Multifactor Authentication - CompTIA Security+ SY0-701 - 4.6

Summary

The script discusses various authentication factors used for secure logins, including 'something you know' like passwords and PINs, 'something you have' such as smart cards and USB security keys, 'something you are' involving biometrics, and 'somewhere you are' using location data. It highlights the importance of combining these factors for robust security, noting the rise of software tokens and the potential pitfalls of relying solely on biometrics.

Takeaways

• 🔐 Username and password are common authentication factors for logging into websites.
• 📱 Mobile apps can provide pseudo-random codes or use GPS location as part of the login process.
• 🔑 Authentication factors are categorized as something you know, have, are, or somewhere you are.
• 🤔 'Something you know' includes passwords, PINs, and patterns, which are memorized and known only to the user.
• 🏢 'Something you have' could be a smart card, USB security key, or hardware token that verifies your identity.
• 📲 Software tokens and SMS codes sent to your mobile phone can also serve as 'something you have' for authentication.
• 👤 'Something you are' refers to biometric authentication like fingerprints or voiceprints, which are unique to the individual.
• 📊 Biometric data is stored as a mathematical representation rather than the actual biometric sample.
• 🌐 'Somewhere you are' uses location data, such as GPS or IP addresses, to authenticate users based on their geographical location.
• 🔄 Multiple authentication factors are often used together to enhance security and prevent unauthorized access.
• 📍 Geolocation services can combine IP addresses and GPS coordinates to determine a user's physical location for authentication purposes.

Q & A

What are authentication factors?

Authentication factors are different types of login parameters used to verify the identity of a user, such as something you know, something you have, something you are, or somewhere you are.

What is 'something you know' in the context of authentication factors?

'Something you know' refers to information that only the user is aware of, such as a password, a personal identification number (PIN), or a pattern to unlock a device.

Can you provide an example of 'something you have' authentication factor?

An example of 'something you have' is a USB security key that contains a certificate specific to the user, which must be plugged in to authenticate.

How does a hardware token work as an authentication factor?

A hardware token generates a seemingly randomized set of numbers that are duplicated on the server, and the user must input this number during the login process along with their username and password.

What is the role of biometric authentication in the 'something you are' category?

Biometric authentication uses unique personal traits like fingerprints or voiceprints as an authentication factor, storing a mathematical representation of the biometric for verification.

Why might 'something you are' be used in conjunction with other authentication factors?

'Something you are' is often used with other factors because biometrics can potentially be circumvented, adding an extra layer of security.

What is the concept of 'somewhere you are' as an authentication factor?

'Somewhere you are' uses location information, such as GPS coordinates or IP address, to determine if the login attempt is from a recognized location.

How can the location information from a mobile device be used for authentication?

The location information from a mobile device can be used to verify if the login attempt is from a location consistent with the user's usual whereabouts, adding a layer of security.

What is the difference between storing a biometric image and its mathematical representation?

Storing a biometric image involves saving the actual picture, while a mathematical representation involves saving a unique set of data derived from the biometric, which is used for comparison during authentication.

How does the use of SMS or text messages as an authentication factor work?

SMS or text messages can be used to send a code to the user's phone, which they then enter during the login process as an additional verification step.

Why might the authentication process use multiple location services?

Using multiple location services, such as IP address and GPS coordinates, can provide a more accurate and comprehensive understanding of a user's physical location, enhancing the security of the authentication process.

Outlines

00:00

🔐 Authentication Factors Overview

This paragraph introduces the concept of authentication factors used during the login process on websites and applications. It explains different types of authentication factors such as 'something you know' (passwords, PINs, patterns), 'something you have' (smart cards, USB security keys, hardware tokens, software tokens, mobile devices), 'something you are' (biometrics like fingerprints or voiceprints), and 'somewhere you are' (location-based authentication using GPS or IP addresses). The paragraph emphasizes the importance of combining these factors for enhanced security and touches on the challenges and circumvention of biometric authentication.

Keywords

💡Authentication Factors

Authentication factors are methods used to verify the identity of a user during the login process. They are crucial for ensuring security and are the central theme of the video. The script discusses various types of authentication factors, such as something you know, something you have, something you are, and somewhere you are, illustrating the multi-layered approach to securing access to systems.

💡Username and Password

A username and password are the most common 'something you know' authentication factors. They are personal identifiers that users memorize and enter to gain access to websites or applications. The script mentions them as the starting point for discussing different authentication methods.

💡Mobile App

A mobile app can generate a pseudo-random code for authentication, serving as 'something you have'. The script uses this as an example of how modern technology can enhance security by providing a dynamic and temporary access credential.

💡GPS Location

GPS location is used as 'somewhere you are', an authentication factor that considers the physical location of the user. The script explains how systems can use this to determine if a login attempt is legitimate based on the user's usual location.

💡Personal Identification Number (PIN)

A PIN is a numeric code used to authenticate identity, often in conjunction with a physical card, making it a form of 'something you know'. The script provides the example of an ATM card, where a PIN is required for access.

💡Smart Card

A smart card is a physical device that can store data and is used as 'something you have'. The script mentions it as a device that can be inserted into a reader for authentication, often in combination with a PIN.

