Authentication KAMI VANIEA 1
|
|
|
- Delilah Stevens
- 5 years ago
- Views:
Transcription
1 Authentication KAMI VANIEA FEBRUARY 1ST KAMI VANIEA 1
2 First, the news KAMI VANIEA 2
3 Today Basics of authentication Something you know passwords Something you have Something you are KAMI VANIEA 3
4 Most recommended security behaviors 2/5 non-experts advice involves authentication 4/5 expert advice involves authentication KAMI VANIEA 4
5 Authentication Verifying a fact about an entity before allowing it to perform an action Entity could be a person or a computer or even an animal (think dog doors) Action can include viewing, reading, writing, or interacting in any way Authentication should happen every time an action is taken and there is no way to be certain that the authenticated entity has not changed. When logging into a website it looks like you only authenticate once, but your computer is actually authenticating for you every time it talks to the server to prevent session hijacking KAMI VANIEA 5
6 Think about what you are authenticating Actual identity of the person That they are the same entity who setup the account They have a specific property Above the legal drinking age Student of the university Facebook user That another authenticator thinks they are the same entity KAMI VANIEA 6
7 Authentication Factors Something you know Password, mother s maiden name, your address Something you have Student ID card, credit card chip, RSA key Something you are Finger prints, voice tones, iris, typing patterns KAMI VANIEA 7
8 Also jokingly known as: Something you can forget Password, mother s maiden name, your address Something you can loose Student ID card, credit card chip, RSA key Something you can t change Finger prints, voice tones, iris, typing patterns KAMI VANIEA 8
9 Multi factor authentication Authentication that requires two or more of the factors. Two-factor Chip and pin in a credit card. Something you have (chip) something you know (pin). Chip and signature credit card. Something you have (chip) something you are (signature pattern). Three-factor Security guard that check s your ID against what you look like and then requires a code. Secure finger print reading fob that gives you a code after it reads your fingerprint, then you use the code and a password to log in. KAMI VANIEA 9
10 Invisible continuing authentication 1. You log into a website using a password (something you know). 2. Website sets a cookie with a secret and a timestamp. 3. Every time you visit a new page your computer sends the cookie (something you have) and the server verifies it. 4. When you log out the cookie is destroyed. KAMI VANIEA 10
11 How banks do (mostly) invisible 2-factor authentication 1. You log into a website using a password (something you know). 2. The website is also sent the cookie from the last time you logged in (something you have). 3. If the password and the cookie both match you get to log in. 4. If the cookie is missing, or wrong, the bank will ask you to prove that you have something else by calling you (phone) or ing you a code ( ). KAMI VANIEA 11
12 Passwords KAMI VANIEA 12
13 Most common passwords in RockYou data Passwords Most popular method of authentication A character string (password) is agreed upon between the user and the system User proves their identity by providing the password Convenient system design Easy to store encrypted Easy to enter on many systems No special equipment needed Scales well Problem: people choose easy to guess passwords Low entropy, so easy to guess Hard to remember password iloveyou princess rockyou abc123 nicole daniel babygirl monkey lovely jessica michael ashley qwerty KAMI VANIEA 13
14 Rockyou Phpbb Myspace Count Password Count Password Count Password password iloveyou princess rockyou abc nicole daniel password 708 phpbb 562 qwerty letmein abc test 75 password1 56 abc fuckyou 29 monkey1 28 iloveyou1 24 myspace1 24 fuckyou1 18 number1 18 football1 17 nicole iloveyou2
15 Standard password guidance What does a good password look like? At least 8 characters, longer better No words (any language, especially English) Avoid common patterns Upper case letter as first letter Putting the number at the end Putting the special character at the end High entropy Lowercase letters Upper case letters Numbers Special characters What does a bad password look like? Short Easy to guess (significant other attack) Uses common patterns Low entropy Word (in any language) Same combination other people use
16 Password entropy A good password should be drawn randomly from a large set of possible passwords A bad password is drawn from either a small set or not randomly
17 UK guidance on simplifying passwords 1. Change all default passwords 2. Help users cope with password overload 3. Understand the limitations of user-generated passwords 4. Understand the limitations of machine generated passwords 5. Prioritize administrator and remote user accounts 6. Use account lockout and protective monitoring 7. Don t store passwords as plain text KAMI VANIEA 17
18 User generated passwords People are somewhat ok at generating passwords they can remember People are bad at generating passwords that are hard to guess User-generated passwords: Low entropy Tend to have facts about themselves such as their pet s name Guessable by someone who knows them Easy to lookup in a password dictionary KAMI VANIEA 18
19 PassFaces Humans are better at recognizing things than they are at recalling information. High feature information, like faces, are easier to recognize Idea: Use high feature information as the pin, so humans can recognize their password Problem: People select faces that mean something to them. If you know basic characteristics about someone you can easily guess their PassFace. KAMI VANIEA 19
20 PassFaces Password length = 4 Each password selected from a set of 9 faces like what is shown on the right Theoretical password space = 6561 What is the best way to break someone s password? If the person is a white male, you can guess the correct password in about two guesses by selecting all the pretty white females.
