Skip to content
Start free
Get App

Lecture 16 Chapter 03 section 3.1 Digital Authentication Principles

Lecture 3.1 from Eyad Elfarra's Computer Security course introduces digital identity and user authentication principles, covering verification, authorization, multi-factor authentication, and password

Key Takeaways

  • Authentication verifies identity; authorization then determines permissions.
  • A username and password alone is insufficient; multi-factor authentication is recommended.
  • Strong password policies and cryptographic storage protect against brute-force attacks and database breaches.
  • Replay attacks can be mitigated with per-request tokens and similar anti-replay techniques.

What the video covers

  • The lecture is Chapter 3 (Section 3.1) of a Computer Security course, focusing on user authentication: verifying that a person is who they claim to be and that the data they provide is correct.
  • Chapter outline previews passwords, tokens, biometrics, remote authentication protocols, attacks, regional application systems in the Emirates, and IAM security.
  • Digital identity is defined as a unique digital representation of a subject (person, process, or system) used in online transactions, such as a university ID or bank account.
  • Authentication establishes that the subject is genuine and controls the authenticator, after which the system trusts the identity and proceeds to authorization, which determines permitted actions.
  • Identity management begins with identification, followed by authentication before system access, and recommends multi-factor authentication instead of relying on a username and password alone.
  • Identifier reuse should be prevented so that inactive or suspended user IDs cannot be assigned to new accounts.
  • Password complexity rules (minimum length, mixed case, special characters) defend against brute-force and dictionary attacks, since common passwords and short strings are easily guessed.
  • Passwords should be protected cryptographically, stored or transmitted encrypted or hashed so that a breach does not expose original passwords.
  • Replay-resistant authentication uses mechanisms such as changing CSRF-style tokens per request so that re-sent authentication data is detected and rejected.
  • Authentication factors are categorized as something you know, have, or are, with biometrics (fingerprints, iris, facial, voice) and tokens or authenticator apps adding layers of security.

Chapters

  1. 00:00Introduction to User Authentication and Chapter Outline
  2. 02:27Digital Identity and Authentication Concepts
  3. 04:27Authentication vs. Authorization and Identifier Management
  4. 06:34Password Complexity and Brute-Force Attacks
  5. 08:34Cryptographic Protection and Replay Resistance
  6. 11:23Registration Process and Identity Proofing
  7. 19:03Authentication Factors: Something You Know, Have, and Are
  8. 28:48Multi-Factor Authentication and Authenticator Apps

Answers

Questions about this video

What is the difference between authentication and authorization in this lecture?

Authentication verifies that a user is genuine and controls their credentials. Once verified, the system trusts the identity and then performs authorization, which determines what permissions the user is allowed.

Why does the lecture recommend enforcing password complexity?

Complex passwords with mixed case, numbers, and special characters protect against brute-force and dictionary attacks, which can easily crack common or short passwords like 123456, birthdays, or mobile numbers.

How can a system defend against replay attacks?

The lecture suggests using a changing token, such as a CSRF-style token that is different with every request. If two requests carry the same token, the system can recognize that someone is replaying previously sent authentication data.

