Authentication

When you open up a website, you may need to provide a username and password, or maybe if you enter a secure building, you may need to show a guard your ID. These processes are part of the process of authentication: the process of providing information about yourself so the system or security team can verify your identity and let your though. It may seem simple, but it prevents a lot of impersonation and lost property.

There are multiple types of authentication, and they can easily be separated into three categories:

Something you HAVE: Something physical that only you have.

• Keycard: An electronic card that needs to be tapped or swiped on a device to allow entry.
• ID card: A card that displays a name and photo of the person it belongs to. If person A shows up with person Bs ID card, they will not allow entry. Same goes if person B shows up without their ID card. They have no proof of who they are, therefore cannot enter.
• OTP (One Time Password): Single use passwords that are typically received via SMS, email, or authentication app. OPTs are typically used for websites to show that you actively possess or have access to a device or application linked to the profile you are accessing.

Something you KNOW: Something only you would know/have memorized.

• Password: A memorized string or characters that must be input correctly to allow access. Typically websites require a certain amount of letter, numbers, and special characters for each password to ensure that they are secure and not easy to guess.
• Passphrases: Similar to passwords, but uses words instead of a single string of characters. These are typically phrases or sentences.
• Security questions: Questions specific to you that must be answered correctly to allow entry. These use prompts and input fields to test your knowledge of things you should easily remember (i.e. your mothers maiden name, the name of your childhood pet, your 4th grade math teacher etc). Typically, there are multiple questions to be answered to make things more complicated for intruders.

Something you ARE: A physical characteristic that only you can possess.

• Face ID: A scan of your face is compared to the one on file. If it matches, access is granted.
• Finger ID: A scan of your finger print is compared to the one of file. Finger prints are completely unique to you and tough to crack.

Online, you’ll typically have to present a username and one authentication method (usually a password), but many websites may take advantage of MFA (Multi Factor Authentication), where you have to submit multiple types of authentication. Although it may seem tedious, it adds an extra layer of protection on top of your password or previous authentication method, keeping your information secure.

Authentication tokens

But first, A quick and simple summary on tokens: Tokens are stand in values that represent sensitive data. They either contain sensitive data, or are random strings that are used as a reference to the real data withing the vault.

After successfully logging in, you receive an authentication token. This token represents (or contains) your credentials so you don’t have to log in to prove your identity every time you use an application or service.

Take your google account for example. Once you log into google, you can use your google account to make/link other accounts on different websites. Once you’re logged into google, you are presented with the “use google account page” where all you have to do is click the account you want to use and it automatically signs in for you.

Authentication tokens are also secure, strings of random characters that don’t mean anything if someone else gets their hands on them, but they still serve their purpose as they relate back to the credentials.

Password Managers

You may be tempted to use a Password manager to keep track of your passwords for many different accounts or log in information. They autofill your passwords for you to make the log in process less of a hassle. However, before committing to these, you may want to consider the pros and cons:

Get Jacob Piloto’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Pros:

• Convenience: Password Managers are incredibly convenient, storing all of your passwords in one place and auto filling credentials for you when you visit a website. Many allow synchronization across devices as well, letting you access your passwords at all times with ease.
• Security: If you use a password manager, you don’t have to worry about remembering any of your passwords besides the one to log into the password manager itself. With that being said, you can set each website password to complete gibberish, having no meaningful value, but remaining incredibly secure, and preventing attackers from cracking any of your log in info for any website.

Cons:

• One point failure: Although some password managers may be incredibly secure, anyone that gets inside would have access to EVERYTHING. Defense in depth is a major part of cyber security, and putting all of your passwords behind a lock is not a good practice of it.
• Adding on: One point failure is also bad in the opposite direction. If your password to access the password manager is too complicated and you forget it, you could be temporarily be locked out, unable to access any of your accounts.
• Phishing: If you visit a fraudulent website accidentally, your password manager might accidentally autofill and submit your information and you would not know until it’s too late.

If you decide to look into password managers, keep in mind that you are consolidating all of your passwords into one single goldmine for attackers. Make sure you do thorough research on which password manager you decide to use. One that uses MFA would be more secure than others.

Tidbits

• Authentication dose not just happen online or withing computers. Authentication happens when you enter a secure location. this could be giving a guard your ID when entering a secure location, or giving a police your license after getting pulled over. Authentication is not just a computer process, it’s a process overall.
• It’s important not to confuse authentication and authorization. Although they are closely related, they are not the same. Where authentication is the process of proving that you are a user, authorization is the process of checking what that user can do. Authorization happens right after authentication, but the two are very different.
• Treat your log in information with care. You may not even realize it but one account, even one that you don’t use anymore, could give an attacker plenty of information to figure out who you are, what you do, and what kind of information you would remember.
• Don’t repeat passwords. If you do, and you fall for a phishing attack, they would have access to so much information about you, and they could even change your password and lock you out forever.
• There might be moments where you receive phishing messages about your Netflix account or a PayPal transaction you never made. It’s important not to fall for the clever tricks that these attackers can pull. Know your phishing types:

TLDR:

• Authentication is the process of proving your identity. It issued to prevent unwanted traffic or access to certain areas.
• MFA is the is the use of multiple authentication methods
• there are three types of authentication methods: what you have, what you know and what you are.
• Authentication tokens remove the need for multiple log in attempts when accessing an application of linked account. They work by taking the. place of your credentials and acting as a reference to them
• authentication tokens are strings of random characters that act as a reference to you credentials. This reduces the risk of your credentials exposure.
• Password managers can be very convenient, but they may not be the most secure option.