Existing Authentication Techniques
What you know
- Username
- Password
- PINs
Shared, Easy to guess, Usually forgotten
What you have
- Cards
- NRIC, Passport
- Keys
Shared, Can be duplicated, Lost or stolen
What you know and have
- ATM + PIN
Shared, PIN is weak
What you are
- Fingerprint
- Face
- Voiceprint
- Iris scan
Not possible to share
Repudiation unlikely
Forging difficult
Cannot be lost or stolen
What a user has
- NRIC, Passport
- OTP
Methods of generating: - Time-synchronised
- Challenge-based
Methods of distributing: - Over SMS on mobile phone
- On proprietary tokens
What a user is
Standard biometrics
* Fingerprint, Retina, Face
Behavioral biometrics
* Keystroke dynamics;
* voice recognition;
* computer foot printing
* Gait (pattern of movement)
Cognitive biometrics
* Memorable events
* Identify specific faces
Attacks on Authentication System
Recommended having a more generalized warning message like the one shown below “Invalid login”. Instead of “username does not exist” or “Wrong password”
- XSS attacks
- Brute-force attempts using bots
- SQL Injection Attack
- Multiple login attempts from single IP
Prevention
Limiting the frequency of online login attempts to an account
through various actions:
* Enforcing multi-factor authentication, Anti-bot (e.g CAPTCHA), or other forms of verification
* Locking an account after a specified number of login attempts is reached
* Prohibiting multiple sessions for single user and location-based verification
Multi-factor authentication
- Granting access to a website or application by presenting two or more pieces of evidence (or factors) to an authentication mechanism:
– knowledge (something only the user knows)
– possession (something only the user has)
– inherence (something only the user is) - Implement multi-factor authentication to prevent automated (bot), credential stuffing, brute force, and stolen credential re-use attacks.
Steps for 2FA
- System verifies userid and password
- System generates a 6 digit SMS OTP to user
- Saves a copy of OTP values and date/time in db - System prompts user for OTP
- System checks if OTP entered is valid
- Valid if OTP matches the one saved in db
- If OTP matches, check if OTP is received before expired date/time - If user request OTP again due to timeout, repeat step 2-4
- System create session and redirect to homepage
Brute force attack
An attempt to crack a password, using trial and error approach and hoping, eventually, to guess correctly.
Captcha - bot prevention
Completely Automated Public Turing test to tell Computers and Humans Apart
Types of Captcha
- Text-Based Captcha
- Invisible ReCaptcha
- Mathematical Captcha
- Image-Based Captcha
- Interactive Captcha
Account Lockout
- To disable user account if consistently receive high login failures
- Allow locked account to be recovered:
- Automatically after a certain duration
- Manually using Web forms with user challenge
- Fail-safe rule