Full Transcript — Download SRT & Markdown

00:01
Speaker A
In the name of God, the Most Gracious, the Most Merciful. Welcome to the third chapter of Computer Security. In this chapter, we will discuss User Authentication. How I intend to define it. Because the person entering is the required person. And that the data they
00:19
Speaker A
entered is correct data. How do I prove this? We will discuss some concepts. We will talk about. Passwords. We will talk about tokens. Biometrics, which are the biological characteristics of a human. Like fingerprints, like facial recognition, like eye scans. We will
00:36
Speaker A
talk about remote protocols. We will talk about attacks. We will discuss two practical examples as case studies.
00:43
Speaker A
Alright, what will we discuss in this chapter? In section 3.1, we will discuss digital authentication. Section 3. 2, we will discuss password authentication; 3.3, token authentication. 3.4. Biometrics; 3.5, remote authentication. 3.6, we will discuss security attacks; 3.7, application systems in the Emirates;
01:11
Speaker A
3.8, we will discuss IAM security; this is IAM. Alright, let's start with section 3. What are the most important basic concepts that appear in digital user authentication? First, we have digital. We have a user, and we have.
01:30
Speaker A
Authentication; authentication is a verification system. It is whether you are you or not. User authentication is a system to verify if this user is genuine or not. Digital with what? In the digital world, or in the world of
01:42
Speaker A
books. Okay, 3.1. It is. How. Did it say. Is it the National Institute? Okay , it gave us the authentication model.
02:06
Speaker A
How confident are we that it is correct ? Right. Let's talk about digital identity. What does digital identity mean? Identity means "hewiya". Digital means digital identity. Since it is an identity, this means it will be unique.
02:27
Speaker A
It is a unique digital representation. Right, of an object. For any subject. The subject here refers to any entity I am trying to communicate with. As a person, as a process, or as a system.
02:40
Speaker A
Right. In online transactions. It is linked to any online transaction. Any online operation. For example, your university ID or your bank account.
02:53
Speaker A
Right. Let's talk about the second thing, which is digital user authentication. Right. I have a user I want to authenticate; I want to perform . Verification saying "I am". So, what does it say first? The data I gave you
03:13
Speaker A
to verify that I am A, B, or Ahmed, Eyad, Ali, or Khaled. Right. With a password, for example, or with a fingerprint, or with anything, it effectively speaks to a valid identity.
03:25
Speaker A
Present in our system. What else? Establish that the subject controls the authenticator. Meaning, the person who gave me this authentication data actually owns it. They did not steal it ; right. The third thing it says is the verified identity for authorization
03:44
Speaker A
decisions; right. If I have verified that the data is correct, and that the person with me who provided this data is actually the owner of this data, then what will I do? I will start to define what permissions I have; nice,
03:59
Speaker A
right. So we have from authentication to access. What will we do? First, we will do authentication. You will give the counter your watches, You will give me your watches. Make sure that you actually own them. Once I know that you
04:19
Speaker A
own them, it means...The system now starts to trust who you are. Who you are, the system now trusts who you are.
04:27
Speaker A
That you are indeed the required person . What will I do? I will perform authorization. What are the permissions you are allowed to do. Okay, identification, How do I verify and authenticate and requirements? It just tells me that to manage a subject,
04:51
Speaker A
whether users or. Right. The first thing I need to define. The same thing. The same thing. Right. So, identify what the subject is. Right. Then I authenticate, I need to verify them before they access our system. What else do we have here? It tells me to
05:18
Speaker A
use multi-factor authentication. Should I just use a username and password? Or should I use, for example, an OTP with them? Use a fingerprint with them.
05:25
Speaker A
Finger. Use facial recognition with them. Use a smart card with them, for example. Right. It tells me that a username and password alone is no longer enough. I need multi-factor authentication. I need to have more than one gate. Every gate has its own
05:38
Speaker A
permissions. It tells me to prevent identifier reuse. It makes no sense for an ID number, that two people have it on my system. If two people enter my system with your ID number, I have a problem with what, preventing
05:50
Speaker A
identifier reuse. Reusing the identifier. Even if the identifier was inactive, or has been completely suspended from the system. Try registering on Facebook, for example.
06:02
Speaker A
