ARE YOU SECURE?
summary
4-digit PINs offer only 10,000 combinations, so shoulder‑surfing and brute force break them and hashing or salting doesn’t fix that use case; device binding with one MFA on first login fails when platform APIs don’t expose a device ID; timing attacks become practical inside EC2 with 20–400 ns latencies; blind and time‑based SQL injection can exfiltrate schema and data; practical tools cited for testing include SQLMap and Metasploit and regular gem/CVE scanning.
AI-written summary · about
chapters (9)
- 0:00Introduction to security
- 1:04Software is broken by definition
- 2:06Client conflicts on security
- 7:29The evil world of hackers
- 12:06Broken code in engineering
- 17:12Timing attacks and SQL injection
- 22:50Testing your own code
- 27:38HTTPS and randomness pitfalls
- 29:26Takeaway: software is broken
related talks
42mChallenges in User Authentication: Balancing Security & User Experience
47mThe Psychology of Multi-Factor Authentication
47mYour Password Complexity Requirements are Worthless
32mPasswords are so 1990
30mhunter2: A Symphony of Password Horror
45mMFA: Stories that make you go 'Huh?'
45m[T]OTPs Are Not As Secure As You Might Believe
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up