Death to Passwords: How Authentication Will Evolve Beyond Passwords
•
114 recomendaciones•14,605 vistas
User authentication in mobile and web applications is a very common and integral use case. Implementing basic authentication is an easy solution for developers but comes with several pitfalls that impair user experience like (re-)entering passwords, the need to create a new unique password or even just the input of personal data on a flaky keyboard while registering a new account. In this talk the security flaws and UX implications of passwords will be discussed and Tim will highlight which different techniques exist that are able to offer a more mobile friendly flow. Highlighting authorization and authentication techniques like OAuth, OpenID Connect and even hardware features like Bluetooth Low Energy this talk will be interesting for anyone who's facing a situation where creating and storing user accounts matters.
Recomendados
Más contenido relacionado
Destacado
Destacado (9)
Similar a Death to Passwords: How Authentication Will Evolve Beyond Passwords
Similar a Death to Passwords: How Authentication Will Evolve Beyond Passwords (11)
Más de Tim Messerschmidt
Más de Tim Messerschmidt (12)
Último
Último (9)
Death to Passwords: How Authentication Will Evolve Beyond Passwords
- 1. @SeraAndroid#DeathToPW Death to Passwords Tim Messerschmidt Head of Developer Advocacy, International PayPal / Braintree SXSW 2015
- 2. @SeraAndroid#DeathToPW Death to Passwords Tim Messerschmidt Head of Developer Advocacy, International PayPal / Braintree SXSW 2015
- 5. @SeraAndroid#DeathToPW The 1000 most used passwords of 2012 wiki.skullsecurity.org/Passwords
- 9. @SeraAndroid#DeathToPW 9.8% use password, 123456 or 12345678
- 15. @SeraAndroid#DeathToPW 1. 123456 2. password 3. 12345678 4. qwerty 5. abc123 6. 123456789 7. 111111 8. 1234567 9. iloveyou 10. adobe123 11. 123123 12. admin 13. 1234567890 14. letmein 15. photoshop 16. 1234 17. monkey 18. shadow 19. sunshine 20. 12345
- 16. @SeraAndroid#DeathToPW 1. 123456 2. password 3. 12345678 4. qwerty 5. abc123 6. 123456789 7. 111111 8. 1234567 9. iloveyou 10. adobe123 11. 123123 12. admin 13. 1234567890 14. letmein 15. photoshop 16. 1234 17. monkey 18. shadow 19. sunshine 20. 12345
- 18. @SeraAndroid#DeathToPW 1. 123456 2. password 3. 12345 4. 12345678 5. qwerty 6. 1234567890 7. 1234 8. baseball 9. dragon 10. football 11. 1234567 12. monkey 13. letmein 14. abc123 15. 111111 16. mustang 17. access 18. shadow 19. master 20. michael
- 19. @SeraAndroid#DeathToPW 1. 123456 2. password 3. 12345 up 17 4. 12345678 down 1 5. qwerty down 1 6. 1234567890 7. 1234 up 9 8. baseball new 9. dragon new 10. football new 11. 1234567 down 4 12. monkey up 5 13. letmein up 1 14. abc123 down 9 15. 111111 down 8 16. mustang new 17. access new 18. shadow 19. master new 20. michael new
- 23. @SeraAndroid#DeathToPW >The 3 key problems_
- 30. @SeraAndroid#DeathToPW /$d+/ @SeraAndroid#DeathToPW Favor security too much over the experience and you’ll make the website a pain to use. smashingmagazine.com/2012/10/26/password-masking-hurt-signup-form
- 33. @SeraAndroid#DeathToPW People forget passwords… 45% admit to leaving a website instead of re- setting their password or answering security questions - Blue Inc. 2011
- 34. @SeraAndroid#DeathToPW Let’s admit it: Passwords really suck!