And pick your user ID. Try to deactivate the account. And create a new account. It won't let you have your old account's user ID. Done, even if you register the same one. Is that clear? The third thing is enforcing
06:18
Speaker A
password complexity. These days when you register on any site, you come to enter your password. Do you find that it accepts any password? It tells you no. It must be something, an eight-character password. Eight, eight characters, characters. Right. It says
06:34
Speaker A
it must contain a capital letter, small letters, and special characters. Right. And consequently, what did it do? It increased and forced you to write a complex password. Why? To protect you from what I call brute-force or dictionary attacks. What is a
06:48
Speaker A
brute-force? What is a dictionary attack? A dictionary attack is simply, I have a million passwords, 2 million passwords, 3 million passwords. Every expected password in the world. I come and try them with your account. If you are not, if you haven't enforced
07:04
Speaker A
password complexity, I will actually know your password. For example, some people write the password 123456, right ? Some people write the password as their email. Some people write the password as their mobile number. Some people write the password as their ID
07:16
Speaker A
number. Some people write the password as their date of birth. Some people write the password as, for example, their favorite team. Nice. So, I want to force you to write a complex password. Clear? If you don't write a
07:27
Speaker A
complex password, and you wrote one of the usual, known passwords, I could definitely discover your password.
07:33
Speaker A
Another thing. There is what is called a brute-force attack. If your password, for example, is two characters. What are the possible probabilities we have?
07:42
Speaker A
Each character, let's say we have 200 to 300 possibilities per character. Two characters, 300 times 300, you are talking about 90,000 possibilities.
07:52
Speaker A
Great. With any computer of standard specifications. I am able to perform 90,000 possibilities for you in two or three minutes. And I will know your password. So, the more you increase the number of characters in your passwords.
08:05
Speaker A
The more complex it becomes. The more you prevent these two issues. Then it tells me to protect passwords cryptographically. What does that mean?
08:13
Speaker A
It tells me that the password you are storing in the database. Or sometimes when you want to send it over the network. Do not send it to me as plain.
08:21
Speaker A
Text, no. Do this for me. Encrypt it and send it. Or store it for me in the database in an encrypted form. Why? So that if your device is breached, or the server database is breached, they cannot retrieve the original password.
08:37
Speaker A
Especially if you have used one of the hashing techniques. Okay? Another thing , what does it tell me? Is replay.
08:44
Speaker A
Resistance authentication, what does replay resistance mean? I sent the username and password. If someone came and performed a replay, meaning they re-sent the same data. I want to create resistance. To the subject, okay. So that they cannot send an authentication
09:00
Speaker A
request two or three consecutive times in a row. Is it clear how I protect against this? Quite simply, I. Could give you a token every time or. It is what we call a CSRF token, okay. You put it in your site. With every request
09:17
Speaker A
, it is changed. So if I got two requests with the same CSRF token, what does that mean? It means someone is trying to replay my data. And in this case, I block them. The next thing it says is disable inactive identifiers.
09:34
Speaker A
If I have a user in the system who has become inactive. An employee resigned.
09:38
Speaker A
An employee left my organization. An employee retired, okay. An employee was transferred from one place to another.
09:44
Speaker A
And their devices are no longer authorized to access the system. We must disable this. So that I prevent any unwanted action from happening on our system. What does it say about preventing password reuse? Most.
09:59
Speaker A
Applications we have nowadays, you find that after a month or three months approximately, it asks you to change your password. And when you change your password, you find that it has stored the old password in its database. So if
10:11
Speaker A
you try to enter the same old password, or one of the old passwords you were using, it prevents you from reusing it.
10:20
Speaker A
Why? To give you more protection, more security while the site is running. What does it say about obscuring authentication feedback? If I give you feedback from the site, I should not return the password in plain form. No, I should return it, for example, in a
10:36
Speaker A
way like what is shown here, which is an asterisk. So that if it's sent back to you, if there were a man-in-the-middle, they wouldn't know what data you originally sent me.
10:46
Speaker A
Exactly. The Authentication Model. What is authentication? Okay, and after that , we have authorization. That's good.
10:58
