Presenting an informal lunch talk on using a password manager to handle personal internet accounts securely. Also discussing 2-factor authentication a bit. Discussion features Lastpass a little bit.
I forgot my password – what a secure password reset needs to have and whyMichal Špaček
Users often forget their passwords, so applications often must have a password reset mechanism. There are several options for how to do it; some of them are good, most of them not so good. Generate a password and send it in an email? No. Security questions? No way. Reset passwords via a phone call? Rather not. This talk presents some really creative examples of botched password reset implementations, as well as a proven method for resetting passwords securely.
Acpe 2014 Internet Anonymity Using TorJack Maynard
Security presentation on Tor at ACPEnw, a Pacific Northwest regional nonprofit association for the educational technology community dedicated to the support of administrative, information and instructional technology.
we have done a small analysis about why should we use or select Liferay for our legacy application replacement in comparison with other opensource framework like sharepoint , Joomla , Drupal etc . Please have alook into the attached PPT for the same.
I forgot my password – what a secure password reset needs to have and whyMichal Špaček
Users often forget their passwords, so applications often must have a password reset mechanism. There are several options for how to do it; some of them are good, most of them not so good. Generate a password and send it in an email? No. Security questions? No way. Reset passwords via a phone call? Rather not. This talk presents some really creative examples of botched password reset implementations, as well as a proven method for resetting passwords securely.
Acpe 2014 Internet Anonymity Using TorJack Maynard
Security presentation on Tor at ACPEnw, a Pacific Northwest regional nonprofit association for the educational technology community dedicated to the support of administrative, information and instructional technology.
we have done a small analysis about why should we use or select Liferay for our legacy application replacement in comparison with other opensource framework like sharepoint , Joomla , Drupal etc . Please have alook into the attached PPT for the same.
Introductory talk on the need to use password managers and a quick review of Lastpass' features.
Presented at the OWASP Austin Cryptoparty in January, 2021.
Black Ops Testing Workshop from Agile Testing Days 2014Alan Richardson
At Agile Testing Days 2014. Steve Green, Tony Bruce and Alan Richardson hosted a double track Black Ops Testing workshop, where Redmine was the target application.
Find out more about the Black Ops Testing Team: http://blackopstesting.com/page/about.html
The subject of passwords is important today since they protect all of your accounts, and are frequently attacked by crackers. In this presentation I examine the technology used to handle and protect passwords, and make recommendations for what the user can do to protect themselves online.
Strong business needs strong foundationsLeesa Watego
In 2018, I was invited to present at the inaugural Strong Women Strong Business conference hosted by Indigenous Business Australia in Adelaide.
In the 'digital' category, I focused on the need for small business to implement good digital security practices, including good password management.
How to choose a password that’s hard to crackKlaus Drosch
A good password is usually the first and only line of defense for your important web-services. Choosing a strong and memorable password can be a hassle since those two criteria don’t always go hand in hand. It’s tempting to reuse an old password, slightly modifying it, or even write it down on a text-file in the computer.
In this guide, we will show you how to choose a good password, how to remember it and just how easily bad passwords can get hacked.
Passwords are the main authentication method used for internet sites and applications. But passwords get stolen and have many weaknesses Here are tips you can use at home and at work to protect your information.
Elevating Tactical DDD Patterns Through Object CalisthenicsDorra BARTAGUIZ
After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!
More Related Content
Similar to Secure Password Management, Informal, @WalmartLabs
Introductory talk on the need to use password managers and a quick review of Lastpass' features.
Presented at the OWASP Austin Cryptoparty in January, 2021.
Black Ops Testing Workshop from Agile Testing Days 2014Alan Richardson
At Agile Testing Days 2014. Steve Green, Tony Bruce and Alan Richardson hosted a double track Black Ops Testing workshop, where Redmine was the target application.
