Answers

F6.2 Authentication

Robust programs · GCSE · OCR J277 2.3.1, AQA 8525 3.2.11, Edexcel 1CP2 6.4.4 · about 15 min

What this lesson is about

Usernames and passwords, limiting attempts, and stronger ways to prove who someone is.

• Something you know
• Say less when it fails
• Limiting attempts
• Better than a password
• Authentication and validation together

Questions 5 marks in all

1. [1 mark]What is authentication?

   1. AChecking a user is who they claim to be
   2. BChecking data is sensible
   3. CEncrypting a message
   4. DTesting a program
   Answer: A. Authentication checks identity, often with a username and password.

2. [1 mark]What does this program print?

   operators = {"ada": "robot42", "alan": "turing1"}
   name, password = "ada", "turing1"
   print(name in operators and operators[name] == password)

   Answer:

   False

   turing1 is a real password, but it belongs to alan, not ada.

3. [1 mark]Why should a login say "access denied" rather than "no such user"?

   1. AIt does not tell an attacker which usernames exist
   2. BIt is shorter
   3. CPython requires it
   4. DIt stops typing errors
   Answer: A. Revealing valid usernames lets an attacker focus on guessing their passwords.

4. [1 mark]Why limit the number of login attempts?

   1. ATo stop an attacker guessing passwords over and over
   2. BTo save memory
   3. CTo make the program shorter
   4. DBecause users forget passwords
   Answer: A. Unlimited tries make guessing, by a person or a program, possible.

5. [1 mark]A password and a code sent to your phone is an example of what?

   1. ATwo-factor authentication
   2. BValidation
   3. CBiometrics
   4. DA range check
   Answer: A. Two different kinds of proof: something you know and something you have.

The task: operator login

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

operators = {"ada": "robot42", "alan": "turing1"}

from bugbot import *
connect()
operators = {"ada": "robot42", "alan": "turing1"}
user = None
for attempt in range(3):
    name = input("Username? ")
    password = input("Password? ")
    if name in operators and operators[name] == password:
        user = name
        break
    print("access denied")
if user:
    print("welcome", user)
    led("green")
    forward(50, distance=20)