Download to read offline
Uploaded byJon Warbrick
(Why) Passwords don't work
The document discusses various security measures to protect sensitive information from potential threats, including students, journalists, organized criminals, and government agencies. It presents multiple options for password management, such as eliminating passwords or implementing centralized verification systems. The document also highlights ongoing security challenges and questions future directions for improving password security.
![The 'New [University of Cambridge] Map](https://cdn.slidesharecdn.com/ss_thumbnails/jw-map-130709115107-phpapp02-thumbnail.jpg?width=640&height=640&fit=bounds)
(Why) Passwords don't work
- 1. In a changefrom our advertised program...
- 2. Why Passwords Don’t Work Jon Warbrick
- 3. What are wetrying to achieve?
- 4. What are wetrying to achieve? Protection from • a bored University student • a tabloid journalist • an organized criminal • the NSA
- 5. What are wetrying to achieve? Protection from • a bored University student • a tabloid journalist • an organized criminal • the NSA Protection of • a student’s photo archive • the heir to the throne's email • the University financial system
- 6. http://xkcd.com/538/ Licensed under aCreative Commons Attribution-NonCommercial 2.5 License http://creativecommons.org/licenses/by-nc/2.5/
- 7.
- 8. Option two: A single,fixed password
- 9.
- 10.
- 11. Option five: Kerberos (orsimilar)
- 23.
- 24.
- 25.
- 26.
- 27.
- 28. Where do wego from here?
Editor's Notes
- #2 \n
- #3 \n
- #4 What security properties do you want?\nWhat are you trying to protect, and from who?\nDoes one size fit all?\n
- #5 What security properties do you want?\nWhat are you trying to protect, and from who?\nDoes one size fit all?\n
- #6 \n
- #7 Oh so easy\nIt all comes down to trust\nC.f. Phoenix 30 years ago - password checking could be disabled\n
- #8 Now we just have to trust a smaller group\nWho would do this? Oh, think of intruder alarms\n
- #9 No longer need to trust users\nDo need to trust anyone/thing that sees the list - any user on any system and then some\nMalicious and/or incompetent\nCould use crypt, but doesn&#x2019;t really help\n
- #10 Note that this is &#x2018;LDAP authentication&#x2019;, but could be other things\nClient system still sees plaintext password\n\n
- #11 Designed largely to solve this problem\nBut...\n
- #12 How does the user know?\n
- #13 How does the user know?\n
- #14 How does the user know?\n
- #15 How does the user know?\n
- #16 How does the user know?\n
- #17 How does the user know?\n
- #18 How does the user know?\n
- #19 How does the user know?\n
- #20 How does the user know?\n
- #21 How does the user know?\n
- #22 Users can always give their PWD away\nAnd the always have to trust something which may not be safe\n
- #23 Users can always give their PWD away\nAnd the always have to trust something which may not be safe\n
- #24 Users can always give their PWD away\nAnd the always have to trust something which may not be safe\n
- #25 Users can always give their PWD away\nAnd the always have to trust something which may not be safe\n
- #26 \n