Solving Problems with Authentication discusses common authentication attacks and issues with passwords. It notes that passwords are inherently insecure due to susceptibility to brute force attacks and human error. While services have implemented measures like multifactor authentication and minimum password requirements, these solutions can be complex, costly, and disruptive. The document recommends removing passwords and using alternative authentication methods like biometric authentication and physical security keys. It also suggests decentralizing authentication and allowing multiple login options to improve security without reducing usability.

1. Solving Problems with
Authentication

2. Yo Sub Kwon
Co-founder of Launchkey

8. Attacks
• Compromised credentials of a privileged account
• Direct access to cloud servers or hardware containing wallets or
credentials
• Compromised credentials on a mass scale of users with weak or
shared passwords
• Weak or compromised API keys
• Trojans and Keyloggers
• Bitcoin specialized malicious software

9. Kill Passwords
Along with many in
the industry, we feel
passwords and
simple bearer tokens
such as cookies are
no longer sufficient
to keep users safe
-Google Vice
President of Security
Eric Grosse
Using passwords for security
is no longer safe for people
-Jonathan LeBlanc, PayPal’s
head of global developer
advocacy
FIDO hopes to make passwords a
thing of the past
-Kayvan Alikhani, senior director of
technology at RSA

10. Passwords are insecure
• They’re inherently susceptible to brute-force attacks
• They are typically stored in-band on servers (and elsewhere) while a
knowledge factor of authentication is only effective so long as the
individual retains sole possession of that secret.
• They’re susceptible to human error by both the individuals that utilize
passwords and the developers that implement them
• Cracking hashed passwords becomes progressively easier with our
ever increasing computing power
• Due to password re-use, one password breach can result in obtaining
credentials for multiple unrelated services

11. Common Patches
• Minimum password requirements
• Password expirations
• More passwords
• One time passwords (OTP) as a second factor
• Social Media logins

12. Problems
• Passwords are insecure
• Multifactor authentication is technically complex
• Out of band hardware is costly
• New authentication measures can be disruptive to business

13. Solutions – Passwords are insecure
• Remove passwords
• Authentication using mobile devices (BYOD)
• Biometric authentication
• Physical devices such as USB keys or wearables

14. Solutions - Multifactor complexity
• Decentralize the layer of authentication
• Don’t do your own security
• Fidoalliance.org

15. Solutions – Disruptive to business
• Offer multiple options to login
• Passive factors of authentication

16. Conclusions
• Better security doesn’t need to be more difficult
• Placing patches on authentication problems is not future-proof
• Better security and easier to use authentication solutions do exist
Encourage the services you use to offer them for their sake and yours