Protecting an account

Which account, and what evidence?

An account is a record used to access a service, such as a school learning site. A username names the account. Authentication checks evidence before allowing access

1. 1A password is a secret A password or passphrase is something the person knows. A passphrase uses words. Keep it unpredictable, unique to the account and unshared
2. 2Secrets can be compromised Compromised means the secret is no longer safely private. Another person who learns the password may pass that check too
3. 3A second kind of evidence A registered security key is a device linked to the account. Our key check passes only when the person can successfully use that key, including any activation it needs

The shared class list contains the username art-room. What does knowing this username show by itself?

Different kinds of evidence

An authentication factor is a category of evidence. Multi-factor authentication, or MFA, uses different categories, not just two screens

1. 1Knowledge: something you know A password and a PIN are both knowledge checks. Using both still repeats one category
2. 2Possession: something you have Successful use of a registered security key is a possession check. It is different from knowing the password
3. 3Biometric: a measured personal feature Fingerprint and face matching are biometric checks. They are two methods in the same category

Which pair uses two different factor categories? Classify the named checks, not the number of screens

Predict: the password check passes, but the registered-key check does not. What changes if the system requires both checks rather than only the password?

Keep Password check Passed and Registered-key check Not passed. Change Required checks from Password only to Password + key. Then pass the key check. Finally, try a failed password check. Compare which required check blocks sign-in

When the password check passes but the key check does not, why does adding the key requirement change the result?

Every required check must pass

Suppose both password and key are required. The password check has not passed, but the key check has. The sign-in is blocked: the passed key does not replace the required password

1. 1List the required checks Here the list has two entries: password and registered key
2. 2Match the supplied results Password: not passed. Key: passed. One required check is still missing, so the complete requirement is not met
3. 3Do not count an unused check Under a password-only requirement, the key is not on the required list. Its result does not decide the sign-in

Both password and registered key are required. Which required checks have not passed? Include every missing check in one answer

Keep these results fixed. Compare a password-only requirement with a requirement for both password and key. What follows?

One case can disprove a claim

A claim says: passing the password check is always enough. Test a case where both checks are required, the password passes and the key does not. Sign-in is blocked. This one counterexample makes the claim false

1. 1Look for a contradiction A counterexample must disagree with the claim. A case where password-only sign-in passes does not disprove it
2. 2Accepted evidence is not certainty If someone other than the owner can complete both required checks, this model accepts those checks too. A second factor helps protect an account; it is not a guarantee against every attack

Evidence, categories, requirements

Name the account, identify the evidence, then check every stated requirement. MFA uses different factor categories. A password plus another password is still one category

1. 1Explain a blocked attempt For example: the password passed, but the required key check did not, so this sign-in is blocked
2. 2Keep the conclusion precise Required checks passed describes the model's result. It does not prove rightful ownership or that every account threat has been prevented