- 36. @SeraAndroid#DeathToPW /$d+/ @SeraAndroid#DeathToPW Bad hashing algorithms MD5, SHA-1, SHA-2, SHA-3 bit.ly/1DOfzy7
- 37. @SeraAndroid#DeathToPW /$d+/ @SeraAndroid#DeathToPW Awesome hashing algorithms PBKDF2, BCRYPT, SCRYPT bit.ly/1DOfzy7
- 43. @SeraAndroid#DeathToPW braintreepayments.com/blog/goodbye-passwords-one-touch-hello-bitcoin > Braintree Says Goodbye to Passwords With One Touch Payments for PayPal and Venmo, and Hello to Bitcoin_
- 49. @SeraAndroid#DeathToPW People hate to register Out of 657 surveyed users 66% think that social sign-in is a desirable alternative. - Blue Inc. 2011
- 52. @SeraAndroid#DeathToPW One person's data is another person's noise. - K.C. Cole
- 53. @SeraAndroid#DeathToPW >Social vs. Concrete Identities_
- 55. @SeraAndroid#DeathToPW Request Request Token Grant Request Token Direct User to Service Obtain Authorization Direct to Consumer Request Access Token Grant Access Token Access Resources The Consumer Service Provider
- 58. @SeraAndroid#DeathToPW Direct User to Service Obtain Authorization Request Access Token Grant Access Token Direct to Consumer Access Resources The Consumer Service Provider @SeraAndroid / @Braintree_Dev
- 59. @SeraAndroid#DeathToPW OAuth 2.0 Token via Header URL url = new URL("http://url.com/"); HttpURLConnection urlConnection = (HttpURLConnection) url.openConnection(); setRequestProperty("Authorization", "Bearer …");
- 60. @SeraAndroid#DeathToPW OAuth 2.0 Token via URI "url.com/oauth?access_token=…"
- 62. @SeraAndroid#DeathToPW OAuth libraries for Android github.com/mttkay/signpost github.com/pakerfeldt/signpost-retrofit
- 63. @SeraAndroid#DeathToPW OAuth libraries for iOS github.com/nxtbgthng/OAuth2Client github.com/AFNetworking/AFOAuth2Manager
- 66. @SeraAndroid#DeathToPW /$d+/ @SeraAndroid#DeathToPW The Hybrids OpenID OAuth Extension & OpenID Connect
- 74. @SeraAndroid#DeathToPW >The Realm of Creepy_
- 80. @SeraAndroid#DeathToPW Security Needs an accessible standard
- 81. @SeraAndroid#DeathToPW Difference Between Authentication and Authorization
- 82. @SeraAndroid#DeathToPW User Experience Should be enhanced - not impaired
Notas del editor
- Have a look at the key issues of passwords Ways to improve working with passwords Alternative technologies that boost UX
- Security is a concept Constant struggle to keep up with exploits No 100% security
- And it doesn’t even stop here
- SplashData
- SplashData
- Batman vs superman movie DC must have paid for this
- Batman vs superman movie DC must have paid for this
- Batman vs superman movie DC must have paid for this
- Mention 3 key problems: Reused Phished Keylogged
- April 7th 2014 public Read the memory of system Compromises secret keys OpenSSL
- Jakob Nielsen Denmark
- Roberto Orgiu
- MD5, SHA-1, 2, 3
- MD5, SHA-1, 2, 3
- bcrypt scrypt and PBKDF2 Password based key derivation function scrypt 2012 IETF
- OTP (One-time password) Not vulnerable to replay attacks Supposed to be used on one system only
- OTP (One-time password) Not vulnerable to replay attacks Affects one system only Twitter & Yahoo
- Sci-Fi Author The Universe and the Teacup
- 3 kinds of token Request Authorization Access
- Vulnerability Redirect URI
- Open a WebView Request Access Token with Auth Code
- More than 1 billion users at peak 2009
- OpenID OAuth 2 Hybrid Extension OpenID Connect
- Should biometry replace passwords or identity?
- Heartbeat
- Fujitsu
- Emotiv Electrical activity in brain