It happens to every one of us every day. We are constantly identified, authenticated, and authorized by various systems. And yet, many people confuse the meanings of these words, often using the terms identification or authorization when, in fact, they are talking about authentication.
That’s no big deal as long as it is just an everyday conversation and both sides understand what they are talking about. It is always better to know the meaning of the words you use, though, and sooner or later, you will run into a geek who will drive you crazy with clarifications, whether it’s authorization versus authentication, fewer or less, which or that, and so on.
So, what do the terms identification, authentication, and authorization mean, and how do the processes differ from one another? First, we will consult Wikipedia:
- “Identification is the act of indicating a person or thing’s identity.”
- “Authentication is the act of proving […] the identity of a computer system user” (for example, by comparing the password entered with the password stored in the database).
- “Authorization is the function of specifying access rights/privileges to resources.”
You can see why people who aren’t really familiar with the concepts might mix them up.
Using raccoons to explain identification, authentication, and authorization
Now, for greater simplicity, let’s use an example. Let’s say a user wants to log in to their Google account. Google works well as an example because its login process is neatly broken into several basic steps. Here is what it looks like:
- First, the system asks for a login. The user enters one and the system recognizes it as a real login. This is identification.
- Google then asks for a password. The user provides it, and if the password entered matches the password stored, then the system agrees that the user indeed seems to be real. This is authentication.
- In most cases, Google then asks for a one-time verification code from a text message or authenticator app, too. If the user enters that correctly as well, the system will finally agree that he or she is the real owner of the account. This is two-factor authentication.
- Finally, the system gives the user the right to read messages in their inbox and such. This is authorization.
Authentication without prior identification makes no sense; it would be pointless to start checking before the system knew whose authenticity to verify. One has to introduce oneself first.
Along the same lines, identification without authentication would be silly. Anyone could enter any login that existed in the database — the system would need the password. But someone could sneak a peek at the password or just guess it. Asking for further proof that only the real user can have, such as a one-time verification code, is better.
By contrast, authorization without identification, let alone authentication, is quite possible. For example, you can provide public access to your document in Google Drive, so that it is available to anyone. In that case you might see a notice saying that your document is being viewed by an anonymous raccoon. Even though the raccoon is anonymous, the system did authorize it — that is, grant it the right to view the document.
However, if you had given the read right only to certain users, the raccoon would have had to get identified (by providing its login), then authenticated (by providing the password and a one-time verification code) to gain the right to read the document (authorization).
When it comes to reading the contents of your mailbox, Google will never authorize an anonymous raccoon to read your messages The raccoon would have to introduce itself as you, with your login and password, at which point it would no longer be an anonymous raccoon; Google would identify it as you.
So, now you know in what ways identification is different from authentication and authorization. One more important point: Authentication is perhaps the key process in terms of the security of your account. If you are using a weak password for authentication, a raccoon could hijack your account. Therefore:
- Create strong and unique passwords for all of your accounts.
- If you have trouble remembering your passwords, a password manager has your back. It can help with generating passwords, too.
- Activate two-factor authentication, with one-time verification codes in text messages or an authenticator application, for every service that supports it. Otherwise, some anonymous raccoon that got its paws on your password will be able to read your secret correspondence or do something even nastier.
