end] of the server + signature [blank_start]counter[blank_end]
    client sends the data and signature to server
    server verifies the [blank_start]signature[blank_end]
    1. Asignature
    2. Bchallenge
    3. Cdomain
    4. Dcounter
    5. Echallenge
    6. Fkey
    7. Gpair
    8. Hpublic
  9. 9Why do 2nd factor need the application to sign the domain + counter of the server as well?

    Domain: To prevent from [blank_start]phishing[blank_end] [blank_start]attacks[blank_end].
    Counter: To prevent [blank_start]cloning[blank_end] of the [blank_start]private[blank_end] [blank_start]key[blank_end]. (Detect not steady increment, aka the hacker increments one time more / less the counter).
    1. Aphishing
    2. Battacks
    3. Ccloning
    4. Dprivate
    5. Ekey
  10. 10[blank_start]FIDO2[blank_end] standardises the use of [blank_start]U2F[blank_end] within the browser with Javascript, called WebAuthn.

    [blank_start]FIDO2[blank_end] also make uses of [blank_start]Client[blank_end] to [blank_start]Authenticator[blank_end] Protocol to access to the signature.

    CTAP: describes how an [blank_start]app[blank_end] can ask an [blank_start]authenticator[blank_end] to generate a [blank_start]signature[blank_end].
    Authenticator: usb token/ smartphone

    The assertions asserts whether the user was:
    - [blank_start]present[blank_end] (clicked the button)
    - [blank_start]verified[blank_end] (had the right pin / fingerprint)
    1. AFIDO2
    2. BU2F
    3. CFIDO2
    4. DClient
    5. EAuthenticator
    6. Fapp
    7. Gauthenticator
    8. Hsignature
    9. Ipresent
    10. Jverified

Information

Description
- Information security (10 Access control, Authentication & protocols) Quiz on 10b Authentification, created by Yawen Hou on 04/06/2019.
Author
Yawen Hou
Language
English
Views
0
Rating
No ratings yet
Rate this quiz
Rate this quiz

Feedback

What is it about?

What do you think of the new look?

How do you like it?