Cellular Phones

Every cellular phone has an electronic serial number to provide unique identification of the phone. When a call is made, the cellular phone transmits its identification information. This allows the phone system to provide continuous service to the caller as the caller travels from one place to another, and it also allows the call to be billed accordingly. Someone who captured this information could "clone" the cellular phone by copying its ID into another phone. As a result, its calls would then be billed to the original owner. In order to prevent this, digital cellular phones use encryption to protect the phone's identity. (Analog cellular phones, based on older technology, do not use encryption.) Because people often use the pushbuttons on a phone to enter private data such as bank account numbers and credit card numbers, all digits dialed on a digital phone are also encrypted.

Cellular phones use relatively weak encryption. Recently several cellular phone encryption schemes have been cracked by independent cryptography experts, but even this weak encryption is sufficient to deter casual eavesdroppers.

6.2.3 Authentication

• Strong Passwords

• Smart Cards

• Biometrics

• Digital Signatures

• Digital Certificates and Certificate Authorities

• SSL Protocol

Authentication is the process of confirming an identity, determining whether you are who you claim to be. This is usually done by verifying that your login name and password match. However, passwords can often be stolen, accidentally revealed, or forgotten. This section introduces some techniques that would make the authentication process more stringent including stronger passwords, smart cards, and biometrics. In latter parts of this section, you will learn about technologies such as digital signatures, certificates, and the SSL protocol that ensure data originated from the genuine source.

Strong Passwords

As you recall from the previous section, 6.1.2 Identity Theft and Privacy Violation, passwords are like the keys to the accounts you want to protect. A weak password may be easily guessed by an intruder. The first line of defense that you can employ against intruders is a password that would be hard for intruders to crack. Below are some guidelines as to what constitutes good password and what constitutes bad passwords.

Characteristics of a good password:

• Difficult to guess

• At least 8 characters long, the longer the better (if you can remember it)

• Contains a mix of uppercase letters, lowercase letters, numbers, symbols, and punctuation marks

• Characters are arranged in an unpredictable order

• Can be typed in quickly by you to prevent someone from obtaining your password by looking at your key strokes

Characteristics of a bad password:

• Based on personal information such as all or part of your name, nickname, birth date, company name, and relative's name

• Based on surrounding objects, such as "computer", "desk", "book"

• Words from a dictionary

• Names of fictional characters from movies or books

• Words spelled in a particular pattern (e.g. with the last letter omitted, backwards)

• Character sequence that is easy to type, such as "asdf" and "qwer"

• Characters that follow a certain pattern such as "abcabcdabcde" and "1122334455"

• Passwords you have seen or used previously

Generating a good password:

• Use a password generator application

• Use the third letter of each word (more than 2 characters long) from a randomly selected sentence Example:

  • Sentence: "AUTHENTICATION is the process of confirming an identity, determining whether someone is who he claims to be."

  • Password: "Teonetemoa."

• Insert symbols randomly (e.g. "Te*netem$a.")

• Mix of uppercase letters, lowercase letterers, numbers, symbols, and punctuation marks (e.g. "T1e*netEm$a.")