4

I was reading about Passwords and came across methods used for authenticating client to a server. Since sending password in Plain text to the server isn't the best method for authentication of a user, certain methods were described which provide resistance to replay attacks, MITM etc.

Some methods described were:-

1) Random Challenge method, where server providing a random string to client, client encrypting it with its key/password (symmetric) and sending the result back to the server. Server doing the similar process (or the reverse) to determine the authenticity of the user.

2) Relying on SSL/TLS for the encyption

3) Certificate based Authentication

My question is - Which of the above method is in current practice? Like when we try to login to our Google, Facebook or Stackexchange account which authentication method is used?

  • 4
    Like when we try to login to our Google, Facebook or Stackexchange -- plain password-based authentication. Just over TLS. – Crypt32 Nov 6 '19 at 7:52
  • 1
    @Crypt32 meaning password in plaintext (encrypted with TLS) is sent over to the server for authentication? – Vasu Deo.S Nov 6 '19 at 8:25
  • Yes, pretty much. And when authenticating between websites, for example, logging into StackExchange via your Google account, oAuth is used. – Izy- Nov 6 '19 at 8:58
  • @Izy- we are sending our password in Plaintext to the server (enc. via TLS) so does that mean the server also had stored it in plaintext format? – Vasu Deo.S Nov 7 '19 at 15:26
  • 1
    @Izy- So that means that our Passwords are sent in plaintext (enc. via TLS) and upon reaching the server, the server produces it's hash by adding a salt to the PT. And then stores/compares the password. (I've used stores assuming the user is setting up a new account) – Vasu Deo.S Nov 8 '19 at 4:43
0

It really depends on the service.

The most common is password-base authentication (and probably will stay like this for a long time). All this services you mentioned use TLS for encryption to mitigate possible MIM attacks.

What is becoming a common practice nowadays is to offer 2FA. A list of web-sites that already offer it: https://twofactorauth.org/

It is important to understand that it is one more layer of security and do not aim to replace password based authentication.

Additionally, most of services offer OAuth2 nowadays. For example, when you access the Stack Exchange using your Google account. Of course, you must authenticate in your Google account, using password based authentication.

Password authentication is widely used because came first and is more scalable than other methods. Let's say my server offers certificate authentication. If you want to authenticate to it, you must have a certificate that is signed by a Certificate Authority that my server trusts. You must buy and have this certificate installed in your computer too. This is not a simple configuration for most end-users in the internet.

There are some other methods that are used by enterprises, because they usually have all the infrastructure and the web-sites are only accessed inside the corporate network, for example: SAML2.0, Kerberos, JWT, etc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.