Speaker A
Now, what does the authentication model consist of? It consists of two parts. The first part talks about the registration phase, and the second talks about the authentication phase.
11:07
Speaker A
Let's talk about the registration phase , which is the sign-up process. First, I want to submit a request to register on your site, okay. So first. The first thing I want to do. Is search for my ID . Right. I'll come and say, for example
11:21
Speaker A
, my name is Ahmed, or my name is Iyad. He'll say Iyad is taken. What about Iyad 123? He says it's taken. So, what am I required to do in this case? I keep trying, or he gives me or suggests
11:33
Speaker A
other identities that aren't used. Great. I've chosen the identity. Then I tell the Registration Authority what to do. It establishes the applicant identity. Now you've reserved the password. Or you've reserved the new identity. This new username is yours.
11:52
Speaker A
What will it do? It will create the request for you. And what will it do?
11:56
Speaker A
It starts reserving it for you. Meaning this identity has been requested by a person. Okay. After this, what does it tell me? The service provider subscribes the account to the user credentials. Okay. Your account has been created. Then. Depending on the
12:13
Speaker A
password you set, or depending on the system. If you're using multi-factor authentication, it registered your account and reserved it for you. Okay.
12:22
Speaker A
Let's move to the second phase, which is the authentication phase. Where you say I want to enter the site with my username and password. For example, Iyad, and the password is, say, 1 to 6.
12:34
Speaker A
Okay. That's a wrong password, 1 to 6. But let's assume that's it. He needs to verify that the person entering the site is indeed Iyad, and his password is 1 to 6. Okay. Now. The next step, what does it say after you entered the
12:53
Speaker A
username? And sent the password to the site. What does the site do? It validates the token. Okay. You actually possess the username and password you sent me, or the credential data you sent. Okay. After verifying that it's you, what does it do? It talks about
13:13
Speaker A
the Relying Party. It checks what permissions this identity has and grants them to you. Okay. Now, if we talk about NIST SP 800-63. The first thing is proving that you are the person. Who owns the identity, which is
13:39
Speaker A
this password. What does the Registration Authority on a site do to perform proofing? It asks you for, say, a copy of your ID. Okay. Some sites ask you to take a selfie, or perform liveness detection to prove you're an
13:53
Speaker A
actual person, not a bot or a robot on our system. Okay, I have verified that the one who claims to be Ahmed is indeed Ahmed, the one who claims to be Ali is Ali, and the one who claims to
14:12
Speaker A
be Saja is Saja. That’s a step. That is the...CSP. What is the CSP? Credential Service Provider. It confirms that the subscribers are indeed these correct people. Alright.
14:31
Speaker A
So, what will the Credential Service Provider do in this case? It will confirm and perform an authentication protocol with the verifier. So, what did I do? First, registration. I gave it my data. After I gave it my data, it
14:46
Speaker A
confirmed that I am indeed the required person. Where does it send it then? To the Registration/Credential Service Provider. The Credential Service Provider went and verified that I am indeed the person required. After verifying that I am the required person
15:02
Speaker A
, we move to the next stage. To perform validation. After validation, confirm that I am the required person. What will the verifier do once it sees the required person? It will begin the process of...Assertion. What is assertion? The verifier tells you who
15:23
Speaker A
you are and what permissions you have. And it wants to grant the relying party , whether it opens a session for you or lets you in. What will I do? I will send my data, okay. I will send my data
15:47
Speaker A
to the Registration Authority; I am here. I am here, this is who I am; I am the subscriber and claimant, okay. I am a subscriber, a new person; what will I do? I will send my data to the
15:59
Speaker A
Registration Authority. The Registration Authority registered me and said everything is fine, and these are your details. And it gave me a token after the registration process, nice. After all this, what will I do? I want to log in. I will send my data to
16:15
Speaker A
the Credential Service Provider. After I sent my data to it, what did it do?
16:21
Speaker A
It sent my data to the verifier. The verifier confirmed that I am the required person and my data is correct and valid. Great, so it validated my data. It validates my data, and then what? It does the assertion. What does
16:37
Speaker A
it do? It defines what permissions I have. Alright, for the assertion, first , I register. After I register, I log in. After I log in or attempt to log in , it goes and confirms I am the required person. After confirming the
16:56
Speaker A
