Passwords are not going away
summary
Core claims: passwords stay; mandatory frequent rotation reduces security; length beats complexity. Practical fixes include make password a sentence, require unique passwords plus a password manager or written backup, block the top 1,000–10,000 leaked passwords with an open filter, and raise minimum length to 15 (result: forgotten-password helpdesk calls drop dramatically). Operational changes: use username → OTP → password flow, publish a fixed change-password URL, avoid exposing OTPs in SMS previews, and treat WebAuthn as the long-term goal.
AI-written summary · about
chapters (42)
- 0:00Intro
- 0:54Joke
- 1:30Associated Press
- 3:02Password recommendations
- 8:42Good news
- 9:25Mandatory password changes are stupid
- 10:01Microsoft says periodic password expiration is obsolete
- 10:43Do you need an account
- 13:07User experience and security
- 13:49Onboarding
- 14:07Creating a new account
- 22:26Invalid characters
- 23:18What makes a strong password
- 24:55Twofactor authentication
- 25:51Text messages
- 29:04Login flow
- 29:51Twofactor indication
- 31:48Give useful information
- 35:06Securitytxt
- 35:36Why are you changing your password
- 38:30Blog post
- 38:45I forgot my password
- 39:29Indicators of compromise
- 39:42Password reset process
- 40:50SP 80063B
- 41:36Highlights
- 44:09My previous job
- 44:40Open Password Filter
- 45:40Password Length
- 47:31What happened next
- 48:00Why did I do this
- 51:22OTPs
- 51:33Email is not secure
- 52:07How to make email secure
- 53:08Netflix
- 54:08Bad people
- 55:17Pin code joke
- 55:27Pin code statistics
- 56:16Peoples choice
- 58:58Nonmemorable pin
- 59:14FIDO
- 59:46Reception
related talks
25mEverything You Know About Passwords Is Wrong
32mPasswords are so 1990
14mPasswords. Are. Not. Hard!
30mhunter2: A Symphony of Password Horror
23mFantastic Passwords and Where to Find Them
50mPasswords don't have to be so hard!
25mPasswords Still? New Data on Consumer Authentication Habits
46mRequiem for the Password