Passwords and Authentication

Page 1

Identification- Who you are

Authentication- Verify that identity

Passwords are digital keys, demonstrates someone is who they say they are and understood by users.

Passwords are a terrible way to handle authentication

Password problems:

People forget them

Can be guessed

Spoofing/ phishing

Comprimised password files

Keylogging

Made worse by weak passwords

Password policies not always great solution

People re-use passwords

When forced to change, they simply increment a counter

Storing passwords-

In plain text is terrible, encrypted better but not perfect- where are they stored? admins can read them

One way hash function much better solution

OS's have taken steps to stop people reading hashes for offline attacks- using shadow files (linux) SAM (windows)

Read protected but by booting another OS will often let you read them

Cracking:

Offline- you have copy of the hash locally, either brute force or dictionary attacks

Online- do not have the hash and attempting to gain access to a login terminal, usually attempted with phishing

Dictionary attacks use list of common words and passwords, applying small variations to this list, trying them all and combining words from two different lists

Password salting

Can improve security by prepending a random salt to a password before hashing, salt is stored unencrypted with the hash.

Random salt for each user means cracking mutliple passwords is slower, hit for a single user not all users with that password

Prevents rainbow table attacks- can't precompute that many password combinations

No effect on speed of cracking a single password

Hash function

Most important factor in password cracking is hashing speed

Newer algorithms take longer- more complex and some specifically designed to take a while

Iterate to increase complexity

System design issues

PIN codes can be short, as only test 3 before locked out

Locking out fine in principle but could lead to DoS

Poorly designed interface = problems e.g. ATMs designed to stop "shoulder surfing"

Attacks on password storage common- obtaining shadow files, SQL injection of web databases

Alternatives to passwords

Passwords are something you know

What about something you have - e.g. key, keycard

Two factor authentication- combines something you know with something you have

E.g. text codes to mobiles, one time passwords

Biometrics- e.g. fingerprint, iris/ retina recognition, voice, gait, typing rhythm

Accuracy of such systems extremely important, trade off between false positive and false negative rates

Modern fingerprint recognition is 99% accurate

Location of access e.g. operator console vs others/ office PC vs home PC/ geographical location- useful addition to 2 factor authentication

Page 2