required person, it goes to the relying party. It tells them to accept the assertion and add me. What does it do then? It opens an authenticated session for me so that I can access the system we have. The left box tells you about
17:11
Speaker A
the registration. This right box tells us about the registration. The left box tells us about the authentication.
17:21
Speaker A
Alright. To register, I send my data to the Registration Authority, which proves it is me and everything is fine.
17:28
Speaker A
Then I send it to the Credential Service Provider. It registers my data and saves it. It gives me a token, alright. So I say I want to log in; what will I do? I will send data to the
17:39
Speaker A
verifier. The verifier will confirm that I am the required person. It will go and inform the relying party that the person is verified. Open a session for him, so it opens the session for me , alright. Now, four means for
17:50
Speaker A
authentication; we have four methods for authentication. The first thing we have is "something you know," something you are familiar with, like a password or a PIN. Exactly, something you know.
18:01
Speaker A
So, what is the problem with it? The problem, they say, is that this thing can be guessed or compromised. Meaning a PIN is four or six digits, consisting of numbers and letters. Anyone with simple computation could guess it,
18:16
Speaker A
right? Users often have weak passwords or crack their device's PIN, right? And so, what happens to the Personal Identification Number? Consequently, what happens? You lose the data, and you have to go through a phase or process to help recover it. So, what is
18:36
Speaker A
the alternative? The method, they say, is "something.""Something you possess," something you own. Like what, something you possess? Like a key card, a smart card, a physical card, or a physical key. Right. Meaning the smart card is similar to an ATM card, a smart card. A
18:51
Speaker A
smart card, exactly. Or a physical key; what does "physical" mean? Actually, it's a real key you carry with you. So what is it? "Something you possess" is what we call: A token. Right. What about it? It can be forged, or stolen,
19:07
Speaker A
or the user might simply lose it. Alright, another thing: "Something you are." What does "something you are" mean? Static biometrics, things that are fixed about you, like your fingerprint, your iris scan, or your facial recognition. The problem is,
19:25
Speaker A
they say, that even the modern systems we have, when they try to identify you ...They say, for example, "This is 70% likely to be Ahmed." Right. So I give it a specific threshold. It tells me, once you reach it, "Yes, this is Ahmed.
19:38
Speaker A
" So if, for example, two people come ...Twins, we get something I call a false positive or a false negative.
19:44
Speaker A
What does a false positive mean? It will say both of these are Ahmed. Even though this is not Ahmed. It's clear here: a false positive or a false negative. If, for example, Ahmed was wearing a mask. Then what will it do?
19:56
Speaker A
It will say that this is not Ahmed. Even though this is Ahmed. Nice. We have false positives and false negatives. Right. Another thing, they say: cost and user acceptance. The cost of building a system based on static biometrics. Which are the biological
20:11
Speaker A
markers. Of a human, it is expensive. And the second thing, they say, is user acceptance. Not every user, for example , has the willingness or acceptance to give a fingerprint or have their face scanned. Nice. One last thing, they say
20:27
Speaker A
"something you do." Something you— biometrics, things that aren't fixed, like your voice, your typing style, right, or your handwriting. So this is what we call dynamic biometrics. The weakness is the same idea as...And some users have reservations about it. So,
20:54
Speaker A
the forms can be combined; I can use a password alone, a username and password . I can use a username and password with, for example, a smart card. Or a username and password with a fingerprint. Or a username and password
21:09
Speaker A
with your voice. Right, a voice print. Nice, I can use them alone or with...
21:13
Speaker A
Each other. Each method adds for us, which is who? Which are high costs or high complexities. Or additional complexities, whether in terms of management or security for whom.
21:28
Speaker A
Alright, let's come to a term called Multi-Factor Authentication. Multi-Factor Authentication tells me I don't settle for one method to determine if this is Ahmed, Ali, or Khaled. It tells me what? It says. To know it's you, Ahmed, I will first take
21:49
Speaker A
a username and password from you. Then I will ask you, for example, for a token I send to you, or send to your mobile number. Nice. Use a password and a phone token. Or a password with a fingerprint. Or a password, for
22:04
Speaker A
instance, with a typing pattern. Nice. Okay. An example is a password with what? With an OTP, so if someone stole your password, it won't be enough alone to enter your system. They must steal the password and they must steal, for