21 Machine generated passwords Computers are better at selecting passwords that are challenging for other computers to guess Computers are less good at selecting passwords that are easy to remember Tactics: Some algorithms produce passwords which are pronounceable, or are made up of words (correct battery horse staple) Let users choose from a small number of passwords KAMI VANIEA 21
22 Demo of John the Ripper on the Mallet VM that is part of your exercise KAMI VANIEA 22
23 Password protections Hashing Lockout Reset on KAMI VANIEA 23
24 Hashing A row from /etc/shadow aychedee:$6$vb1tly1qiy$m.1zcqktjbxbtzm1gri8bbkn39ku0yjw1cumfztrancnkfkr4rmaqvk4rqqqckajt6wxqjukfca/qnxlyqw.u/:15405:0:99999:7::: There are two ways to protect a password on a server: You can encrypt the password and keep the key in a really safe place You can hash the password. Hashing does not require a secret key so there is no secret key to lose
25 Hashing A row from /etc/shadow aychedee:$6$vb1tly1qiy$m.1zcqktjbxbtzm1gri8bbkn39ku0yjw1cumfztrancnkfkr4rmaqvk4rqqqckajt6wxqjukfca/qnxlyqw.u/:15405:0:99999:7::: What type of hash function was used 6 Salt vb1tly1qiy Encrypted password M.1ZCqKtJBxBtZm1gRi8Bbkn39KU0YJW1cuMFzTRANcN KFKR4RmAQVk4rqQQCkaJT6wXqjUkFcA/qNxLyqW.U/
26 Lockout Password guessing attacks work because a computer can guess many times a second Humans don t guess many times a second Idea: if a user can t guess a password in 10 tries or less lock them out for a time period or require another factor KAMI VANIEA 26
27 Something you have KAMI VANIEA 27
28 Physical keys Simplest and one of the most common examples of something you have Each key contains a code in the form of notches on the key Having one allows you to open physical locks Single factor authentication KAMI VANIEA 28
29 RSA key fob When a button is pushed the fob prints out a number The number is generated securely using methods we will talk about later The number must be typed in along with a password Two factor authentication KAMI VANIEA 29
30 Chip in a credit card Similar to RSA fob, the chip generates a unique code The user KAMI VANIEA 30
31 My public key -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v2 A public/private digital key We will discuss these in more detail later in the course Simply: A public key can unlock what a private key locks, and vice versa A PGP key is something you have which authenticates you For example, if a file is encrypted using the key on the right only I can decrypt it using my matching private key which only I possess mqenbfhmcgabcac9wrydo6k2l3vhyi4ehn6suhlqmpj+so+iutulevnuzioxauxh KozHejfV/9XoG8j933ZtszXKCog3aMESe0E0z6fNGfolvaCe5B4jwqoJt8NHwb5L B2dnq0CplgXcN2GJxfEHHUaf27COSobCJxPMeshUh4ZHke+g6DatmiEtBpVp41Ot 1zgxdMQkgb2H2xw28RYfYkdDoueteIkOrFLrCy9ZF9KdMhA1eBH94KnwIQshdiZR QYEX25+M8cKCb++Rc9H6an7EG9WHOFRW40UsY52OfveOyfQPzkkRto7u2339hvH0 B/h+7xLM6FQbOUZQ9BD5w7IQHgYtXJVsUj0dABEBAAG0IkthbWkgVmFuaWVhIDxr dmfuawvhqgluzi5lzc5hyy51az6jat8eeweiackfalykyvecgymfcqlmayahcwki BwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAKCRCTdsxl9/HZffG+CACShuKxje3QAqew GWh8K4gCdiY0xDqJwq3PHxmyhZmQeN/1a1KcOrIjI2b+Q75/5t+EgXOHpR0PIxfG lz6zoepf6a18ifxx3jgqzdwpd0jtbiwnpoymebgtgiveyg3so2vueqoexcq3dbyp 5vstVxtD+TKHQ5CioIT75P2bzYq/XLT5aIbNQhQDPcTo0DgbRH+FvqsRXr7yeaef JaPnxX0+1L33t2QY9zctiGyebwrvHMrIPBJ2VYCDzQkJ7uQ5eFh4ZhsMgOmzLQD4 YiGr5weIMFwAvxZOaRxEa9Vf48jiWvrxuJ8YfHWS0hEScNOcYC2P8q20lJwwE26T lpdtrwcqtb1lyw1pifzhbmllysa8a2ftaub2yw5pzweuy29tpokbqgqtaqialaib