Passwords and authentication
Cyber security Lesson 6 1:56 English narration · English + 中文 subtitles burned in
Chapters
Transcript
Authentication means proving you are who you claim to be, and there are three classic ways.
身份验证的意思是证明你就是你自称的那个人，而经典的方式有三种。
Something you know — a password or a PIN.
你知道的东西——一个密码或 PIN。
Something you have — your phone, or a card.
你拥有的东西——你的手机，或者一张卡。
Something you are — a fingerprint or a face.
你本身的东西——一枚指纹或一张脸。
A password can be stolen and a phone can be taken, so none of the three is perfect alone.
密码会被偷，手机会被拿走， 所以这三种没有哪一种单独用是完美的。
Which is exactly why two-step verification works.
而这恰恰就是两步验证管用的原因。
Watch the attacker: they steal your password and try to log in — but a one-time code goes to YOUR phone, which they do not have, and they are stopped.
看那个攻击者：他偷到了你的密码，去尝试登录—— 但一次性验证码发到了"你的"手机上，那台手机他没有，于是他被挡住了。
Two-factor asks for two DIFFERENT factors, so knowing the password is no longer enough.
双因素要求的是两个"不同类别"的因素， 所以只知道密码已经不够了。
Biometrics have real advantages: nothing to remember, nothing to type, and very hard for someone else to present.
生物特征有实实在在的好处：不用记，不用敲， 而且别人很难拿出来冒充。
But they are not perfect, and one weakness is permanent — you cannot change a fingerprint once it leaks, the way you would change a password.
但它们并不完美，而且有一个弱点是永久的—— 指纹一旦泄露，你没法像换密码那样把它换掉。
Scanners can also be fooled, and can fail on a perfectly real finger.
扫描仪也可能被骗，也可能对一根完全真实的手指判错。
And back to lesson three's arithmetic.
再回到第 3 课的算术。
Length beats everything.
长度胜过一切。
Compare a short password full of symbols with a long passphrase of ordinary words: the second is far harder to brute-force and far easier to remember.
拿一个塞满符号的短密码和一串普通词组成的长口令比一比： 后者暴力破解起来难得多，记起来也容易得多。
A long passphrase wins on both counts, which is why security advice has moved towards them.
长口令在两方面都赢， 这也是为什么安全建议这些年在往这个方向走。
Four things to take with you.
带走四点。
One: the three factors are something you know, have, or are.
第一：三种因素是你知道的、你拥有的、你本身的。
Two: two-factor combines two DIFFERENT factors.
第二：双因素结合的是两个"不同类别"的因素。
Three: length matters more than mixing in symbols.
第三：长度比掺符号更要紧。
Four: a good checker also rejects common passwords.
第四：一个好的检查器还会拒绝常见密码。
Now write the checker in the task below.
现在去下面的题里把那个检查器写出来。