[igCS] Authentication

[igCS] Authentication

Authentication

• Verify the identity of user or;

• Verify the data is from a trusted source (e.g. website)

Authentication techniques

• Username and password, PIN

• Biometrics

• Digital Signature / Certificate

Open Ended

What is Biometric authentication? [2]

Open Ended

Name 3 types of biometric authentication technology.

Digital Certificate

• Websites can attach a digital certificate, to prove that it is the authentic website

• Digital Certificate for email can prove that the sender's identity, and also the message is not altered

• Digital Certificate is usually issued by a third-party organisation or government

Multiple Choice

Activity: Click on the "Lock" next to address bar of browser, find out who's the issuer of the digital certificate of quizizz.com

• Google Trust Services

• DigiCert Inc

• Let's Encrypt

• Microsoft Corporation

Multiple Choice

What is the certificate issuer of Microsoft website?

• Google Trust Services

• DigiCert Inc

• Let's Encrypt

• Microsoft Corporation

Digital Certitificate for company and personal use can be applied in Macau Post Office

More about certificate

• Browsers will check the authenticity of the certificate

• Certificate should be issued by trustworthy CA (certificate authority)

• If certificate does not match, e.g. facelook.com giving out a facebook.com certificate, browser will give warning

something wrong with certificate

Multiple Select

What kind of security threats may results in the browser warning?

• Phishing

• Pharming

• DDoS

• Keylogger

Username and Password

• Username: To identify the user

• Password: To Prove that you are that user

Chip and PIN system

• Chip (usually refers to debit card with computer chip)

• PIN (Personal identification Code, usually refers to number only)

• Chip and PIN usually used in Payment system (not common in Macau)

• More secure than magnetic strip cards as data can be encrypted on the chip

Hacking passwords

• Watch following video and write down what the password hackers will try

• https://www.youtube.com/watch?v=97CdJFyAv1s&has_verified=1

• 
  

Open Ended

Give 3 rules that makes the password difficult to guess [3]

Strong passwords

• Password that is "difficult" to guess by the hackers

• Difficult refers to a reasonable amount of time and computation power

• The difficulty will varies as the computer is getting faster and faster

• In general increasing password length will make the difficult exponentially increase

Open Ended

Suggest one security measure that a website can prevent password hackers.

Other measures to prevent brute force

• Captcha

• Firewall

• 2FA - two factors authentication

•