Authentication

Question 1

What ist “access control”

Answer 1

authentication + authorisation

Question 2

Attacks against passwords?

Answer 2

• Guess
• phishing, spoofing, keylogging
• social engineering

Question 3

What are the risks of reusing a password?

Answer 3

Using the same or related passwords on multiple accounts means that one compromised system or account can lead to compromise of other accounts

Question 4

how to avoid password reuse?

Answer 4

• Generating service-specific passwords from one master password
• Password wallet

Question 5

Countermeasures against password guessing?

Answer 5

• limit login attempts
• prevent reuse of old passwords
• Password aging, i.e. mandatory periodic password changes

Question 6

difference between offline and online attack?

Answer 6

offline attack: cracking password from known hash of the password -> attacker can perform brute force
online attack: attacker tries to og in many times->System can limit number of login attempts

Question 7

How should you store passwords on a database?

Answer 7

• store as hash
• use a slow hash function
• include random account-specific “salt”

Question 8

What is biometric authentication?

Answer 8

verifying some physical feature of the user