What is Authentication?

Authentication: Proving You're You

Think about logging into your email account.

When you type in your username and password, you're performing authentication. You're proving to the email service that you are the legitimate owner of that account. If the username and password match what's on file, you're authenticated and granted entry. If they don't, you're denied access. It's simply verifying your identity.

But wait! What's the difference between authentication and authorization? Well, here's a way to simplify it.

Authentication simply means "Who you are" while Authorization simply means "What you can do".

For example, Authentication determines whether someone accessing a website is actually the person who created the account, while Authorization determines what that person is permitted to access once they're identified. Simple, right?

Authentication Mechanisms and Potential Vulnerabilities

Now that we've clarified the basics, let's talk about how authentication systems can be attacked and exploited.

Brute-Force Attack
This is a blunt but often effective method where an attacker performs an automated trial-and-error process, systematically guessing credentials against an authentication system like a login page, SSH, or FTP. The goal is to eventually stumble upon the correct username and password combination.

A common tactic within this attack is Username Enumeration. This occurs when an attacker can validate whether a username is valid or invalid, often by observing different error messages on a login page (e.g., "Username not found" or "Incorrect password"). Once a valid username is identified, the attacker then focuses their brute-force efforts by trying a large wordlist of common or likely passwords against that specific username.

Bypassing Two-Factor Authentication (2FA)
You might think 2FA makes you impenetrable, and it's certainly a strong defense. However, even this crucial security layer isn't always flawless. The implementation of 2FA can sometimes contain weaknesses that allow it to be bypassed entirely.

You know how 2FA typically works, right? You log in with your username and password, and then you're prompted on a separate page to enter a verification code sent to your phone or generated by an app. But what if I told you that some websites don't actually check whether you completed that second verification step?

So you're thinking what I'm thinking? 😏

In some poorly implemented systems, once the initial username and password are submitted, the server might generate a session token before the 2FA code is verified. If an attacker intercepts this token or can manipulate the request to skip the 2FA verification page, they could potentially gain full access to the account without ever entering the second factor. This highlights that even the best security concepts depend heavily on their flawless implementation.