IwUJCWYBgAcLCQgHAwIBBhUIAgkKCwQWAgMBAh4BAheABQJWCmMeAhkBAAoJEJN2 zgx38dl9jjaiaiw0rxrlysrmks6cbw8mgtxxtdoxact1b7f0w0qzhskiuqhece+a XBYib1A5uHaatLfyjeXaD3qMEoZnQHoYMGE0GKu00wWsbhfoQzHPgwzRLkD1i75M BIbaww0KWoVB9e4AkMakXJCnF5BXeo6AHRL2v15V205DikVnlCRXocKtu8b7LnkM cln7olobr1de1uykonzbsno/vpkdjp0/ey5yuev9oiypzy/6wfqbehg1sxye6zno 9wb9uUsu9+/P8pz4JILMDSevjfT7zSRSl/YP3fOfZ6N4bc+KOdwPM7u5Iyoeu9zh pzibv3ge7vhh2xiwz8vyz/2xt1345twrrmojahweewecaayfaltnspeacgkqjyxm p99tbt2b8a/+opizosqbqjb8yxti4i7ppd1wejdf3a81vhm7jyxe/xy66ypfdt3w XmFRUuIrwezY1NebWNCRQHzQvRv/VJwjbTUx+Q3HsjIkKlHbE7iCiQXXtTRk0Eny 2nudcjGI2v03C3B2JCucEw6esF1x79PI/lPv2+6tgUBKmDfOpsB2vbtqrHnmAYKL 4lQBFH1YSJgnzwo2Jkh0hcHdF90Zem1eMeiDEeVkH63893N8Swk5fBKdTj+SKZ/L rqelbblpmr9bmey6bpvwruycvk0nimr80g9ifabxjtpwbl8agk6eevk5eqydgvkd ZIarK84r+KU1KD5IfgOCN7nhwgy7VImE68caZHSRiPWZP1fVVMhydiRJv8WsoUs6 INfVU3nxH+ZYthPbY0T86leGSchBT5K/fBQvbjhrRTbTFwvjzSifb9efWylDi994 nzp6cnorir3gipst8gpgbb2/njxawim6y3x1az1vrnsunqhuykkfwpzwnevdjyac NN/3jWcbhLFwKBDsaHps2+1meFP0oJFvNetzp2bjT9a9pXaQ6KhOmo5DnhLcaV97 bfbpsuubgayztss05x1rdxhqpebgap8dtuhhvvjw9qydqbjr0k4akyg9qqmd8cta Pl/FAdyAqwH8Nw9efqAK+RQxSVUaue9BYEnbIRpsDK6MkP3YMFmu5ki5AQ0EUcxy AAEIALyXYy8G2ZaTDJpdGcRhmIqOOSUlzPV7/5E5BbYKBNu4KU3nX+JLVcF5jxPQ 42c7i/WRVxE1BJTiarKGsEvCi94TTXSIUKAt3T1oGBtXmGvqbGBq8ljSGl1UTwdF 5yu50JyRSf2fqRND6P/2eHNXejDUtdvhUXIUt8h9MuUO/ipD0DnwIvMnAATJHA+R Zqw6oNpyjRGzvr3iuWUwe4PtyJDI3ELAFkbp/NAc5TIuVHRHNOWNplcIJhM5zHuB QQb3G/EsCn2PQZ5w5SDzavF2SpvQfDqxYpDaTLAXtF+wsJL5iaUjxwRgJPOdbCZf 2Tozd7h9MXtGJDlPKJ8eLG8ogcMAEQEAAYkBJQQYAQIADwUCUcxyAAIbDAUJCWYB gaakcrctdsxl9/hzfs+hb/9bjqsmigcohfxnb1pvikxekzl8+wvm5pk/egmqslz2 HX4p3ial5PEPcYgUw9YnaG4i00dwJGw5/daTWRrTzcnKd8YqoP+DU0t96HZDSu3m mcze9nvaqybofbvmgox0eo627ubsvfqaxvaxbdykor8b0tnkhrqfwxkzvb30hkwd TgAFjOGlZiE6uAdST231tFaq0bizYfe5AVXRqro20xBqNbaJNqs3SW0D831Syvdv llobx83/r0gg7huki6f2vzxicwmuwfsxrrggcsbloshsp6isbwwvlhermna/aqab YKG3gbV9iyczAS31gbogVLAZqNSWhp8vVIEE28Fyf/Ed =x5fk -----END PGP PUBLIC KEY BLOCK----- KAMI VANIEA 31
32 DKIM People are not the only ones who authenticate Servers also need to authenticate to each other One of the most visible is DKIM signatures in KAMI VANIEA 32
33 DKIM Problem: Spam Solution: 1. Sending server signs the using a private key 2. Receiving server checks the key to authenticate the sending server
34 Something you are KAMI VANIEA 34
35 Finger print readers Fingerprints are nearly unique so they seem like a good authenticator Not all people have fingerprints Some professions destroy fingerprints Some fingerprints are too faint to read Fingerprints can never be changed You leave fingerprints everywhere KAMI VANIEA 35
36 Most biometric readers have similar problems KAMI VANIEA 36
37 Continuous authentication Your interaction with a computer is unique and we can measure it Mouse movements Keyboard typing patterns Nearly impossible to duplicate a real user s typing patterns Easy to loose access if the user hurts their hand, or is doing something non-standard Repetitive Stress Injury (RSI) patients trigger continuous authentication warnings regularly while healing KAMI VANIEA 37
38 Privacy Users have a right to privacy, that is, a right to keep aspects of themselves hidden that are not necessary to expose Authentication mechanisms need to take privacy into account and not ask for more than they need Identifying a user using a Facebook, Google, or Apple account may be easy, but it gives away large amounts of data Similarly, requiring a validated ID such as drivers or passport information also exposes quite a bit of information KAMI VANIEA 38