Find out more about the Black Ops Testing Team: http://blackopstesting.com/page/about.html
The subject of passwords is important today since they protect all of your accounts, and are frequently attacked by crackers. In this presentation I examine the technology used to handle and protect passwords, and make recommendations for what the user can do to protect themselves online.
Strong business needs strong foundationsLeesa Watego
In 2018, I was invited to present at the inaugural Strong Women Strong Business conference hosted by Indigenous Business Australia in Adelaide.
In the 'digital' category, I focused on the need for small business to implement good digital security practices, including good password management.
How to choose a password that’s hard to crackKlaus Drosch
A good password is usually the first and only line of defense for your important web-services. Choosing a strong and memorable password can be a hassle since those two criteria don’t always go hand in hand. It’s tempting to reuse an old password, slightly modifying it, or even write it down on a text-file in the computer.
In this guide, we will show you how to choose a good password, how to remember it and just how easily bad passwords can get hacked.
Passwords are the main authentication method used for internet sites and applications. But passwords get stolen and have many weaknesses Here are tips you can use at home and at work to protect your information.
Similar to Secure Password Management, Informal, @WalmartLabs (20)
Elevating Tactical DDD Patterns Through Object CalisthenicsDorra BARTAGUIZ
After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!
GraphRAG is All You need? LLM & Knowledge GraphGuy Korland
Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs.
1. Unifying Large Language Models and Knowledge Graphs: A Roadmap.
https://arxiv.org/abs/2306.08302
2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs:
https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/
UiPath Test Automation using UiPath Test Suite series, part 3DianaGray10
Welcome to UiPath Test Automation using UiPath Test Suite series part 3. In this session, we will cover desktop automation along with UI automation.
Topics covered:
UI automation Introduction,
UI automation Sample
Desktop automation flow
Pradeep Chinnala, Senior Consultant Automation Developer @WonderBotz and UiPath MVP
Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP
Connector Corner: Automate dynamic content and events by pushing a buttonDianaGray10
Here is something new! In our next Connector Corner webinar, we will demonstrate how you can use a single workflow to:
Create a campaign using Mailchimp with merge tags/fields
Send an interactive Slack channel message (using buttons)
Have the message received by managers and peers along with a test email for review
But there’s more:
In a second workflow supporting the same use case, you’ll see:
Your campaign sent to target colleagues for approval
If the “Approve” button is clicked, a Jira/Zendesk ticket is created for the marketing design team
But—if the “Reject” button is pushed, colleagues will be alerted via Slack message
Join us to learn more about this new, human-in-the-loop capability, brought to you by Integration Service connectors.
And...
Speakers:
Akshay Agnihotri, Product Manager
Charlie Greenberg, Host
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf91mobiles
91mobiles recently conducted a Smart TV Buyer Insights Survey in which we asked over 3,000 respondents about the TV they own, aspects they look at on a new TV, and their TV buying preferences.
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Jeffrey Haguewood
Sidekick Solutions uses Bonterra Impact Management (fka Social Solutions Apricot) and automation solutions to integrate data for business workflows.
We believe integration and automation are essential to user experience and the promise of efficient work through technology. Automation is the critical ingredient to realizing that full vision. We develop integration products and services for Bonterra Case Management software to support the deployment of automations for a variety of use cases.
This video focuses on the notifications, alerts, and approval requests using Slack for Bonterra Impact Management. The solutions covered in this webinar can also be deployed for Microsoft Teams.
Interested in deploying notification automations for Bonterra Impact Management? Contact us at sales@sidekicksolutionsllc.com to discuss next steps.
Generating a custom Ruby SDK for your web service or Rails API using Smithyg2nightmarescribd
Have you ever wanted a Ruby client API to communicate with your web service? Smithy is a protocol-agnostic language for defining services and SDKs. Smithy Ruby is an implementation of Smithy that generates a Ruby SDK using a Smithy model. In this talk, we will explore Smithy and Smithy Ruby to learn how to generate custom feature-rich SDKs that can communicate with any web service, such as a Rails JSON API.
GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...James Anderson
Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM
The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management.
The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM).
Speakers:
Bob Boule
Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle.
Gopinath Rebala
Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.
Transcript: Selling digital books in 2024: Insights from industry leaders - T...BookNet Canada
The publishing industry has been selling digital audiobooks and ebooks for over a decade and has found its groove. What’s changed? What has stayed the same? Where do we go from here? Join a group of leading sales peers from across the industry for a conversation about the lessons learned since the popularization of digital books, best practices, digital book supply chain management, and more.
Link to video recording: https://bnctechforum.ca/sessions/selling-digital-books-in-2024-insights-from-industry-leaders/
Presented by BookNet Canada on May 28, 2024, with support from the Department of Canadian Heritage.
The Art of the Pitch: WordPress Relationships and SalesLaura Byrne
Clients don’t know what they don’t know. What web solutions are right for them? How does WordPress come into the picture? How do you make sure you understand scope and timeline? What do you do if sometime changes?
All these questions and more will be explored as we talk about matching clients’ needs with what your agency offers without pulling teeth or pulling your hair out. Practical tips, and strategies for successful relationship building that leads to closing the deal.
Securing your Kubernetes cluster_ a step-by-step guide to success !KatiaHIMEUR1
Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster.
However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks.
In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualityInflectra
In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring.
Learn about:
• The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks.
• Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective.
• Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification.
• Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process.
Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.
2. Who Am I?
● 20 years industry operations experience
● Joined Kosmix 2005
● Acquired into @Walmartlabs, 2011
● NOT a security expert!
– but neither are most people!
3. What is the problem?
● Sites get compromised
● Passwords can be recovered
– Even sites practicing good security!!
● Emails and passwords are re-used
● More and more online accounts!
● Most hackers are after lower-hanging fruit
● Some hackers target specific people, i.e. @N twitter
4. What is a solution?
● Unique, random, long passwords per site
– 8, 12, 16 characters – even longer!
● Compromised? Limited vulnerability
● Password managers are one way to do this
● Password manager must be secured well
● Not perfect – nothing is perfect
5. Considerations in a PM
● How is the data secured?
● Can I access my data on mobile? How?
● Is there two-factor authentication?
● Can the data be recovered without the master password?
● How do I back it up securely?
● Can it be used if company XX goes splat?
6. My choice: Lastpass Premium
● Premium ($12/yr) adds mobile support
● Encrypted cloud storage
● Secured and Encrypted by master password
● Good 2-factor authentication
● Usual support of forms, data, password generation
7. My choice: Lastpass Premium
● Works off-line
● Import/Export for backups
● CSV export available for non-lastpass
– PITA – mostly disaster recovery, IMO
● All major browsers have plugins
● All mobile have fully-functional app ($$)
8. My choice: Lastpass Premium
● Lastpass never gets non-encrypted data
● Not perfect, but IMO the best option
● Other options are also good! Check 'em out
● Choosing a good password manager is a big deal!
● If somebody hacks Lastpass and releases booby-trapped
code, all bets are off the table.. but that's true for
everybody
9. Using Lastpass
● Create account
● Create MASTER PASSWORD
● No master password = NO DATA
● Add 2-factor authentication
● Read blogs on securing and using it
● Some security settings are important
12. Best Practices – Master Pass
● Master password should be very good
– Write one or two copies down – optional
– The MP is obviously critical
– Losing master password means no data
● Never use 'Remember me' option
● Be careful with “Allow for XX hours”
13. Best Practices - Sites
● Every site gets a long, unique password
– As long as allowed, if possible
– Use symbols if allowed
● Change ALL passwords to random ones in PM
– (Optional) except things like financial accounts
– trade-offs for those as well
14. Best Practices - Sites
●
Consider 2nd
, secure email for financial
● Maybe not really helpful
● Enable 2-factor and security notifications
15. 2-Factor Authentication
● Something you know + Something you have
● Possibilities:
– cell phone / SMS text
– FOB keys / custom solutions
– TOTP / Google Authenticator
● How secure it is varies, despite 2-factor
● Still a good thing - usually
16. 2-Factor Best Practices
● Enable on critical accounts if at all possible
● Especially:
– Lastpass (or other PM)
– Google
– Facebook
– Linkedin
– Banks and Financial (!!)
