Download as PDF, PPTX
Uploaded byPayPal
Death To Passwords
The document discusses the widespread misuse of weak passwords among users, highlighting that many rely on common and easily guessable passwords. It emphasizes the importance of improving security practices, such as implementing two-factor authentication and utilizing OAuth for safer user authentication methods. The content suggests that enhancing user experience while maintaining security is crucial for retaining user engagement.
More Related Content
Death To Passwords
- 1. DEATH TO PASSWORDS LONGLIVE SECURITY Tim Messerschmidt / @SeraAndroiD Mobile Tech Con, Munich ‘14
- 2. DO YOU BELIEVE INSECURITY?
- 3. DO YOU BELIEVE INSECURITY?
- 4.
- 5. 4.7% OF USERSUSE THE PASSWORD PASSWORD
- 6. 8.5% ARE USING PASSWORDOR 123456
- 7. 9.8% USE PASSWORD 123456OR 12345678
- 8. ... And itdoesn’t even stop here 14% have a password from the top 10 passwords 40% have a password from the top 100 passwords 79% have a password from the top 500 passwords 91% have a password from the top 1000 passwords
- 10.
- 11. 1. 123456 up1 2. Password down 1 3. 12345678 4. Qwerty up 1 5. Abc123 down 1 6. 123456789 New 7. 111111 up 2 8. 1234567 up 5 9. Iloveyou up 2 10. Adobe123 new 11. 123123 up 5 12. Admin new 13. 1234567890 new 14. Letmein down 7 15. Photoshop new 16. 1234 new 17. Monkey down 11 18. Shadow 19. Sunshine down 5 20. 12345 new
- 12. My learnings fromthis trend - People HATE monkeys - People are more depressed - Adobe is very popular
- 13. 3 Password Problems -Reused - Phished - Keylogged
- 14.
- 15.
- 16.
- 17. Favor security toomuch over the experience and you’ll make the website a pain to use.
- 19.
- 20. Storing Passwords SQLCipher &KeyChain
- 21.
- 22. People forget passwords… 45%admit to leaving a website instead of re- setting their password or answering security questions * * Blue Inc. 2011
- 23. Also they hateto register Out of 657 surveyed users 66% think that social sign-in is a desirable alternative. * * Blue Inc. 2011
- 24. SO WHAT CANWE DO INSTEAD?
- 25.
- 26.
- 28.
- 30. Request Request Token Grant Request Token Direct User to Service Obtain AuthorizaDon Direct to Consumer Request Access Token Grant Access Token Access Resources Consumer Service Provider
- 31.
- 33. Android: Signpost <3 github.com/mttkay/signpost iOS: TDOAuth github.com/tweetdeck/TDOAuth
- 34.
- 35. Direct User to Service Obtain AuthorizaDon Request Access Token Grant Access Token Direct to Consumer Access Resources / Profile Consumer Service Provider
- 36. URL url =new URL(”http://url.com/”);! HttpURLConnection urlConnection =! !(HttpURLConnection) url.openConnection();! ! ! setRequestProperty(”Authorization”, ”Bearer …”);! HTTP Header “url.com/oauth?access_token=…”! URI parameter
- 37.
- 38.
- 39. OAuth 2.0 andthe Road to Hell hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell
- 40. Identity Techniques - OpenID -OpenID Connect - Persona
- 41. Identity Providers Social vs.Concrete
- 43. Name Email Date of Birth Locale TimeZone Address Gender Language Phone Number Creation Date
- 45. What’s Next? Bluetooth Smartand Co.
- 49. Security matters to usersand developers Difference authentication and authorization User Experience should be enhanced not impaired
- 50.