Password Authentication

Passwords are the most widespread form of authentication. Most users of computers are familiar with passwords, as most operating systems either require or provide the option of prompting the user for a username and password before allowing access.

Password authentication in general works by a server prompting the user for the password, and upon entering the correct password the user is granted access. For this method to be reasonably secure for authenticating remote users, there are a number of important security considerations:

The passwords must not be sent across the network in plaintext form, as any malicious user capable of monitoring the network traffic will then be able to pose as the owner of the password.
The chosen password must have a sufficient amount of entropy, meaning that it is sufficiently random to be very hard to guess. If the password does not have sufficient entropy, dictionary attacks are likely to be effective.
The user's password must not be revealed to anyone else than the intended user. Also, the password must not be stored in an unsecured location on the client or server machine, since a malicious user who is able to compromise the client machine would also gain access to the server. If the client program maintains a file of usernames and passwords for a number of servers, these should be secured, since the confidentiality of the password would otherwise depend on the security of the machine itself.