What is authentication?
Authentication is proving that you are the person or the program you say you are. A system that cannot tell users apart cannot protect anything from them.
You do it many times a day: a phone passcode, a card and a PIN, a code sent by text message. They are different ways to answer the same question.
By the end of this lesson
Note
I can compare ways to prove who you are and judge a password.
Key words
| Word | What it means |
|---|---|
| Authentication | proving who you are to a system |
| Factor | one kind of proof of who you are |
| Multi-factor authentication | using proofs of two or more different kinds |
| Brute force | trying guess after guess until one works |
| Passphrase | a long password made of random words |
| Account | the identity a system gives to a user |
The cells students fill in are left blank in this preview.
There are three kinds of proof
A factor is one kind of proof. There are three.
Something you know, such as a password. Something you have, such as a phone or a card. Something you are, such as a fingerprint.
Multi-factor authentication uses two or more different kinds. A thief who steals the password still has no phone.
Worked example: three factors compared
| Factor | Example | How it fails |
|---|---|---|
| Know | A password | It is guessed, reused or told to a stranger |
| Have | A phone that receives a code | The phone is lost or stolen |
| Are | A fingerprint | It cannot be changed once copied |
| Know and have | A password and a code | The thief needs both |
The cells students fill in are left blank in this preview.
Longer passwords have far more guesses
A thief using brute force tries every possible password. The number of possibilities is the number of symbols to the power of the length.
Eight lowercase letters give 26 symbols to the power 8. Eight letters and digits, upper and lower, give 62 to the power 8. Five random words from a list of 2,000 give 2,000 to the power 5.
Eight lowercase letters
echo $((26**8))Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Eight letters and digits
echo $((62**8))Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Five random words from 2,000
echo $((2000**5))Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Worked example: the number of guesses
| Password type | Possibilities | Read as |
|---|---|---|
| 8 lowercase letters | 208,827,064,576 | about 209 billion |
| 8 letters and digits | 218,340,105,584,896 | about 218 trillion |
| 5 random words | 32,000,000,000,000,000 | about 32 quadrillion |
The cells students fill in are left blank in this preview.
A common mistake
Warning
Many people think a capital letter, a digit and a symbol make a strong password. P@ssw0rd1 follows those rules and is on every list of guesses, because everyone changes the same letters. Length and unpredictability protect you. Tricks do not.
Count the characters in four passwords
printf 'password\n123456\nqwerty\nBlue-Harbour-Seven-Clock\n' | awk '{print length($0)}'Shown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
A system checks accounts, not people
A system never sees you. It sees an account, a name with a password and some rights. Anyone who proves they know the password is treated as that account.
So the most powerful accounts need the strongest proof. On Linux the root account has the user id 0, the number the system uses to decide who may do anything.
Which accounts have the user id 0?
awk -F: '$3 == 0 {print $1}' /etc/passwdShown here, not run. Create a free account to press Run and type it into your own lab’s terminal.
Going further
Choose three of your own online accounts. For each, write which factors it asks for, and which one you would add.
Then say what happens to each account if your phone is lost. A good plan names a way back in before the phone goes missing.