InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Complete guide to authentication mechanisms including passwords, multi-factor authentication, biometrics, tokens, and modern passwordless approaches for verifying user identity.
What is Authentication?
Authentication is the process of verifying the identity of a user, device, or system. It answers the fundamental question: "Are you who you claim to be?" Authentication is distinct from identification (claiming an identity) and authorization (determining what an authenticated entity can do).
| Something You | Something You | Something You |
|---|---|---|
| KNOW | HAVE | ARE |
| Password | Smart card | Fingerprint |
| PIN | Security token | Iris scan |
| Security question | Mobile phone | Face recognition |
| Pattern | Hardware key | Voice print |
Authentication Flow
Three Authentication Factors
Authentication Factor Types
Factor 1: Knowledge (Something You Know)
The most common but weakest authentication factor:
| Method | Strength | Vulnerability |
|---|---|---|
| Passwords | Varies | Phishing, brute force, credential stuffing |
| PINs | Low | Shoulder surfing, limited keyspace |
| Security Questions | Low | Social media research, data breaches |
| Passphrases | High | Still vulnerable to keyloggers |
Factor 2: Possession (Something You Have)
| Method | Strength | Vulnerability |
|---|---|---|
| SMS OTP | Medium | SIM swapping, SS7 attacks |
| TOTP App | High | Phone theft (if no PIN) |
| Hardware Token (YubiKey) | Very High | Physical theft (rare) |
| Smart Card | Very High | Physical theft + PIN needed |
| Push Notification | High | MFA fatigue attacks |
Factor 3: Inherence (Something You Are)
| Method | FAR* | FRR** | Spoofability |
|---|---|---|---|
| Fingerprint | 0.001% | 0.1% | Moderate (gummy fingers) |
| Iris Scan | 0.0001% | 0.2% | Low |
| Face Recognition | 0.01% | 0.5% | Moderate (photos, masks) |
| Voice Print | 0.1% | 1% | High (deepfakes) |
| Behavioral (typing) | 1% | 2% | Low |
*FAR = False Acceptance Rate, **FRR = False Rejection Rate
Multi-Factor Authentication (MFA)
MFA combines two or more factors from different categories:
Example
import hashlib
import hmac
import time
import struct
import os
class TOTPAuthenticator:
"""Time-based One-Time Password (RFC 6238) implementation."""
def __init__(self, secret: bytes = None):
self.secret = secret or os.urandom(20)
self.time_step = 30 # seconds
self.digits = 6
def generate_totp(self, timestamp: int = None) -> str:
"""Generate a TOTP code for the current time window."""
if timestamp is None:
timestamp = int(time.time())
# Calculate time counter
counter = timestamp // self.time_step
# Convert counter to 8 bytes big-endian
counter_bytes = struct.pack(">Q", counter)
# Compute HMAC-SHA1
hmac_digest = hmac.new(
self.secret, counter_bytes, hashlib.sha1
).digest()
# Dynamic truncation
offset = hmac_digest[-1] & 0x0F
code = struct.unpack(">I", hmac_digest[offset:offset + 4])[0]
code = code & 0x7FFFFFFF
code = code % (10 ** self.digits)
return str(code).zfill(self.digits)
def verify_totp(self, code: str, window: int = 1) -> bool:
"""Verify TOTP code with time window tolerance."""
current_time = int(time.time())
for i in range(-window, window + 1):
check_time = current_time + (i * self.time_step)
expected = self.generate_totp(check_time)
if hmac.compare_digest(code, expected):
return True
return False
# Demonstration
auth = TOTPAuthenticator(b"JBSWY3DPEHPK3PXP12345")
code = auth.generate_totp()
print(f"Current TOTP code: {code}")
print(f"Valid for: {30 - (int(time.time()) % 30)} more seconds")
print(f"Verification: {auth.verify_totp(code)}")
Password Security Best Practices
Example
import hashlib
import os
import re
class PasswordManager:
"""Secure password handling with hashing and validation."""
def __init__(self):
self.min_length = 12
self.common_passwords = {"password", "123456", "qwerty", "admin"}
def hash_password(self, password: str) -> dict:
"""Hash password using PBKDF2 with random salt."""
salt = os.urandom(32)
iterations = 600000 # OWASP 2024 recommendation
key = hashlib.pbkdf2_hmac(
'sha256', password.encode(), salt, iterations
)
return {
"hash": key.hex(),
"salt": salt.hex(),
"iterations": iterations,
"algorithm": "pbkdf2_sha256"
}
def verify_password(self, password: str, stored: dict) -> bool:
"""Verify password against stored hash."""
salt = bytes.fromhex(stored["salt"])
key = hashlib.pbkdf2_hmac(
'sha256', password.encode(), salt, stored["iterations"]
)
return hmac.compare_digest(key.hex(), stored["hash"])
def check_password_strength(self, password: str) -> dict:
"""Evaluate password strength."""
checks = {
"length": len(password) >= self.min_length,
"uppercase": bool(re.search(r"[A-Z]", password)),
"lowercase": bool(re.search(r"[a-z]", password)),
"digits": bool(re.search(r"\d", password)),
"special": bool(re.search(r"[!@#$%^&*(),.?\":{}|<>]", password)),
"not_common": password.lower() not in self.common_passwords,
"no_sequences": not re.search(r"(012|123|234|345|456|567|678|789|abc|bcd)", password.lower()),
}
score = sum(checks.values())
strength = "weak" if score < 4 else "medium" if score < 6 else "strong"
return {"checks": checks, "score": f"{score}/7", "strength": strength}
# Example
pm = PasswordManager()
result = pm.check_password_strength("MyS3cur3P@ssw0rd!")