22:19
Speaker A
example, your phone, nice. Consequently , what? They won't be able to get in with just your credentials. Where does this happen for us? In wallets, for example. Currently, every wallet has a username and password. In addition, it always sends a token or sends an
22:36
Speaker A
activation code to your mobile number. So what are the theft operations currently happening? They try to use social engineering, phishing, or fraud.
22:44
Speaker A
To convince you to give them the activation code, okay. Another thing it says: multiple factors resist compromise far better than one. It says whenever you increase security layers, it becomes better for me. Meaning, a username and password is much better
23:08
Speaker A
than a username alone. Okay, if a username and password with a fingerprint, it's better. What if a username and password with a fingerprint, for example, and an OTP sent to your phone, nice. Here, it is also even better, okay. The more we
23:22
Speaker A
increase security layers, the better it is for us, it says. Look here, what happens with us in Multi-Factor Authentication. Here is the authentication, I as a client entered the first factor. I have, for example, the username and password. It told me
23:35
Speaker A
correct. If it says correct, I go to the second stage. I will send you the OTP. If it said wrong, it doesn't reach the OTP stage. It stops, okay. I entered the second stage. What does it tell me? It goes and sends you the OTP.
23:46
Speaker A
It sent you the OTP. If you entered the OTP correctly, you passed through the second gate. And you can enter the system and work. You entered it incorrectly, it means we have a failure . And what did we do? It prevented you
23:58
Speaker A
from accessing. So this is our first factor, okay. And this is who? And this is the second factor. This is considered the second factor. Okay, Multi-Factor Authentication in practice . We have the popular method: the company asks you for a username,
24:17
Speaker A
password, and a physical OTP token. Like who, for example? Like an access card. Just like I see in the movies, a username and password, okay. In addition to what? That they have a card they have the device read. We call this
24:30
Speaker A
a physical OTP token. All right. General public password. Or in general. If I’m not working for a company.
24:38
Speaker A
Just working normally from home. For example, my bank account, or any other account. What does it tell me? Enter the password. After I enter. The password. I perform an SMS or voice code entry, fine. An authenticator app, fine. What is an authenticator app? We
24:53
Speaker A
have Google, for example. Like Google Authenticator. So this is similar in size. I call it an authenticator app or an app. Okay, what do we have? What are the obstacles or challenges hindering us from adopting? Multi-factor authentication; it says most legacy
25:10
Speaker A
systems don't work with it or don't support it, and. To support it, the cost of change will be high for me. The second thing, it says the adoption process depends mainly on the sector I'm working in. And what is the
25:25
Speaker A
security architecture I am. Working with; some security architectures. I can add multi-factor authentication to them without a high cost. And others, no. It will be a very high cost for them. I mean, for example, if I want to
25:39
Speaker A
add multi-factor authentication, a username and password, I add a username and password plus the fingerprint which . That is, the drawing or the password.
25:48
Speaker A
Well, if the system originally takes the users 'identity information. All right. But if it doesn't. I have to bring a scanner, have them scan their fingerprints, input all their data, and add something to my database related to fingerprints to store their data.
26:06
Speaker A
Therefore, we end up with a very high cost. And the third thing in the challenges. Is that government requirements encourage adoption. That governments currently, what are they doing? They have started to require it from you. Asking people. Forcing them
26:21
Speaker A
on the issue of who. Or encouraging them to adopt what. Which is multi-factor authentication. It says we have things you should understand. Or some limitations, which are the constraints for it. It says what. It says multi-factor authentication is not
26:40
Speaker A
immune. What does not immune mean? Not protected. From whom? From phishing. What does phishing mean? Phishing, I create. A login page, like the Facebook page exactly. Username and password, enter them for me. Okay, here is the user. And here is the password. You
26:57
Speaker A
enter them for me. After you enter them here, I am able to take them from you.
27:03
Speaker A
And go log in to my Facebook account for real. Why? Because I created for you a real Facebook page that is similar, or an identical copy, but it's a different link. So I call it phishing or spoofing. The second thing, it says
27:18
Speaker A
