Authentication: Passwords
Computer Science: Cambridge International GCSE, topic 1.6.10
Cracking Passwords
Many hackers focus their attention on cracking passwords to overcome authentication mechanisms.
Cracking passwords
- Authentication is the name for any methods which allow users to prove that an account is theirs.
- The most common authentication method is using a password.
- Many hackers want to find people's passwords, so that they can gain access to accounts:
- Finding people's passwords is called cracking the password.
The brute force attack
- A brute force attack tries to crack a password by trying every single combination of letters and numbers until the correct one is found.
- This can take a very long time, although special software is used to do this which makes it possible to make millions of attempts per second.
The dictionary attack
- A quicker form of the brute force attack is the dictionary attack.
- Rather than attempting every single combination, a dictionary attack tries words from a predetermined list:
- A common dictionary to use would be a list of common passwords.
Protection against cracking
- Writing a network policy which enforces strong passwords can protect against dictionary attacks.
- Using two-factor authentication can prevent the hacker from logging in, even if they have the password.
- Restricting the number of failed password attempts before an account is 'locked' for a fixed period of time can deter hackers.
Passwords
Passwords are one method of providing authentication.
Purpose of passwords
- Passwords help to prevent unauthorised users from accessing a device or network.
- Passwords are one of the simplest authentication methods.
Issues with passwords
- Passwords are only effective if:
- They remain secret.
- The password is strong against brute force attacks.
- Stronger authentication systems can be created by implementing features such as two-factor authentication.
Principles of a strong password
- A strong password should:
- Be long.
- Use letters, numbers, and symbols.
- Be changed regularly.
- Never be written down.
Test yourself on Authentication: Passwords
What is a brute force attack?
Which of these is true of a dictionary attack?
How can stronger authentication systems be developed?