When we use a password and user name to log in to our own computer, or to log in at the office or to some remote website, the system we are logging into needs to confirm that the password matches the user name, but it is vitally important that this system doesn't store are password for comparison. Instead of storing the password the system should store a salted hash of the password. This is a method that uses a one way encryption process called a hash to encrypt the password and a second unique, long and random value. The results of this hash is then stored along with the unique salt.

Salt should be generated using a Cryptographically Secure Pseudo-Random Number Generator

When a user logs in they submit their username and their password to the system. This looks up the stored hash value for this user, and repeats the hash plus the same salt as used before for this password to calculate a new value. If the new value matches the stored hash we know the password is correct for that username.

If you are involved in developing a secure login system you must use one of the latest secure hashing methods

DO NOT use:

• Fast cryptographic hash functions such as MD5, SHA1, SHA256, SHA512, RipeMD, WHIRLPOOL, SHA3, etc.
• Insecure versions of crypt ($1$, $2$, $2x$, $3$).
• Any algorithm that you designed yourself. Only use technology that is in the public domain and has been well-tested by experienced cryptographers. https://crackstation.net/hashing-security.htm

If you want to see how easy it is to crack insecure password storage have a look at the rest of the crackstation website*: display on video

Adobe in 2013 didn't use a secure hash plus salt process and the passwords could be recovered from the stored values.*:display havibeenpwned site

Spambot in 2017 simply stored passwords. No encryption at all.

Quinstreet 2015 used the MD5 hash method with a salt to store a value that corresponded to each password. Not the password itself, but note that MD5 is no longer considered sufficiently secure.

Authentication is the process of confirming that a user is who they say they are, and is recognised by the system. Often this is simply that the username and password matches the stored username and stored hash for that username. We only search the database for that username. We never allow a search for the password.

Two factor authentication takes the process a stage further. If the username and password match, the telephone number stored for that account is selected,  a random code is generated and an automatic text containing that code is sent to that telephone number. At the same time the random code is stored in that account and the time is also stored. If the user submits this code within a short time interval and it matches the code stored for this account, then the authentication is complete.

Two factor authentication is more secure than just using passwords against random attacks, but where the user is specifically targeted and the attacker can obtain the telephone number the attacker can intercept the authentication codes and take over the account. They don't have to steal the phone in order to do this.

Also you need to consider how you would get access to your account without a telephone signal, or if your phone was stolen.

More secure than using a phone for two factor authentication is a physical hardware security key for your computer that conducts an encrypted exchange with the server in order to log you in.

An article by The Verge on hardware security keys: https://www.theverge.com/2019/2/22/18235173/the-best-hardware-security-keys-yubico-titan-key-u2f

Fido Alliance administers and develops standards for hardware security keys: https://fidoalliance.org/

Biometrics can also be used for authentication. These are the users physical features such as finger prints, facial features, retina scans and voice. Again these have to be recorded and hashed for security in a way that ensures that an imposter's details are not being recorded. Biometric systems work well when the user is first identified with a username. The system then only needs to match the biometrics submitted for authentication against the stored details for one account. Multiple biometrics used in this way can make the system even more secure.

A system that searches a database of biometric data to locate those of an unknown user is not nearly as reliable - or fast.