not immune to social engineering. What does social engineering mean? Like we talked about in the case of the wallets . I, for example, know that person X, for instance, is lucky, and has a wallet with 1000 shekels, 1500 shekels,
27:28
Speaker A
or others. Okay? I managed to get their username and password a bit. With some simple research in the civil registry, I found out their. ID number. I found what was missing for me. Only one thing is missing from them. To tell me their
27:42
Speaker A
last transaction, or tell me the activation code sent to their phone. So , I call them and say, "Hello, am I speaking with so-and-so?""Alright, we are calling you from such-and-such company.""We've just sent an activation code for your wallet.""Provide it to us
27:58
Speaker A
so we can issue a code, or something else for your wallet." In this case— and many people have fallen for this— they go ahead. They provide them with the activation code. After they provide the activation code, what happens? They
28:08
Speaker A
now have the data they were after. And the second part was the activation code itself, or the token that reached your phone. Effectively, you give it to them . Thank you very much. You have just handed over your wallet. So,
28:19
Speaker A
Multi-Factor Authentication is useless in this situation. It is also not immune to malware. What does malware mean? It means harmful tools or programs installed on your device. It could perform keylogging or......
28:32
Speaker A
anything else to read. All the data you type on the device. Or data sent from the device. And therefore, it is......
28:38
Speaker A
not secure. That concludes this section . Multi-factor practices. The common approach in companies, he says, is the login. Which is a password. Plus a physical OTP token. Like the card they have with them. They have a scanner read it. And thus, they are able to get
28:54
Speaker A
in. Another thing is the general public that we have now. Currently, for instance, on websites, it's password, SMS, or voice. Or an......insecure one.
29:10
Speaker A
We have challenges; some old systems support this at a very alarming rate. He also says we have a point about authentication. It is not immune against phishing. One, the original page, the original page, SSL. Your second one. Token, the previous token.
29:43
Speaker A
Pages from the fake page, social engineering. Phone and requesting from you sites with no count. Without you actually meeting the person. There is malware if I am the one controlling it.
30:00
Speaker A
It has a virus for all the data and sends it to me, okay. Let's talk about something called "Identity." How can I be certain that this is really him and not someone......impersonating him? The first one, do I have any connection to
30:24
Speaker A
the real world? Verify it for me, alright. Consequently, there's no proof you said you are Ahmed, or the person actually typing. I have no proof of identity. The Multi-Factor level two.
30:42
Speaker A
It tells me who the manager is, the intermediate one. It tells me there is something supporting me like that. How, for example? Like, for instance, social ......media, it tells you to take a picture holding your ID. Take a selfie
30:56
Speaker A
of yourself. Send it to them. We now have a type......of link with real-world identities. We have, what do you say? The ID......forget the certificates. Or the live...I have this physical......in real circumstances.
31:21
Speaker A
Like, for instance, you register, come once to the office and register with us . Then come and get what they call access to the electronic system. For the small one, he must come to the university. Register his data. A photo
31:36
Speaker A
of him, a student ID card. Real proof, therefore, the basis......is present and clear. And so on. There are some like the last sign or. The third one, why not? Do a good job. Alright. Well, who should I choose among them all?
32:13
Speaker A
Based on the response being worked on. Of the risk, which is the damage if it were a social risk. Press And it's subject to high risk. High risk, alright. The university system is also at high risk. So it depends on the
32:32
Speaker A
system. It depends on what is the risk or. The risk, supposedly in the case of identity compromise, I discussed the first and second levels, now let's talk about the resources. Alright, so how can I be sure? That the person who is
33:02
Speaker A
logging into my account is actually him ? The person authorized for the account whose data is being entered into the system. It tells me the first level is a single-factor user. Great. If you did the screenshot, okay, for example, the
33:52
Speaker A
smart card. You must scan in order to See Also That I have Another person Actually. You are the real person, the owner of the tion on the tion, you will work on the tation On the tion S P. And
34:54
Speaker A
the data cation That you are actually a person tion Actually, what is this You are doing. Thank you.
Topics:user authenticationdigital identitymulti-factor authenticationpassword securitybiometricsbrute-force attackreplay attackauthorizationIAMcomputer security