39 Questions KAMI VANIEA 39
Usable Security and User Training
Usable Security and User Training KAMI VANIEA JANUARY 25 KAMI VANIEA 1 Equifax was serving up spyware https://krebsonsecurity.com/2017/10/ equifax-credit-assistance-site-servedspyware/ Equifax was serving
Lecture 3 - Passwords and Authentication
CSE497b Introduction to Computer and Network Security - Spring 2007 - Professor Jaeger Lecture 3 - Passwords and Authentication CSE497b - Spring 2007 Introduction Computer and Network Security Professor
Lecture 3 - Passwords and Authentication
Lecture 3 - Passwords and Authentication CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12 What is authentication? Reliably verifying
Computer Security 3/20/18
Authentication Identification: who are you? Authentication: prove it Computer Security 08. Authentication Authorization: you can do it Protocols such as Kerberos combine all three Paul Krzyzanowski Rutgers
Computer Security. 08. Authentication. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08. Authentication Paul Krzyzanowski Rutgers University Spring 2018 1 Authentication Identification: who are you? Authentication: prove it Authorization: you can do it Protocols such
Summary
The Imperva Application Defense Center (ADC) ADC White Paper Summary In December 2009, a major password breach occurred that led to the release of 32 million passwords 1. Further, the hacker posted to
Take Control of Your Passwords
Take Control of Your Passwords Joe Kissell Publisher, Take Control Books @joekissell takecontrolbooks.com The Password Problem Passwords are annoying! It s tempting to take the easy way out. There is an
Authentication SPRING 2018: GANG WANG. Slides credit: Michelle Mazurek (U-Maryland) and Blase Ur (CMU)
Authentication SPRING 2018: GANG WANG Slides credit: Michelle Mazurek (U-Maryland) and Blase Ur (CMU) Passwords, Hashes, Salt Password database Username Plaintext Password Not a good idea to store plaintext
Personal Internet Security Basics. Dan Ficker Twin Cities DrupalCamp 2018
Personal Internet Security Basics Dan Ficker Twin Cities DrupalCamp 2018 Overview Security is an aspiration, not a state. Encryption is your friend. Passwords are very important. Make a back-up plan. About
Module: Authentication. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Authentication Professor Trent Jaeger 1 1 Authentication and Authorization Fundamental mechanisms to enforce security on a system Authentication:
Passwords. EJ Jung. slide 1
Passwords EJ Jung slide 1 Basic Problem? How do you prove to someone that you are who you claim to be? Any system with access control must solve this problem slide 2 Many Ways to Prove Who You Are What
HOST Authentication Overview ECE 525
Authentication Overview Authentication refers to the process of verifying the identity of the communicating principals to one another Usually sub-divided into Entity authentication Authentication in real-time
CNT4406/5412 Network Security
CNT4406/5412 Network Security Authentication Zhi Wang Florida State University Fall 2014 Zhi Wang (FSU) CNT4406/5412 Network Security Fall 2014 1 / 43 Introduction Introduction Authentication is the process
Computer Security 4/12/19
Authentication Computer Security 09. Authentication Identification: who are you? Authentication: prove it Authorization: you can do it Paul Krzyzanowski Protocols such as Kerberos combine all three Rutgers
Biometrics problem or solution?
