Worksheet

F6.2 Authentication

Robust programs · GCSE · OCR J277 2.3.1, AQA 8525 3.2.11, Edexcel 1CP2 6.4.4 · about 15 min

What this lesson is about

Usernames and passwords, limiting attempts, and stronger ways to prove who someone is.

• Something you know
• Say less when it fails
• Limiting attempts
• Better than a password
• Authentication and validation together

Questions 5 marks in all

1. [1 mark]What is authentication?

   1. AChecking a user is who they claim to be
   2. BChecking data is sensible
   3. CEncrypting a message
   4. DTesting a program

2. [1 mark]What does this program print?

   operators = {"ada": "robot42", "alan": "turing1"}
   name, password = "ada", "turing1"
   print(name in operators and operators[name] == password)

3. [1 mark]Why should a login say "access denied" rather than "no such user"?

   1. AIt does not tell an attacker which usernames exist
   2. BIt is shorter
   3. CPython requires it
   4. DIt stops typing errors

4. [1 mark]Why limit the number of login attempts?

   1. ATo stop an attacker guessing passwords over and over
   2. BTo save memory
   3. CTo make the program shorter
   4. DBecause users forget passwords

5. [1 mark]A password and a code sent to your phone is an example of what?

   1. ATwo-factor authentication
   2. BValidation
   3. CBiometrics
   4. DA range check

The task: operator login

Use operators = {"ada": "robot42", "alan": "turing1"}. Ask Username? and Password? up to three times. For each wrong pair print access denied. When a pair is right, print welcome <name>, turn the LED green and drive 20 cm forward. The task types alan and wrong, then alan and turing1.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

operators = {"ada": "robot42", "alan": "turing1"}

Plan your program here, then type it in and press Run.

Do it on the robot
www.bugbotlab.com/learn/f6-2-authentication/
The simulator checks it and tells you when it passes. Nothing to install, no account.

Challenges

1. After three failures, make the robot flash red and refuse any more attempts.
2. Add a new operator by asking for a username and a password twice, and only saving it if both passwords match. What is that second check called?
3. Add a validation check that passwords are at least 8 characters with at least one digit.