Inatokea kwa kila mmoja wetu kila siku. Sisi hutambuliwa, kuthibitishwa, na kuidhinishwa daima na mifumo mbalimbali. Hata hivyo, watu wengi huchanganya maana ya maneno haya, mara nyingi wakitumia maneno utambulisho au idhini wakati, kwa kweli, wanazungumza juu ya uthibitisho. Hiyo si jambo kubwa kwa muda mrefu kama ni tu mazungumzo ya kila siku na pande zote mbili kuelewa nini wao ni kuzungumza juu. Ni daima bora kujua maana ya maneno unayotumia, ingawa, na mapema au baadaye, utapata geek ambaye atakufanya wazimu na ufafanuzi, ikiwa ni idhini dhidi ya uthibitisho, chini au chini, ambayo au kwamba, na kadhalika. Kwa hiyo, maneno utambulisho, uthibitisho, na idhini humaanisha nini, na taratibu hizo hutofautianaje? Kwanza, tutaangalia Wikipedia: - <unk>Utambulisho ni kitendo cha kuonyesha utambulisho wa mtu au kitu.<unk> - <unk>Uhakikisho ni kitendo cha kuthibitisha [...] utambulisho wa mtumiaji wa mfumo wa kompyuta<unk> (kwa mfano, kwa kulinganisha nenosiri lililoingizwa na password iliyohifadhiwa katika hifadhidata). - <unk>Uruhusi ni kazi ya kutaja haki za upatikanaji / mapendeleo ya rasilimali.<unk> Unaweza kuona kwa nini watu ambao <unk>si kweli ukoo na dhana inaweza kuchanganya yao. Kutumia raccoons kueleza utambulisho, uthibitisho, na idhini Sasa, kwa urahisi zaidi, hebu kutumia mfano. Hebu tuseme mtumiaji anataka kuingia kwenye akaunti yao ya Google. Google inafanya kazi vizuri kama mfano kwa sababu mchakato wake wa kuingia umegawanywa vizuri katika hatua kadhaa za msingi. Hapa ni nini inaonekana kama: - Kwanza, mfumo anauliza kwa ajili ya kuingia. Mtumiaji anaingia moja na mfumo inatambua kama kuingia halisi. Hii ni utambulisho. - Google kisha anauliza kwa ajili ya nenosiri. Mtumiaji hutoa, na kama password iliyoingizwa inalingana na password iliyohifadhiwa, basi mfumo unakubali kwamba mtumiaji anaonekana kuwa halisi. Hii ni uthibitisho. Google pia inahitaji nambari ya uthibitisho wa mara moja kutoka kwa ujumbe wa maandishi au programu ya uthibitishaji. Ikiwa mtumiaji anaingia kwa usahihi, mfumo utakubali kwamba yeye ndiye mmiliki halisi wa akaunti. Hii ni uthibitisho wa mambo mawili. - Hatimaye, mfumo inatoa mtumiaji haki ya kusoma ujumbe katika sanduku lao la barua na kama. Hii ni idhini. Uthibitisho bila utambulisho wa awali haina maana; itakuwa bila maana kuanza kuangalia kabla ya mfumo alijua ambaye uhalisi kuthibitisha. Ni lazima mtu ajitambulishe kwanza. Kwa njia ileile, utambulisho bila uthibitisho ungekuwa upumbavu. Mtu yeyote angeweza kuingia kuingia yoyote ambayo ilikuwepo katika hifadhidata <unk> mfumo ungehitaji nenosiri. Lakini mtu anaweza kugundua nenosiri hilo au kulidhani tu. Kuuliza kwa uthibitisho zaidi kwamba tu mtumiaji halisi inaweza kuwa, kama vile mara moja uthibitisho code, ni bora. Kwa kulinganisha, idhini bila utambulisho, acheni uthibitisho, inawezekana kabisa. Kwa mfano, unaweza kutoa upatikanaji wa umma kwa hati yako katika Google Drive, ili iwe inapatikana kwa mtu yeyote. Katika kesi hiyo unaweza kuona taarifa kusema kwamba hati yako ni kuwa kuonekana na raccoon bila jina. Hata ingawa raccoon ni bila jina, mfumo alifanya ruhusa yake <unk> kwamba ni, kutoa haki ya kuona hati. Hata hivyo, kama wewe alikuwa na kutoa haki ya kusoma tu kwa watumiaji fulani, raccoon ingekuwa na kupata kutambuliwa (kwa kutoa login yake), kisha kuthibitishwa (kwa kutoa nenosiri na mara moja kuthibitisha code) kupata haki ya kusoma hati (idhinisho). "Kama inakuja kusoma yaliyomo kwenye sanduku lako la barua, Google haitakubali kamwe raccoon isiyojulikana kusoma ujumbe wako, raccoon hiyo itahitaji kujianzisha kama wewe, na jina lako la kuingia na nenosiri, wakati huo haitakua raccoon isiyojulikana; Google ingeiitambulisha kama wewe. """ Hivyo, sasa unajua katika njia gani utambulisho ni tofauti na uthibitisho na idhini. Jambo moja muhimu zaidi: Uthibitisho labda ni mchakato muhimu katika suala la usalama wa akaunti yako. Ikiwa unatumia nenosiri dhaifu kwa ajili ya uthibitisho, mnyama-mwitu anaweza kuiba akaunti yako. Kwa hiyo: - Kuunda nguvu na ya kipekee nywila kwa ajili ya akaunti yako yote. - Kama una tatizo la kukumbuka nywila zako, meneja wa nywila ana nyuma yako. Inaweza kusaidia katika kuzalisha nywila, pia. - Kuamsha uthibitisho wa sababu mbili, na nambari za uthibitisho wa wakati mmoja katika ujumbe wa maandishi au programu ya uthibitishaji, kwa kila huduma inayounga mkono. Vinginevyo, raccoon fulani asiyejulikana ambaye amepata vidole vyake kwenye nenosiri lako ataweza kusoma mawasiliano yako ya siri au kufanya kitu kibaya zaidi.