Biometrics problem or solution? Summary Biometrics are a security approach that offers great promise, but also presents users and implementers with a number of practical problems. Whilst some of these
On Passwords (and People)
On Passwords (and People) EECE 571B Computer Security Konstantin Beznosov Basics and Terminology definition authentication is binding of identity to subject! Identity is that of external entity! Subject
CSCI 667: Concepts of Computer Security
CSCI 667: Concepts of Computer Security Lecture 8 Prof. Adwait Nadkarni Derived from slides by William Enck, Micah Sherr, Patrick McDaniel and Peng Ning 1 2 Announcements Project Proposals due Tonight,
Lecture 14 Passwords and Authentication
Lecture 14 Passwords and Authentication Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides based on Bailey s ECE 422 Major Portions Courtesy Ryan Cunningham AUTHENTICATION Authentication
Part II: Passwords. Ron van der Meyden. (University of New South Wales Sydney, Australia) March 12, R. van der Meyden Part II: Passwords
Part II: Passwords Ron van der Meyden (University of New South Wales Sydney, Australia) March 12, 2013 Passwords An old security mechanism: Soldiers access to camp Secret society handshakes Objective:
MU2a Authentication, Authorization & Accounting Questions and Answers with Explainations
98-367 MU2a Authentication, Authorization & Accounting Questions and Answers with Explainations Which are common symptoms of a virus infection? (Lesson 5 p 135-136) Poor system performance. Unusually low
CS530 Authentication
CS530 Authentication Bill Cheng http://merlot.usc.edu/cs530-s10 1 Identification vs. Authentication Identification associating an identity (or a claimed identity) with an individual, process, or request
Password. authentication through passwords
Password authentication through passwords Human beings Short keys; possibly used to generate longer keys Dictionary attack: adversary tries more common keys (easy with a large set of users) Trojan horse
ECE646 Fall Lab 1: Pretty Good Privacy. Instruction
ECE646 Fall 2012 Lab 1: Pretty Good Privacy Instruction PLEASE READ THE FOLLOWING INSTRUCTIONS CAREFULLY: 1. You are expected to address all questions listed in this document in your final report. 2. All
ECE596C: Handout #9. Authentication Using Shared Secrets. Electrical and Computer Engineering, University of Arizona, Loukas Lazos
ECE596C: Handout #9 Authentication Using Shared Secrets Electrical and Computer Engineering, University of Arizona, Loukas Lazos Abstract. In this lecture we introduce the concept of authentication and
Corporate Online. Introducing Corporate Online
Corporate Online. Introducing Corporate Online Effective as at April 2015 About this Guide About Corporate Online Westpac Corporate Online is an internet-based electronic platform, providing a single point
Usable Security Introduction to User Authentication and Human Interaction Proof Research
Usable Security Introduction to User Authentication and Human Interaction Proof Research Argyris C. Constantinides PhD Student Department of Computer Science University of Cyprus 1 Agenda Introduction
Identification, authentication, authorisation. Identification and authentication. Authentication. Authentication. Three closely related concepts:
Identification, authentication, authorisation Three closely related concepts: Identification and authentication WSPC, Chapter 6 Identification: associating an identity with a subject ( Who are you? ) Authentication:
Web Security, Summer Term 2012
IIG University of Freiburg Web Security, Summer Term 2012 Brocken Authentication and Session Management Dr. E. Benoist Sommer Semester Web Security, Summer Term 2012 7 Broken Authentication and Session
Web Security, Summer Term 2012
Table of Contents IIG University of Freiburg Web Security, Summer Term 2012 Brocken Authentication and Session Management Dr. E. Benoist Sommer Semester Introduction Examples of Attacks Brute Force Session
User Authentication. E.g., How can I tell you re you?
User Authentication E.g., How can I tell you re you? 1 The Basics Unlike real world authentication (e.g., you recognize someone s voice over the phone) computer can t recognize someone (well, not in the
0/41. Alice Who? Authentication Protocols. Andreas Zeller/Stephan Neuhaus. Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken
0/41 Alice Who? Authentication Protocols Andreas Zeller/Stephan Neuhaus Lehrstuhl Softwaretechnik Universität des Saarlandes, Saarbrücken The Menu 1/41 Simple Authentication Protocols The Menu 1/41 Simple
ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification
ICT 6541 Applied Cryptography Lecture 8 Entity Authentication/Identification Hossen Asiful Mustafa Introduction Entity Authentication is a technique designed to let one party prove the identity of another
Sumy State University Department of Computer Science
Sumy State University Department of Computer Science Lecture 1 (part 2). Access control. What is access control? A cornerstone in the foundation of information security is controlling how resources are
Computer Security 3e. Dieter Gollmann. Security.di.unimi.it/1516/ Chapter 4: 1
Computer Security 3e Dieter Gollmann Security.di.unimi.it/1516/ Chapter 4: 1 Chapter 4: Identification & Authentication Chapter 4: 2 Agenda User authentication Identification & authentication Passwords
Certificate-based authentication for data security
Technical white paper Certificate-based authentication for data security Table of Contents Introduction... 2 Analogy: A simple checking account... 2 Verifying a digital certificate... 2 Summary... 8 Important
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 3 User Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown User Authentication fundamental security building
Security & Privacy. Web Architecture and Information Management [./] Spring 2009 INFO (CCN 42509) Contents. Erik Wilde, UC Berkeley School of
![Security & Privacy. Web Architecture and Information Management [./] Spring 2009 INFO (CCN 42509) Contents. Erik Wilde, UC Berkeley School of](/thumbs/80/82185476.jpg "Security & Privacy. Web Architecture and Information Management [./] Spring 2009 INFO (CCN 42509) Contents. Erik Wilde, UC Berkeley School of")
Contents Security & Privacy Contents Web Architecture and Information Management [./] Spring 2009 INFO 190-02 (CCN 42509) Erik Wilde, UC Berkeley School of Information Abstract 1 Security Concepts Identification
Authentication. Chapter 2
Authentication Chapter 2 Learning Objectives Create strong passwords and store them securely Understand the Kerberos authentication process Understand how CHAP works Understand what mutual authentication
Worksheet - Reading Guide for Keys and Passwords
Unit 2 Lesson 15 Name(s) Period Date Worksheet - Reading Guide for Keys and Passwords Background Algorithms vs. Keys. An algorithm is how to execute the encryption and decryption and key is the secret
Investigating the Distribution of Password Choices
Investigating the Distribution of Password Choices David Malone and Kevin Maher, Hamilton Institute, NUI Maynooth. 19 April 2012 How to Guess a Password? Passwords are everywhere. If you dont know the
Session objectives. Identification and Authentication. A familiar scenario. Identification and Authentication
Session objectives Background Identification and Authentication CSM27 Computer Security Dr Hans Georg Schaathun University of Surrey Autumn 2008 Week 3 Recognise the purposes of (password) identification.
