Question

Implementation of User's Authentication and Authorization. What network technology are you planning to implement user's authentication and authorization by application? Where in the network would reside such functionality?

Answer 1

Ans). Well, there are many phases where a possible breach can occur.

--> Firstly, to avoid key loggers attack, we can use virtual keyboard and disable keystroking.

--> Now, to send the password over the channel for authentication, we must encrypt it. We'll use RSA cipher for that to avoid key exchange problems.

--> On the server side also, we must store only hash values of the passwords and the whole passwords as plaint text. In case of plain texts, any successful attack on servers would disclose all login credentials. We should hash passwords and store only hash values at server.

--> when someone requests for authentication, hash value of input password is checked with the one stored at servers.

--> To avoid brute force attack, we can include max wrong tries limit and captcha.

Hope it helped! Feel free to ask any doubt in comments. Don't forget to upvote if it helped :).