The document discusses issues surrounding password usability and security, criticizing existing practices like blocking password managers and limiting character entry. It suggests improvements such as using simple text fields and adopting more secure authentication methods like fingerprints and U2F. It emphasizes the importance of conducting usability studies and understanding user behavior related to authentication errors.

1. Authenticity and Usability
Pawel Krawczyk, Immusec.com

3. My Secure Banking Password
1st, 11th, 14th character?

4. Definition of the problem --->

5. “A Crypto-Nerd’s Imagination”
Type 1st, 5th and 14th characters
of your password
Oh, obviously these will be
4, o and k
Inspired by Xkcd.com

6. My Usable Banking Password
<-- A real world human response strategy

7. My Usable Banking Password

8. My Usable Banking Password

9. My Usable Banking Password

10. My Usable Banking Password
Credit: www.whatsmypass.com

11. What could be done better
● Do not block the password managers
○ Use a simple login/password text fields
○ Do not actively block text paste
○ Avoid “chosen characters” password entry
○ Never limit maximum password length
● Choose a more secure authentication methods
○ Fingerprint
○ U2F (Universal Two-Factor)
○ Avoid SMS passwords

12. How to get it right?
● Always run usability study on your authentication schemes
● Run controlled experiment with live users
● Note authentication error rates
● Understand user back-out strategies from authentication errors
Questions?
pkrawczyk@immusec.com https://immusec.com
0 7879 180015 https://www.linkedin.com/in/pawelkrawczyk/