Accounts and Passwords
Accounts and Passwords Hello, I m Kate and we re here to learn how to set up an account on a website. Many websites allow you to create a personal account. Your account will have its own username and password.
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A. Authentication EECE 412. Copyright Konstantin Beznosov
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A Authentication EECE 412 Copyright 2004-2007 Konstantin Beznosov What is Authentication? Real-world and computer world examples? What is a result
Information Security & Privacy
IS 2150 / TEL 2810 Information Security & Privacy James Joshi Associate Professor, SIS Lecture 8 Feb 24, 2015 Authentication, Identity 1 Objectives Understand/explain the issues related to, and utilize
14 - Authentication in Practice
14 - Authentication in Practice Engineering & Public Policy Lorrie Cranor, Blase Ur, and Rich Shay February 26, 2015 05-436 / 05-836 / 08-534 / 08-734 Usable Privacy and Security # Today s class Biometrics
Computer Security & Privacy
Computer Security & Privacy Melissa Winstanley (mwinst@cs.washington.edu) (based on slides by Daniel Halperin) How exploration sessions work You get 1/3 point of extra credit for each session Attendance
Chapter 3: User Authentication
Chapter 3: User Authentication Comp Sci 3600 Security Outline 1 2 3 4 Outline 1 2 3 4 User Authentication NIST SP 800-63-3 (Digital Authentication Guideline, October 2016) defines user as: The process
HY-457 Information Systems Security
HY-457 Information Systems Security Recitation 1 Panagiotis Papadopoulos(panpap@csd.uoc.gr) Kostas Solomos (solomos@csd.uoc.gr) 1 Question 1 List and briefly define categories of passive and active network
Computers and Security
The contents of this Supporting Material document have been prepared from the Eight units of study texts for the course M150: Date, Computing and Information, produced by The Open University, UK. Copyright
10/1/2015. Authentication. Outline. Authentication. Authentication Mechanisms. Authentication Mechanisms. Authentication Mechanisms
Authentication IT443 Network Security Administration Instructor: Bo Sheng Authentication Mechanisms Key Distribution Center and Certificate Authorities Session Key 1 2 Authentication Authentication is
CIS 4360 Secure Computer Systems Biometrics (Something You Are)
CIS 4360 Secure Computer Systems Biometrics (Something You Are) Professor Qiang Zeng Spring 2017 Previous Class Credentials Something you know (Knowledge factors) Something you have (Possession factors)
5. Authentication Contents
Contents 1 / 47 Introduction Password-based Authentication Address-based Authentication Cryptographic Authentication Protocols Eavesdropping and Server Database Reading Trusted Intermediaries Session Key
Berner Fachhochschule Haute cole spcialise bernoise Berne University of Applied Sciences 2
Table of Contents Hacking Web Sites Broken Authentication Emmanuel Benoist Spring Term 2018 Introduction Examples of Attacks Brute Force Session Spotting Replay Attack Session Fixation Attack Session Hijacking
CSCE 548 Building Secure Software Biometrics (Something You Are) Professor Lisa Luo Spring 2018
CSCE 548 Building Secure Software Biometrics (Something You Are) Professor Lisa Luo Spring 2018 Previous Class Credentials Something you know (Knowledge factors) Something you have (Possession factors)
Outline. Login w/ Shared Secret: Variant 1. Login With Shared Secret: Variant 2. Login Only Authentication (One Way) Mutual Authentication
Outline Security Handshake Pitfalls (Chapter 11 & 12.2) Login Only Authentication (One Way) Login i w/ Shared Secret One-way Public Key Lamport s Hash Mutual Authentication Shared Secret Public Keys Timestamps
BIOMETRIC MECHANISM FOR ONLINE TRANSACTION ON ANDROID SYSTEM ENHANCED SECURITY OF. Anshita Agrawal
BIOMETRIC MECHANISM FOR ENHANCED SECURITY OF ONLINE TRANSACTION ON ANDROID SYSTEM 1 Anshita Agrawal CONTENTS Introduction Biometric Authentication Fingerprints Proposed System Conclusion References 2 INTRODUCTION
Password Managers: Devil s in the Details
Password Managers: Devil s in the Details How Can Giving all your Passwords to a Password Manager be Safe? AUGUST 2018 Passwords are dead; long live the password! Passwords are unequivocally the most used
User Authentication Protocols
User Authentication Protocols Class 5 Stallings: Ch 15 CIS-5370: 26.September.2016 1 Announcement Homework 1 is due today by end of class CIS-5370: 26.September.2016 2 User Authentication The process of
The Match On Card Technology
Precise Biometrics White Paper The Match On Card Technology Magnus Pettersson Precise Biometrics AB, Dag Hammarskjölds väg 2, SE 224 67 Lund, Sweden 22nd August 2001 Abstract To make biometric verification
Hashes, MACs & Passwords. Tom Chothia Computer Security Lecture 5
Hashes, MACs & Passwords Tom Chothia Computer Security Lecture 5 Today s Lecture Hashes and Message Authentication Codes Properties of Hashes and MACs CBC-MAC, MAC -> HASH (slow), SHA1, SHA2, SHA3 HASH
In this unit we are continuing our discussion of IT security measures.
