Challenges in User Authentication: Balancing Security & User Experience
summary
Machine breach aggregates show 15 billion leaked accounts, and the demoed Bank of Asgard flow (recorded after a network failure) proves passkeys + TOTP work but are better when adaptive: geolocation, behavioral AI and typing DNA raise challenge levels only when risk signals appear. CAPTCHA fails against bots, SMS is discouraged due to SIM swapping, four‑digit codes are trivially brute‑forced, session/token entropy must be high, and EU verifiable credentials rollout (2026–2027) requires wallet support.
AI-written summary · about
chapters (16)
- 0:00Introduction and speaker background
- 1:05Passwords and security breaches
- 4:32Balancing security and convenience
- 7:20Why CAPTCHA fails
- 10:15MFA and authentication options
- 13:53Passwordless authentication demo
- 17:24Adaptive authentication strategies
- 22:15Risk-based authentication decisions
- 23:18Passkey authentication demo
- 25:52SMS risks and alternatives
- 28:42Session ID and token security
- 30:26Code entropy and reset security
- 33:16Email enumeration risks
- 35:22Verifiable credentials overview
- 38:36Self-sovereign identity future
- 41:48Key takeaways and closing
related talks
47mThe Psychology of Multi-Factor Authentication
47mLet’s stop blaming our users for getting hacked when it is our problem to solve
32mPasswords are so 1990
30mGoing Beyond Passwords: The Future of User Authentication
45mRedefining Security: From Passwords to Biometrics and Digital Signatures
17mGoing Beyond Passwords: The Future of User Authentication
15mThe evolution of user logins
16mInnovation in Authentication and More