Identification, Authentication and Authorization - Quiz

Correct option:
TRUE

Explanation:
Authorization is the process of granting or denying access to resources or actions based on the user's identity and permissions. However, authorization can only be performed after identification (the process of identifying the user or system) and authentication (the process of verifying that the identified entity is legitimate). Without these initial steps, the system would not know who the user is or whether they should be granted access to the requested resources.

Correct option:
An open standard that allows users to share personal resources stored on a site with another site, without having to share their credentials.

Explanation:
OAuth (Open Authorization) is an open standard for access delegation. It allows users to grant third-party applications limited access to their resources (like data) on another service without sharing their credentials (such as username and password). For example, a user might allow an application to access their Google contacts, but the application would not have access to their Google password. OAuth allows this secure delegation of access through access tokens, rather than exposing the user's credentials.

Correct option:
A system or entity which can verify and prove identity to other systems/entities involved in the SSO mechanism. Typically, this is also the entity that generates and verifies the SSO token.

Explanation:
In an SSO (Single Sign-On) solution, the identity provider (IdP) is the entity responsible for authenticating the user and verifying their identity. It provides identity information to other systems (called service providers) by generating and verifying the SSO token or authentication assertion, which allows users to access multiple applications without needing to authenticate again.

The IdP does not necessarily encrypt or provide passwords directly to other systems; instead, it manages user credentials and authentication.

Correct option:
All the above options

Explanation:
All of the listed protocols are commonly used for Single Sign-On (SSO):

• OpenID Connect is a protocol that works on top of OAuth 2.0, allowing users to authenticate with an identity provider.
• SAML (Security Assertion Markup Language) is an XML-based protocol that allows secure exchange of authentication and authorization data between an identity provider and a service provider.
• Kerberos is a network authentication protocol that uses secret-key cryptography for authenticating users and services.
• OAuth is a token-based protocol primarily used for authorization but can also be used as part of SSO implementations.

Thus, all of these protocols can be used for implementing SSO.

Correct option:
The process where stolen account credentials (usernames and/or email addresses and the corresponding passwords), mostly from a data breach, are used to gain unauthorized access.

Explanation:
Credential stuffing is a type of cyberattack where attackers use stolen account credentials (username and password pairs) from one data breach to try and gain unauthorized access to users' accounts on other websites. This works because many people reuse the same login credentials across multiple services. If attackers have access to a breached dataset, they can automate login attempts on various websites, hoping to find users who have reused their credentials.

Correct option:
TRUE

Explanation:
The iOS keychain is a secure storage solution designed to store sensitive information, such as passwords, cryptographic keys, and tokens. In the context of an SSO solution, storing the SSO token in the keychain is a secure way to persist the token across multiple iOS apps. By using a common Apple certificate and App Groups, the token can be shared securely between apps that are signed by the same certificate, ensuring that only authorized apps can access the token.

This method takes advantage of iOS security features to protect sensitive data and allows secure sharing between trusted apps on the same device.

Correct option:
TRUE

Explanation:
JWT tokens are prone to Cross-Site Scripting (XSS) attacks if they are not handled securely. XSS vulnerabilities occur when an attacker injects malicious scripts into web pages viewed by other users. If a JWT token is stored in a way that is accessible to client-side JavaScript (such as in local storage or a cookie), an attacker could potentially steal the token and use it for malicious purposes.

To mitigate this risk, it's important to:

• Use HttpOnly and Secure flags for cookies storing JWT tokens.
• Avoid storing JWT tokens in local storage.
• Ensure proper validation and sanitization of any user input to prevent XSS attacks.

Correct option:
header, payload, and signature delimited by dots(.)

Explanation:
A JSON Web Token (JWT) consists of three parts:

1. Header: Contains metadata about the token, such as the signing algorithm.
2. Payload: Contains the claims or the data that is being transmitted.
3. Signature: Ensures the integrity of the token and verifies that it was not tampered with.

These three parts are separated by dots (.) in the JWT format, i.e., header.payload.signature.

The other options (footer and signature or footer and header) are incorrect.

Correct option:
B) and C)

Explanation:
Principal authentication involves verifying the identity of an entity (such as a person, device, or group) based on a unique identifier associated with that entity.

• B): Refers to an entity (e.g., a user, device) being authenticated using a unique identifier.
• C): Describes how a person or entity can be authenticated by a system through the use of an identifier (like a user ID).

Option A) is not specific to principal authentication and seems unrelated to the context of this question. Therefore, B) and C) are the correct options.

Correct option:
Authentication

Explanation:
Authentication refers to the process of verifying the validity of a claimed identity. It ensures that the user or system claiming a specific identity is actually who they say they are, often through methods like passwords, biometrics, or tokens.

• Identification is the process of claiming an identity (e.g., providing a username).
• Authorization is the process of determining what actions or resources an authenticated user is allowed to access.