1 In this unit we are continuing our discussion of IT security measures. 2 One of the best security practices in Information Security is that users should have access only to the resources and systems
Deprecating the Password: A Progress Report. Dr. Michael B. Jones Identity Standards Architect, Microsoft May 17, 2018
Deprecating the Password: A Progress Report Dr. Michael B. Jones Identity Standards Architect, Microsoft May 17, 2018 The password problem Alpha-numeric passwords are hard for humans to remember and easy
COMPGA12 1 TURN OVER
Applied Cryptography, COMPGA12, 2009-10 Answer ALL questions. 2 hours. Marks for each part of each question are indicated in square brackets Calculators are NOT permitted 1. Multiple Choice Questions.
Codebook. Codebook for OS X Introduction and Usage
Codebook Codebook for OS X Introduction and Usage What is Codebook Encrypted Data Vault Guards passwords and private data Keeps sensitive information organized Enables quick recall of secrets Syncs data
User Authentication Protocols Week 7
User Authentication Protocols Week 7 CEN-5079: 2.October.2017 1 Announcement Homework 1 is posted on the class webpage Due in 2 weeks 10 points (out of 100) subtracted each late day CEN-5079: 2.October.2017
Keep Track of Your Passwords Easily
Keep Track of Your Passwords Easily K 100 / 1 The Useful Free Program that Means You ll Never Forget a Password Again These days, everything you do seems to involve a username, a password or a reference
CIS 6930/4930 Computer and Network Security. Topic 6. Authentication
CIS 6930/4930 Computer and Network Security Topic 6. Authentication 1 Authentication Authentication is the process of reliably verifying certain information. Examples User authentication Allow a user to
ANDROID PRIVACY & SECURITY GUIDE ANDROID DEVICE SETTINGS
ANDROID PRIVACY & SECURITY GUIDE WESNET The Women s Services Network Smartphones store a lot of personal information, including email or social media accounts, reminders and notes, the number of steps
Authentication Methods
CERT-EU Security Whitepaper 16-003 Authentication Methods D.Antoniou, K.Socha ver. 1.0 20/12/2016 TLP: WHITE 1 Authentication Lately, protecting data has become increasingly difficult task. Cyber-attacks
L5: Basic Grammar Based Probabilistic Password Cracking
L5: Basic Grammar Based Probabilistic Password Cracking Sudhir Aggarwal and Shiva Houshmand and Matt Weir Florida State University Department of Computer Science E-Crime Investigative Technologies Lab
===============================================================================
We have looked at how to use public key crypto (mixed with just the right amount of trust) for a website to authenticate itself to a user's browser. What about when Alice needs to authenticate herself
Security Handshake Pitfalls
Hello Challenge R f(k, R f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone can send the challenge R. f(k, R Problems: 1. Authentication is not mutual only authenticates Anyone
SECURITY STORY WE NEVER SEE, TOUCH NOR HOLD YOUR DATA
SECURITY STORY WE NEVER SEE, TOUCH NOR HOLD YOUR DATA CTO Office www.digi.me another Engineering Briefing digi.me keeping your data secure at all times ALL YOUR DATA IN ONE PLACE TO SHARE WITH PEOPLE WHO
BEST PRACTICES FOR PERSONAL Security
BEST PRACTICES FOR PERSONAL Email Security Sometimes it feels that the world of email and internet communication is fraught with dangers: malware, viruses, cyber attacks and so on. There are some simple
ECE646 Fall Lab 1: Pretty Good Privacy. Instruction
ECE646 Fall 2015 Lab 1: Pretty Good Privacy Instruction PLEASE READ THE FOLLOWING INSTRUCTIONS CAREFULLY: 1. You are expected to address all questions listed in this document in your final report. 2. All
Stuart Hall ICTN /10/17 Advantages and Drawbacks to Using Biometric Authentication
Stuart Hall ICTN 4040 601 04/10/17 Advantages and Drawbacks to Using Biometric Authentication As technology advances, so must the means of heightened information security. Corporate businesses, hospitals
User Authentication. Daniel Halperin Tadayoshi Kohno
CSE 484 / CSE M 584 (Autumn 2011) User Authentication Daniel Halperin Tadayoshi Kohno Thanks to Dan Boneh, Dieter Gollmann, John Manferdelli, John Mitchell, Vitaly Shmatikov, Bennet Yee, and many others
Due: October 8, 2013: 7.30 PM
Jackson State University Department of Computer Science CSC 437-01/539-01 Computer Security Fall 2013 Instructor: Dr. Natarajan Meghanathan Lab Project # 1: Lab Project on using PGP GNU Privacy Guard (GPG)
Congratulations! You just ordered IdentaMaster software package featuring Biometric login, File/Folder Encryption and Entire Drive Encryption.
