[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 1 · 1.2.c
AP Cybersecurity · Introduction to Security
Making Authentication Stronger
Long, random, unique — then add a factor that still works once the password is known.
key ideaLong, random, unique — then add a second factor. In that order.
Matching controls to threats
Each authentication control answers a specific attack. Length and randomness defeat guessing; uniqueness defeats replay from another breach; multifactor defeats a password that was correctly obtained by any means at all.
| Weakness | How it is exploited | Control | What it breaks |
|---|
| short or patterned password | dictionary attack built from public facts | long, random password | the candidate list stops working |
| meaningful words, names, dates | personalized guessing | avoid personal words entirely | removes the raw material |
| same password on many sites | credential stuffing | unique password per account | one breach stays contained |
| password known to the adversary | any of the above, or phishing | multifactor authentication | the password alone is no longer enough |
| too many passwords to remember | reuse, or writing them down | password manager | makes uniqueness practical |
Read the last column. A control is worth adopting because it breaks a named mechanism — not because it sounds rigorous.
the four properties
- Long beats complex: length is what actually expands the search space.
- Random beats memorable: a template the user follows is a template the adversary generates.
- Unique contains the blast radius of somebody else's breach.
- MFA is the only one of the four that still helps after the password is known.
Layering
Each layer answers a different failure. A long random password does nothing about reuse; uniqueness does nothing once a password is phished. The layers add rather than duplicate.| MFA factor | Category | Strength |
|---|
| one-time code by SMS | something you have | weakest — vulnerable to SIM swapping and to being read aloud |
| authenticator app code | something you have | stronger — bound to the device, no carrier involved |
| hardware security key | something you have | strongest — also verifies the site, so phishing fails |
| fingerprint or face | something you are | strong locally; cannot be changed if compromised |
Every row beats a password alone. The differences matter mainly against phishing: only a security key checks which site is asking.
Something you knowthe password or passphrase
Something you havea phone, app, or security key
Something you area fingerprint or face scan
Worked analysis
EX 1
Repair a weak password
A user's password is Bailey2019! — their dog's name and their wedding year. Recommend a replacement and justify each property.
1
Name the weakness
Every element is publicly discoverable, in the exact template attackers generate.
2
Fix the length
A four-word passphrase or a generated string of 16+ characters.
3
Fix the predictability
No names, dates, or personally meaningful words — that is where dictionaries come from.
4
Fix the reuse
Unique to this account, generated and stored by a password manager.
5
Add the layer that survives failure
Enable MFA, so even a correctly obtained password is insufficient.
EX 2
Is a password manager risky?
A student objects that a password manager is one basket for all the eggs. Evaluate the objection.
1
Grant the point
The vault is a single high-value target — that much is true.
2
Compare with the alternative
Without one, users reuse passwords. Reuse means every site is the single point of failure.
3
Note how the vault is protected
A strong master passphrase plus MFA, with the vault encrypted at rest.
4
Weigh the two risks
One well-defended target beats dozens of weakly defended ones.
5
Give the recommendation
Use the manager, protect it with a long unique passphrase and MFA, and let it generate every other password.
EX 3
MFA that failed
An account had SMS-based MFA enabled and was still taken over. What happened, and what would have stopped it?
1
List how SMS MFA fails
SIM swapping, or the victim reading the code to a caller.
2
Note what MFA does and does not do
It stops a password-only attack; it does not stop a victim handing over the second factor.
3
Identify the stronger option
An authenticator app removes the carrier from the picture entirely.
4
Identify the strongest
A hardware security key verifies the site's identity, so a lookalike page gets nothing.
5
State the conclusion
MFA is a category, not a guarantee. Which factor you choose decides which attacks it actually blocks.
Check yourself
What three properties does the CED require of a password?
Show answer
Long, random, and unique — produced and stored by a password manager, or written as a long unique passphrase.
Why does avoiding names and dates matter more than adding a symbol?
Show answer
Personal words are exactly what a personalized dictionary is built from, and symbols are appended in a predictable position. Removing the raw material shrinks the attacker's list; adding a symbol barely grows it.
What does MFA protect against that a strong password cannot?
Show answer
A password that the adversary already has — phished, breached, or guessed. MFA requires extra proof of identity, so the password alone stops being sufficient.
Rank SMS codes, authenticator apps and hardware keys, and say why.
Show answer
Hardware key strongest — it verifies the site, so phishing fails; authenticator app next — device-bound, no carrier; SMS weakest — exposed to SIM swapping and to being read aloud.