Let’s stop blaming our users for getting hacked when it is our problem to solve
summary
Passwords, SMS and TOTP are shown to fail in real attacks: SMS suffers SIM‑jacking and social engineering, TOTP acts like a shared secret and can be captured, and a live demo with Evilginx records passwords, TOTP and session cookies via a phishing proxy. Biometrics are local only with ~1/1000 false match baseline. FIDO2/WebAuthn uses asymmetric keys so stolen public keys are useless, works as anti‑phishing FIDO2/WebAuthn and is deployable via libraries and an ASP.NET Core component that validates assertions and updates counters.
AI-written summary · about
chapters (13)
- 0:00Start
- 4:21Why Password's So Popular
- 8:25What Can We Do To Improve Passwords
- 11:06Knowledge Based Authentication
- 12:39Multi-Factor Authentication
- 16:59Time-Based One-Time Passwords
- 24:17Physical Biometrics
- 24:41Typing Cadence
- 26:20Push Notifications
- 35:51Passwords
- 40:20The Open Source Library
- 44:57A Password Authenticated Key Exchange
- 46:19Secure Remote Password
related talks
42mChallenges in User Authentication: Balancing Security & User Experience
25mAuthentication Beyond SMS
07mImagine: A world without passwords, it is easy if you try
30mGoing Beyond Passwords: The Future of User Authentication
47mThe Psychology of Multi-Factor Authentication
24mTwo Factor Failure
32mPasswords are so 1990
51mYou Shall Not Password: Modern Authentication for Web Apps