Network Security and Authentication Lecture

This set covers key concepts from the lecture on authentication, including MFA factors, password attack vectors, passkey mechanics, and session management.

Hosting verification

A process where a client browser checks a website's certificate against the URL bar to ensure the site is legitimate before establishing a connection.

Identification

The claim of an identity, which is often indicated through a username.

Authentication

The process of proving a claimed identity by presenting some kind of secret that the user is supposed to possess.

Authorization

The specific set of activities or services a user is permitted to access once they have successfully authenticated.

Knowledge-based factor

An authentication factor based on something the user knows, such as a password or a PIN.

Possession-based factor

An authentication factor based on something the user has, such as an authenticator app on a phone or a physical security key.

Inherence-based factor

An authentication factor based on something the user is, commonly involving biometrics like fingerprints (Touch ID) or facial recognition (Face ID).

Credential stuffing

An attack method where leaked username and password combinations from one service are tried across multiple other accounts, exploiting the habit of password reuse.

Offline cracking

A method where an attacker steals a database of password hashes and uses brute force to guess the original passwords by running various attempts through a hash function.

Salts

Extra pieces of data added to a password before hashing to make brute forcing infeasible and render precomputed rainbow tables useless.

Rainbow tables

Precomputed tables of password and hash combinations that allow attackers to quickly look up a password if they have its hash.

HMAC (in One-Time Passwords)

A Hash-based Message Authentication Code that computes a hash based on a shared key and the current time in 30-second increments to derive a temporary login code.

MFA fatigue

A vulnerability where an attacker bombards a user with authentication prompts until the user approves the request out of annoyance or distraction.

Passkeys

A phishing-resistant authentication method using public key cryptography where keys are tied to specific domains and stored in secure hardware.

Secure Enclave

A dedicated hardware module in Apple devices used to store sensitive cryptographic keys for features like passkeys and biometrics.

Trusted Platform Module (TPM)

A secure hardware module used in non-Mac environments to store cryptographic keys and protect sensitive authentication data.

Session token

A temporary 'password' saved in a browser's cache as a cookie, allowing a user to remain logged in without constant re-authentication.

HTTPOnly

A security flag for cookies that prevents malicious JavaScript from reading session tokens, protecting them from exfiltration through scripts.

Federated identity

A system, such as 'Sign in with Google,' where a third-party service authenticates the user and passes the verification to other websites.

Kerberos

A network authentication protocol that allows an organization to implement its own single sign-on system through the use of tickets.

Host keys

Public keys placed on a client by an SSH server to help verify the server's identity for future sign-ins.