print(f"Password strength: {result['strength']} ({result['score']})")
for check, passed in result["checks"].items():
print(f" {'✓' if passed else '✗'} {check}")
Authentication Protocols
Kerberos Authentication
Kerberos Authentication Flow
================================
Client KDC (AS + TGS) Service
| | |
| 1. AS_REQ | |
| (username) | |
|------------------>| |
| | |
| 2. AS_REP | |
| (TGT encrypted | |
| with client key)| |
|<------------------| |
| | |
| 3. TGS_REQ | |
| (TGT + service | |
| requested) | |
|------------------>| |
| | |
| 4. TGS_REP | |
| (Service Ticket) | |
|<------------------| |
| | |
| 5. AP_REQ (Service Ticket) |
|--------------------------------------->|
| | |
| 6. AP_REP (optional mutual auth) |
|<---------------------------------------|
Key concepts
- TGT: Ticket Granting Ticket (proves identity to KDC)
- Service Ticket: Proves identity to specific service
- No password sent over network after initial auth
- Tickets have expiration times (typically 8-10 hours)
OAuth 2.0 / OpenID Connect
Example
OAuth 2.0 Authorization Code Flow:
=====================================
User Client App Auth Server Resource Server
| | | |
| 1. Click | | |
| "Login" | | |
|------------>| | |
| | 2. Redirect to | |
| | auth endpoint | |
|<------------|---------------->| |
| | | |
| 3. User logs in & consents | |
|------------------------------>| |
| | | |
| 4. Redirect with auth code | |
|<------------------------------| |
|------------->| | |
| | 5. Exchange | |
| | code for token | |
| |--------------->| |
| | | |
| | 6. Access token| |
| |<---------------| |
| | | |
| | 7. API request with token |
| |---------------------------------->|
| | | |
| | 8. Protected resource |
| |<----------------------------------|
Common Authentication Attacks
| Attack | Description | Defense |
|---|---|---|
| Brute Force | Try all possible combinations | Account lockout, rate limiting |
| Credential Stuffing | Use leaked credentials from other breaches | MFA, breach monitoring |
| Phishing | Trick user into revealing credentials | Security awareness, FIDO2 |
| Pass-the-Hash | Use stolen hash directly | Credential guard, network segmentation |
| MFA Fatigue | Spam push notifications until user accepts | Number matching, time limits |
| SIM Swapping | Take over phone number for SMS OTP | Use app-based TOTP or hardware keys |
Interview Questions
- What is the difference between authentication and authorization?
- Authentication verifies identity ("who are you?") while authorization determines permissions ("what can you do?"). Authentication must happen before authorization.
- Why is SMS-based MFA considered weaker than app-based TOTP?
- SMS is vulnerable to SIM swapping attacks (social engineering the carrier), SS7 protocol vulnerabilities (intercepting messages), and the message travels in cleartext. TOTP apps generate codes locally using a shared secret.
- Explain how Kerberos prevents replay attacks.
- Kerberos uses timestamps (authenticators) and ticket expiration. Each request includes a timestamp encrypted with the session key. The server maintains a cache of recent authenticators and rejects duplicates. Tickets expire after a configured period.
- What is credential stuffing and how do you prevent it?
- Credential stuffing uses username/password pairs leaked from one service to try logging into other services. Prevention: MFA, rate limiting, CAPTCHA, monitoring for impossible travel, breach notification services, password managers promoting unique passwords.
- Compare FIDO2/WebAuthn with traditional password-based authentication.
- FIDO2 uses public-key cryptography with the private key stored in hardware (phone/security key). It is phishing-resistant (bound to origin), eliminates shared secrets, provides strong authentication without passwords, and supports passwordless flows.
Summary
Authentication is the gateway to security — if an attacker can bypass authentication, all other controls become irrelevant. Modern authentication moves beyond passwords toward multi-factor, risk-adaptive, and passwordless approaches. Understanding the strengths and weaknesses of each method is essential for building secure systems.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Authentication in Information Security.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, fundamentals, authentication, authentication in information security
Related Information Security Topics
Continue learning this concept
Security FundamentalsAccountability in Information SecurityUnderstanding accountability principles in information security including audit trails, logging, monitoring, non-repudiation mechanisms, and how to establish responsibility for security actions.Security FundamentalsAuthorization in Information SecurityUnderstanding authorization mechanisms, access control models, permission systems, and the principle of least privilege for controlling what authenticated users can do within systems.Security FundamentalsAvailability in Information SecurityUnderstanding the availability principle of the CIA Triad, including redundancy strategies, disaster recovery, DDoS protection, and ensuring systems remain accessible to authorized users when needed.Security FundamentalsConfidentiality in Information SecurityDeep dive into the confidentiality principle of the CIA Triad, exploring encryption methods, access controls, data classification, and practical implementations to protect sensitive information from unauthorized disclosure.Security FundamentalsIntegrity in Information SecurityComprehensive guide to the integrity principle of the CIA Triad, covering hash functions, digital signatures, checksums, database integrity, and techniques to detect and prevent unauthorized data modification.Security FundamentalsNon-Repudiation in Information SecurityUnderstanding non-repudiation as a security service that provides undeniable proof of origin, delivery, or action, covering digital signatures, timestamps, and legal frameworks.