Introduction

As technology advances, software applications have progressively become more complex and able to hold larger and larger amounts of data. From initially being used solely for solving mathematical problems, computers are now used in a variety of tasks from creating artificial intelligence to calling a taxi cab. This white paper will cover how developers tackle authentication in their applications from bank transactions to holding sensitive medical data.

When a person tries to access their personal information, such as their social network, email, or bank accounts, it is common to first be required to input two pieces of information: the first would be a string that represents them, such as a username,
an identification number or their email address, and the second is a secret string, known as a password. The process above is known as authentication and it allows the applications to verify that the user trying to access the information is allowed to see it.

However, authentication with a password is not as secure as one would expect. In
the same way that technologies have evolved through time, so have the methods used for illegally accessing other people’s information. There is phishing, where a malicious person applies social engineering to obtain hints of people’s authentication information by speaking with them. Additionally, people often assign easy to remember strings such as their own names or their birthdays, making their account easier for those with malicious intent to access. Although there are ways to alleviate this, the more restrictions placed on the construction of passwords, the harder it is
for the user. Malicious people take advantage of this and use replay attacks, which automatically input thousands of string combinations until the user’s password is found. The above is even more complicated for Personal Identification Numbers (PIN), a variation of passwords that are used with ATM’s and mobile phones. They are usually limited to a small number of digits composed solely of numbers.

There are multiple alternatives to the common username and password authentication methods such as the tokens usually used for performing online bank transactions or user biometrics (face recognition or fingerprints). However, all existing authentication methods are lacking in some aspects, such as some are not user- friendly, others are not adequately secure, and others are too expensive to implement or maintain over time. On the other hand, not all applications need as much security as others, or to be as useable as others; this depends on multiple features such as the information the application will hold (if it is sensitive or not), the users for which it is aimed, and the target context.

When developers work on new software applications that require the use of an authentication method, they have to consider the distinct features and restrictions of these applications to correctly select the best authentication method for them. However, this is more challenging for bigger applications where multiple criteria must be considered. Additionally, developers sometimes decide to simply implement the authentication methods that they have heard of most or are most familiar with, even if they are not the best option for the current application, due to their lack of knowledge on other authentication methods. It is important for developers to be knowledgeable on all methods in order to properly select the best authentication method for their applications.