Concept - Authentication Security Issues
| Issue | Description | Countermeasure |
|---|---|---|
| Client attacks (s.28) | try to achieve authentication without access to the remote host; masquerade as a legitimate user (guess or try all passwords) | strong passwords; limit number of attempts |
| Host attacks (s.29) | attack the host where passwords/passcodes are stored | hashing, protect password databases |
| Eavesdropping (s.30) | learn passwords by observing the user, finding written passwords, keylogging | diligence to keep passwords; multifactor authentication; admin revokes compromised passwords |
| Replay (s.31) | repeat a previously captured user response | challenge-response; 1-time passcodes (OTP) |
Exam tip: match each of the four names to its one-line description and countermeasure.
Related: Concept - Challenge-Response, Concept - Password Hashing and Salt, Concept - Password Vulnerabilities and Countermeasures. Appears in 03 User Authentication - Chunk 01 (s.1-33).