Authentication

In computer security, authentication (Greek: αυθεντικός, from 'authentes'='author') is the process by which a computer, computer program, or another user attempts to confirm that the computer, computer program, or user from whom the second party has received some communication is, or is not, the claimed first party. A blind credential, in contrast, does not establish identity at all, but only a narrow right or status of the user or program.

Related Topics:
Computer security - Greek - Computer - Computer program - Blind credential

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

In a Web of trust "authentication" is a way to ensure users are who they say they are--that the user who attempts to perform functions in a system is in fact the user who is authorized to do so.

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

To distinguish authentication from the closely related term authorization, the short-hand notations A1 (authentication) and A2 (authorization) are occasionally used.

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

The problem of authorization is often thought to be identical to that of authentication; many widely adopted standard security protocols, obligatory regulations, and even statutes are based on this assumption. However, there are many cases in which these two problems are distinct.

Related Topics:
Authorization - Standard - Security protocol

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

One familiar example is access control. A computer system supposed to be used only by those authorized must attempt to detect and exclude the unauthorized. Access to it is therefore usually controlled by insisting on an authentication procedure to establish with some established degree of confidence the identity of the user, thence granting those privileges as may be authorized to that identity. Common examples of access control involving authentication include:

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

• withdrawing cash from an ATM.
• controlling a remote computer over the Internet.
• using an Internet banking system.

However, note that much of the discussion on these topics is misleading because terms are used without precision. Part of this confusion may be due to the 'law enforcement' tone of much of the discussion. No computer, computer program, or computer user can 'confirm the identity' of another party. It is not possible to 'establish' or 'prove' an identity, either. There are tricky issues lurking under what appears to be a straightforward surface.

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

It is only possible to apply one or more tests which, if passed, have been previously declared to be sufficient to proceed. The problem is to determine which tests are sufficient, and many such are inadequate. There have been many instances of such tests having been spoofed successfully; they have by their failure shown themselves, inescapably, to be inadequate. Many people continue to regard the test(s) -- and the decision to regard success in passing them -- as acceptable, and blame their failure on 'sloppiness' or 'incompetence' on the part of someone. The problem is that the test was supposed to work in practice -- not under ideal conditions of no sloppiness or incompetence -- and did not. It is the test which has failed in such cases. Consider the very common case of a confirmation email which must be replied to in order to activate an online account of some kind. Since email can easily be arranged to go to or come from bogus and untraceable addresses, this is just about the least authentication possible. Success in passing this test means little, without regard to sloppiness or incompetence.

Related Topics:
Email - Bogus

~ ~ ~ ~ ~ ~ ~ ~ ~ ~

 
Authentication: Multifactor authentication ►