Admin at 18:02, 17 September 2009

2009-09-17T18:02:53Z

Admin at 02:44, 18 April 2009

2009-04-18T02:44:56Z

Admin: Created page with ''''Authentication''' is a method by which a human (or another computer) identifies itself with another computer. ==User Name and Password Authentication== Most computer based au...'

2009-04-18T02:38:53Z

Created page with ''''Authentication''' is a method by which a human (or another computer) identifies itself with another computer. ==User Name and Password Authentication== Most computer based au...'

New page

'''Authentication''' is a method by which a human (or another computer) identifies itself with another computer.

==User Name and Password Authentication==
Most computer based authentication is via a '''User Name''' and '''Password'''.

The drawbacks of using '''User Name'''s at all is the fact that most '''users''' must have a unique '''user name''' on a web site so a computer system can distinguish them between other users.

With the growth of the internet, the '''User Name''' (and the issues with being unique) has often been replaced with using an '''[[Email Address]]''' in lieu of a '''User Name''' due to the fact that [[Email Address|email addresses]] are ''always'' unique for an individual.

'''User Name''' and '''Password''' authentication are the most primitive, but most easily implemented form of authentication.

==Email Address Authentication==
Many web sites use a backup form of authentication which is a person's [[Email Address|email address]].

That is, the assumption is:
'''If someone is authenticated to read email sent to a particular email address, then they must be the owner of that email address.'''

Note that due to the nature of how internet email works, the '''receipt''' of an email at a particular email address can only be considered authentication, and that '''sending''' email '''from''' an email address '''is not considered authentication.''' This is due to the fact that anyone can send an email and make it appear to ''come from'' any other email address.

Recent developments in email technologies have made the receipt of an email more dependable. Two technologies, [[Sender Policy Framework]] and [[Domain Keys]] have made [[Spoof|spoofing]] an email address more difficult, however, their use is not 100% adopted.

[[Email Address]] authentication works as follows:
# A web site sends an email to an [[Email Address]] with a special, random token that would be very difficult to guess, typically embedded in a link back to the web site.
# When the user receives the email, they click on the link, returning them to the web site, and sending the random token back to the web site.
# If the token matches the email address on file, the web site can safely assume that the person clicking the link is also authorized to access the email address inbox.

For example:
<pre>
To: Jane Doh <user@example.com>
From: ConversionRuler Support <support@example.com>
Subject: Email Verification for user@example.com

You recently changed your email address at:

http://conversion.marketruler.com/user/validate.php?Hash=e1f1841144caf47073d99af7df2a3018

This email serves to validate your email address.

To verify your email, please click on the following link:

http://conversion.marketruler.com/user/validate.php?Hash=e1f1841144caf47073d99af7df2a3018

Your user name: jane_doh

If you have any questions, please contact us:

http://support.conversionruler.com/

Monday through Friday, 9:00AM through 5:00PM EST

--
ConversionRuler.com
A product of MarketRuler
P.O. Box 1537
Media, PA 19063 USA
</pre>

In the above example, the web site stores the '''random token''': e1f1841144caf47073d99af7df2a3018

If the recipient of the email can prove they received this token (which is hard to guess), then it proves that they have access to the email address the token was sent to.

← Older revision		Revision as of 18:02, 17 September 2009
Line 59:		Line 59:

	If the recipient of the email can prove they received this token (which is hard to guess), then it proves that they have access to the email address the token was sent to.		If the recipient of the email can prove they received this token (which is hard to guess), then it proves that they have access to the email address the token was sent to.
		+
		+
		+	[[Category:Glossary]]
		+	[[Category:Technical]]

@@ Line 11: / Line 11: @@
 ==Email Address Authentication==
-Many web sites use a backup form of authentication which is a person's [[Email Address|email address]].
+Many web sites use a backup form of authentication which is a person's [[Email Address|email address]]. This is most commonly used by sites to reset [[Forgotten Passwords]].
 That is, the assumption is:

Authentication - Revision history

Admin at 18:02, 17 September 2009

Admin at 02:44, 18 April 2009

Admin: Created page with ''''Authentication''' is a method by which a human (or another computer) identifies itself with another computer. ==User Name and Password Authentication== Most computer based au...'