Get More with the SozAI App

Transcribe recordings, audio files, and YouTube videos — with AI summaries and speaker detection. 30 minutes free.

App Store Google Play
Or transcribe another YouTube video here →

Free tools: TXT to SRT · SRT Validator · Merge SRT · Subtitle to Text · All tools

More from Eyad Elfarra

View All
Lecture 11 Chapter 02 Cryptographic Tools section 2.2 Message… — Transcript30:35
Lecture 11 Chapter 02 Cryptographic Tools section 2.2 Message… — Transcript
3,911 1 Arabic
Lecture 15 Chapter 02 section 2.6 Encryption of stored data — Transcript16:14
Lecture 15 Chapter 02 section 2.6 Encryption of stored data — Transcript
2,708 1 English
Lecture 14 Chapter 02 section 2.5 Random and Pseudorandom Numbers — Transcript15:44
Lecture 14 Chapter 02 section 2.5 Random and Pseudorandom Numbers — Transcript
2,357 1 English
Lecture 12 Chapter 02 section 2.3 Public Key Encryption — Transcript32:45
Lecture 12 Chapter 02 section 2.3 Public Key Encryption — Transcript
5,249 1 English
Lecture 13 Chapter 02 section 2.4 Digital Signature and key Management — Transcript25:00
Lecture 13 Chapter 02 section 2.4 Digital Signature and key Management — Transcript
4,005 1 English
Lecture 10 Chapter 02: 2.1 Confidentiality with Symmetric Encryption — Transcript32:44
Lecture 10 Chapter 02: 2.1 Confidentiality with Symmetric Encryption — Transcript
4,534 1 English
Lecture 09 Chapter 01 section 1.6 – 1.7 — Transcript9:58
Lecture 09 Chapter 01 section 1.6 – 1.7 — Transcript
1,444 1 English
Lecture 08 Chapter 01 section 1.5 Attack surface and Attack Trees — Transcript20:15
Lecture 08 Chapter 01 section 1.5 Attack surface and Attack Trees — Transcript
3,172 1 English
Lecture 07 Chapter 01 section 1.4 Fundamental Security Design Principles — Transcript26:20
Lecture 07 Chapter 01 section 1.4 Fundamental Security Design Principles — Transcript
3,646 1 English
Lecture 06 Chapter 01 section 1.3 FUNCTIONAL REQUIREMENTS — Transcript27:18
Lecture 06 Chapter 01 section 1.3 FUNCTIONAL REQUIREMENTS — Transcript
4,144 1 English
Lecture 05 Chapter 01 section 1.2 — Transcript35:18
Lecture 05 Chapter 01 section 1.2 — Transcript
4,008 1 Arabic
Lecture 04 Chapter 01 section 1.1 Computer security concepts Part 03 — Transcript11:16
Lecture 04 Chapter 01 section 1.1 Computer security concepts Part 03 — Transcript
1,368 1 Arabic