Logging in to the warehouse
An analyst opens her firm's data system. First she types a username. That is a claim: "I am Sam from the sales team."
Then the system asks for a password and a code from her phone. That is the proof.
These are the first two steps of a model called IAAA: saying who you are, then proving it.
Key words
| Word | What it means |
|---|---|
| IAAA | Four steps in secure access: say who you are, prove it, get your rights, and be recorded. |
| Identification | Saying who you are, so the system can recognise you. |
| Authentication | Proving that you are who you said you are. |
| Username | A name that identifies an account. |
| Knowledge factor | Something you know, such as a password. |
| Possession factor | Something you have, such as a card or a phone. |
| Biometric | Something you are: a body feature such as a fingerprint. |
| MFA | Multi-factor authentication: using two or more different kinds of proof. |
| Passphrase | A password made of several words. |
| Authorisation | Deciding what a logged-in user may do. It is the next lesson. |
| Token | A small device or app that makes a code for logging in. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can explain identification (saying who you are) and authentication (proving it), with the benefit and drawback of each method.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Identification is the claim
Identification is recognising an individual in a digital system. You say who you are. It is only a claim.
There are three ways to be identified:
Knowledge-based: something you know, such as a username.
Possession-based: something you have, such as a staff card.
Biometric-based: something you are, such as a face or a fingerprint.
Authentication is the proof
Authentication checks that the claim is true. Anyone can type a username, so the system asks for proof.
Proof can be a password or passphrase (knowledge), a phone code or token (possession) or a fingerprint (biometric).
With MFA, the system asks for two or more different kinds. A password and a fingerprint is MFA. Two passwords is not.
Worked example: benefits and drawbacks
| Method | Kind | Benefit | Drawback |
|---|---|---|---|
| Username | Knowledge: identification | Simple, free | Easy to guess, so it proves nothing |
| Password | Knowledge | Cheap and familiar | Guessed, stolen, reused, forgotten |
| Passphrase | Knowledge | Long and easy to remember | Still a secret that can be stolen |
| Card or phone | Possession | Hard to steal at a distance | Can be lost or stolen |
| Fingerprint or face | Biometric | Always with you, fast | Cannot be changed if stolen, may be wrong sometimes |
| MFA | Two or more kinds | A stolen password is not enough | Extra effort, a lost phone causes trouble |
The cells students fill in are left blank in this preview.
Check: identification and proof
Have a go
Check: identification and proof
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.