Josh Alexander, Toopher Discussion of precisely why modern approaches to user authentication fail and how we can add bandwidth to our perspective to prevent attacks without the hindering aspects that ruin user experience.

1. Elderly People’s Ankles

2. Characterizing Artifacts of Legacy Security
Technology and Their Effects on Modern
Applications of Authentication and
Authorization

3. Hi.

4. Nay @toopherjosh

5. Ian Glazer and I have a bet…

6. Who can use the most slides without
affecting quality?

7. I

8. will

9. win.

10. Let’s get to it –

12. Picture of “children”

13. Let’s play a game.

14. Seriously… I’ll wait until you agree…

15. Picture 1.2

16. Picture 1.1

17. Picture 2.1

18. Picture 2.2

19. Picture 2.2

20. Picture 2.2

26. Statistics

27. µ

28. σ

32. The null

33. There is a 68% chance this is boring.

37. A long long time ago…

38. In the year 2000…

41. Don’t judge – you had one too.

43. Where even the water has calories

44. null hypothesis = you are a good person

46. You are a terrorist.

47. null hypothesis = you are a terrorist.

50. You are a terrorist shoe bomber.

51. null hypothesis = you are a shoe bomber.

55. elderly people’s ankles

56. elderly people’s ankles

57. EPA

59. Picture 3.1

60. Picture 3.2

61. You are not you.

62. You are not you.

63. You are not you.

68. null hypothesis = you are not you.

69. you are not you.

70. you are not you.
your user

71. you are not you.
your user
customer

74. 1 act play

75. Act 1
<login>

76. 3 act play

77. Act 1
<login>

78. Act 2
<action>

79. Act 3
<logout>

80. Yes… I totally had to look all that up on wiki

81. ?

83. Act 1
<login>

84. Act 2
<action>

85. <Act 1>

86. Act 1
<login>

87. Act 2
<action>

92. A Happy Ending?

93. Repetition Poisoning

96. We
retain
the
right
to
rename
your
kids

98. Repetition Poisoning

99. Repetition Poisoning Test

100. ILK
BILK
SILK

101. What fiber to SILKworms produce?

102. ILK
BILK
SILK

103. ILK
BILK
SILK

104. What’s another word for DEFRAUD?

105. ILK
BILK
SILK

106. ILK
BILK
SILK

107. What’s a word to describe a person or
thing similar to which you’ve previously
referred?

108. ILK
BILK
SILK

109. ILK
BILK
SILK

110. What do cows drink?

111. Wrong.

112. Cows drink water.

117. </Act 1>

118. <Act 2>

127. ?

128. <Act 2.1>

131. U/P + device recognition < MITB

132. U/P + device recognition < Zeus

134. 1 / 30 days

135. 3-4 times per day

136. MFA @ 1%

137. invisibility ≠ omission

139. </Act 2.1>

140. <Act 2.2>

141. ?

142. UX

143. UX è optimized

144. UX è optimized = no modification to
human behavior

147. Context

161. </Act 2.2>

162. <Act 2.31>

163. Identity is valuable.

164. Identity, Inc.; NYSE: IDNT

165. Yeah you are.

171. </Act 2.31>

172. <Act 2.32>

173. The Internet of Things (IoT)

174. The Internet of Things (IoT)
<groan>

175. Relying Party
Benefit
User Benefit

177. Relying Party
Benefit
User Benefit

178. Context creates invisibility.

179. Invisibility enables security.

180. </Act 2.32>

182. <Act 3>

183. Act 3
<logout>

184. ?

193. Optimize UX

194. Context creates invisibility.

195. Invisibility enables security.

196. </Act 3>

197. Session
Login
Cri5cal
Ac5on
Session
Logout

198. Shift in perspective can identify EPAs

199. Invisibility enables security.

202. Great. So what do I do?

203. Laws of Modern MFA

204. 1. Tell the user what you’re doing.

205. 2. Communicate completely out of band.

206. 3. Get out of their way (invisibility)

207. 1. Tell the user what you’re doing.
2. Communicate completely out of band.
3. Get out of their way (invisibility)
Laws of Modern MFA

208. @toopherjosh
Thanks.