INSTALLATION Congratulations! You just ordered IdentaMaster software package featuring Biometric login, File/Folder Encryption and Entire Drive Encryption. From this point on, you may install any additional
Cryptography: Practice JMU Cyber Defense Boot Camp
Cryptography: Practice 2013 JMU Cyber Defense Boot Camp Prerequisites This unit assumes that you have already known Symmetric-key encryption Public-key encryption Digital signature Digital certificates
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A. Authentication
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A Authentication What is Authentication? Real-world and computer world examples? What is a result of authentication? What are the means for in
Security and Usability Computer Security: Lecture 9. 9 February 2009 Guest Lecture by Mike Just
Security and Usability Computer Security: Lecture 9 9 February 2009 Guest Lecture by Mike Just Introduction Who am I? Mike Just Visiting Research Fellow, School of Informatics Researching security and
Pattern Recognition and Applications Lab AUTHENTICATION. Giorgio Giacinto.
Pattern ecognition and Applications Lab AUTHENTICATION Giorgio Giacinto giacinto@diee.unica.it Computer Security 2018 Department of Electrical and Electronic Engineering University of Cagliari, Italy Authentication
Authentication. Steven M. Bellovin January 31,
Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to do Identification is whom you claim to be be Authentication
Introduction. Security Edition User Guide
Introduction Turbo SIM is a device with a set of pre-installed applications targeted at SMS encryption and privacy protection. Inserted in the SIM Lock together with the operator SIM card, the device can
CSC 474 Network Security. Authentication. Identification
Computer Science CSC 474 Network Security Topic 6. Authentication CSC 474 Dr. Peng Ning 1 Authentication Authentication is the process of reliably verifying certain information. Examples User authentication
Security+ Guide to Network Security Fundamentals, Third Edition. Chapter 11 Basic Cryptography
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 11 Basic Cryptography Objectives Define cryptography Describe hashing List the basic symmetric cryptographic algorithms 2 Objectives
Authentication. Steven M. Bellovin September 26,
Authentication Steven M. Bellovin September 26, 2009 1 Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to
LAB :: PGP (Pretty Good Privacy)
LAB :: PGP (Pretty Good Privacy) GnuPG : GnuPG forms the heart of Gpg4win the actual encryption software. Kleopatra : The central certificate administration of Gpg4win, which ensures uniform user navigation
Multi-Factor Authentication (MFA)
10.10.18 1 Multi-Factor Authentication (MFA) What is it? Why should I use it? CYBERSECURITY Tech Fair 2018 10.10.18 2 Recent Password Hacks PlayStation Network (2011) 77 Million accounts hacked Adobe (2013)
Authentication. Steven M. Bellovin September 16,
Authentication Steven M. Bellovin September 16, 2013 1 Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to
WHITE PAPER. Authentication and Encryption Design
WHITE PAPER Authentication and Encryption Design Table of Contents Introduction Applications and Services Account Creation Two-step Verification Authentication Passphrase Management Email Message Encryption
Intermediate STEMSEL Project 7 Combination Lock
Intermediate STEMSEL Project 7 Combination Lock Problem We want to make an electronic lock using our STEMSEL boards. How can we use it to make a combination lock? Background As writer Allan Poe said, everyone
CPSC 467b: Cryptography and Computer Security
CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 24 April 16, 2012 CPSC 467b, Lecture 24 1/33 Kerberos Secure Shell (SSH) Transport Layer Security (TLS) Digital Rights Management
Who are you? Enter userid and password. Means of Authentication. Authentication 2/19/2010 COMP Authentication is the process of verifying that
Who are you? Authentication COMP620 Authentication is the process of verifying that the user or system is who they claim li to be. A system may be acting on behalf of a given principal. Authentication
What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource.
P1L4 Authentication What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource. Authentication: Who are you? Prove it.
Assignment 9 / Cryptography
Assignment 9 / Cryptography Michael Hauser March 2002 Tutor: Mr. Schmidt Course: M.Sc Distributed Systems Engineering Lecturer: Mr. Owens CONTENTS Contents 1 Introduction 3 2 Simple Ciphers 3 2.1 Vignère
Technologies 1ºESO. Unit 2. Hardware and software. Name Nº Class. After having explained page 26 of your book:
After having explained page 26 of your book: Make sure you get this concepts right: 1. What is computer science? A computer system collects data, processes it and transmits the information. Computer science
User Authentication and Passwords
User Authentication and : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 31 October 2012 Y12S2L11, Steve/Courses/2012/s2/css322/lectures/passwords.tex,
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 9: Authentication Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline Definition of entity authentication Solutions password-based