💡USB Security Key

A USB security key is a physical device that contains a unique certificate for a user, serving as 'something you have'. The script explains that when the key is plugged in, it authenticates the user based on the assumption that only the rightful owner possesses the key.

💡Biometric Authentication

Biometric authentication uses unique physical characteristics like fingerprints or voiceprints as 'something you are'. The script describes how it works by storing a mathematical representation of the biometric data, emphasizing its difficulty to replicate or modify.

💡Hardware Token

A hardware token is a device that generates a seemingly randomized set of numbers, used as an additional authentication factor. The script explains how it works in tandem with a username and password, requiring the user to input the number displayed on the token during login.

💡Software Tokens

Software tokens are applications on mobile devices that can generate authentication codes, serving the purpose of 'something you have'. The script mentions them as a convenient alternative to carrying a hardware token.

💡SMS or Text Messages

SMS or text messages can be used to send a code to a user's phone, which is then used as an authentication factor during the login process. The script describes this method as a practical way to leverage the user's possession of a mobile device.

💡Geolocation

Geolocation is the process of determining a user's physical location, used as 'somewhere you are'. The script discusses how it can be an authentication factor, with systems using IP addresses or GPS coordinates to verify if a login attempt is from a familiar location.

Highlights

Common use of username and password for website logins.

Authentication factors include mobile apps providing pseudo random codes and considering GPS location.

Authentication factors categorized as something you know, have, are, or somewhere you are.

Passwords and personal identification numbers (PINs) are examples of 'something you know'.

Patterns used to unlock mobile devices also fall under 'something you know'.

Smart cards and USB security keys are examples of 'something you have'.

Hardware and software tokens generate randomized numbers for authentication.

SMS or text messages can be used to send codes for the login process as part of 'something you have'.

Biometric authentication like fingerprints and voiceprints are 'something you are'.

Biometric data is stored as a mathematical representation, not as an image.

Biometrics are difficult to change or modify, often used with additional authentication factors.

Mobile devices can use location information as 'somewhere you are' for authentication.

Geolocation can prevent logins from unexpected countries based on user's previous location.

IP addresses can provide an approximate location but are not always accurate.

Combining IP addresses with GPS coordinates can improve location accuracy for authentication.

Using multiple location services enhances the 'somewhere you are' authentication factor.

Transcripts

When you log into a website, it's very common

to use a username and password.

There might be a mobile app that provides a pseudo random code

or it may take into account your GPS location.

We refer to these different types of login parameters

as authentication factors, and some very common authentication

factors might be something you know, something you have,

something you are, or somewhere you are.

Although these are very popular authentication factors,

there are others you could use as well.

Something you know is probably one of the most popular

authentication factors because this includes the password

that you've memorized.

Obviously, your password is made up

of a string of characters or a particular phrase,

and it's something that's only known to you.

Another good example of something you know

is a personal identification number.

If you put your card in to an ATM,

you're commonly asked to provide a four-digit PIN.

This personal identification number

isn't written down anywhere, so it clearly would be something

that only you know.

And you might have a mobile phone

or a tablet that uses some type of pattern

to be able to unlock that system.

This is also referred to as something

you know since you're the only one who

knows the specific pattern that allows

you access to that device.

Another type of authentication factor is something you have.

For example, you might have an ID,

and that ID is part of a smart card.

That smart card can be inserted into a device,

and usually it's used in conjunction

with the personal identification number

to provide multiple types of authentication.

Another good example of something you have

is a USB security key.

The security key has a certificate

on that key that is specific to you.

So if you plug in that key, it's assumed

that must be because you're the only one with that USB drive.

You might also have a hardware device that

creates a seemingly randomized set of numbers,

and those numbers are also duplicated on the server.

So when you log in with the username and password,

you might also be asked to input the number that happens

to be on your hardware token.

There are also software tokens available

that you can use on your mobile phone

so that you don't have to carry around yet another device.

And carrying your phone with you also is something

you have, and it's not uncommon to use SMS or text messages

to send a code to your phone that you can

use during the login process.

A type of authentication factor that is very personal

is something you are.

This is commonly used with biometric authentication

where you're using a fingerprint, a voiceprint,

or something else that is specific to you as a person.

This works by storing a mathematical representation

of the biometric.

So a picture of your fingerprint itself

is not being stored and compared.

It's actually a mathematical representation

of your fingerprint.

This is also a very difficult type of authentication factor

to change or modify since it's very difficult

to change something like a voiceprint or a fingerprint.

And usually this type of authentication factor

is used in conjunction with other factors at the same time,

especially since we've seen situations where

biometrics can be circumvented.

So you may want to include this something you are along

with one of the other authentication factors as well.

Our mobile devices are very good at determining our location,

and we can use that location information

as an authentication factor we call somewhere you are.

For example, if a login is attempted from a country that's

different than where you were 10 minutes ago,

the system may not allow that login to occur because it's

checking on somewhere you are.

We can also get an idea of where someone might

be based on their IP address.

This is not a perfect representation

of where someone might be, and it becomes much more difficult

when we start having much larger addresses, such as the ones

found with IP version 6.

And of course, we could use multiple types

of location services to determine

where someone might be.

We could query their IP address, combine

that with GPS coordinates to help

understand where a person may physically be located.

And once that geolocation process is complete,

it can all be used as another authentication factor

to allow you to log into the system.