● twofactorauth.org has a list
17. 2-Factor Best Practices
● Realistically, it can often be bypassed
● Social engineering works really well
– Humans want to be helpful
● Password protection still the best option
● “Reset password” is almost universal
– Email security on accounts is paramount!
● Where you can't be secure, early notice is best
18. 2-Factor Best Practices
● Some 2-factor sites (like Google) can give you one-time-
use codes.
● Codes can substitute for your 2-factor once.
● Good to have as backup or travel
● Carefully print or control where they are
19. 2-Factor Best Practices
● Be careful about critical 2-factor accounts
● You can lose access without it, sometimes!
● Understand how to transfer things like the Google
Authenticator app to new phone
● Most sites, you can fix not having 2-factor with the master
password, but not every one!
● Codes are a good idea to have printed out
– Secure those puppies!
20. Passwords – Worst Practices
● Are you a worst practice-ing password-er?
● YOU ARE MAKING IT EASY!!!
– hackers <3 you – feel the love
● Bad ideas: Using personal data of any kind
– birthdays, anniversaries, dates
– addresses, cities, locations
– favorite colors, items, activities, ...
– old phone numbers and account numbers
– anything relating to your children or spouse
● Dictionary words of any kind, even modified
● DO NOT DO THIS!
21. How to make Secure Passwords
● Completely random is best
●
Long, complex passwords are 2nd
best
● Length of password matters - a lot
– encryption and hashes both benefit
● If you have to remember it, use strategies
22. Bad password example
● Example: Take two words, bunny + carrot
● Combine them and scramble a bit
– Bunn33%carrot
● This is much less secure than you might think
– Though.. still better than most out there
23. Good password example
● Start with a phrase, a made-up story is good
– “My bunny is weird, he only eats green carrots”
● Take first letters, scramble a bit
– Add punction/symbols
– replace some letters with non-expected
– add some words at the end that are easy to add length
to the password
24. Good password example
“My bunny is weird, he only eats green carrots”
mY!biW+He0eatsgreencarrots
● Sufficient Random-ish chars important (8+)
● Extra words or characters help – even if simple
● You'll have to type this out, don't be too crazy
● You need to remember it
– Putting it on a post-it kind of beats the point of it
25. App-specific passwords
● Offered by Google, Microsoft, Facebook, etc.
● Creates a one-use password (or several)
– Sometimes it can be named, i.e. “iPhone email”
● Limited ability to change account
● You can disable all app-specific passwords from master
account controls
● Use for iphone email, IM chats, etc.
● Avoid using your real passwords whenever you can
26. 2-Factor Example: Google
● Implements TOTP
● Scans a QR code (or type in) for shared secret
● Generates a 6-digit code based on secret securely
● Codes last about 30 seconds, then change
● Turns your mobile device into RSA FOB
● Works very easily in practice
● Add everywhere you can!
29. Final Suggestions
● Never, ever give out passwords
● IT and sites almost never can use it
● Don't save your corporate credentials – ever
● Be very careful giving out information
● Be very careful using devices not yours
30. Final Suggestions
● Passwords Managers are worthless without good device
and computer security!
– phishing
– malware / viruses
– social engineering
– saved passwords in browser
● Use passcodes on your phone
● Configure phone to erase itself after X tries
31. Final Suggestions
● Email account is critical
● Almost all sites have “reset password”
● Can usually bypass 2-factor as well (!!!)