PasswordsCon 2018 Stockholm
| title | author | length |
|---|---|---|
| The Big Picture | Marie Baléo | 32m |
Personal stories tie physical and digital security to concrete outcomes: emergency protocols, an EpiPen and parental training prevent repeated anaphylaxis… | ||
| How iOS Encourages Healthy Password Practices | Ricky Mondello | 39m |
iOS 12 adds concrete features to move users off reused passwords: automatic strong passwords generates 20‑character, syllable‑style passwords with ~71 bits… | ||
| iCloud Security: What if someone gets your password? | Vladimir Katalov | 30m |
History of tools that download iCloud backups and extract credentials is laid out with concrete limits: three most recent backups live as encrypted chunks and… | ||
| Implementing "password never expires" | Almedin Santic, Camilla Lyngedal | 23m |
Organization implements a voluntary password never expires policy for 1,400 internal accounts, sets minimum length to 16 characters while keeping complexity… | ||
| Web Authentication: From Draft To Product | Suby Raman | 25m |
Duo is rolling WebAuthn to millions within weeks and describes an extendable WebAuthN backend, production JavaScript that parses CBOR attestation objects, and… | ||
| An investigation of the effectiveness and security of pwds | Sibusiso Sishi | 24m |
Collected 2614 LM hashes, 170,000 NTLM hashes from seven South African organisations; 19 common weak English passwords are converted into eight Southern… | ||
| What does ”MFA” mean? | Jeffrey Goldberg | 34m |
MFA often means different things in practice: chip-and-PIN works as true two-factor, U2F prevents verifiers being crackable, TOTP/push use a shared long-term… | ||
| Advice is like mushrooms, the wrong kind can prove fatal | Hazel Murray | 16m |
Collected 269 pieces of advice from 21 sources and sorted into 29 categories, revealing direct contradictions (e.g., reuse vs alter passwords, require special… | ||
| Human skills for more secure behaviour | Cecilie Wian | 23m |
Users recognize forms quickly and react emotionally so interfaces should leverage recognition not punish it. Key claim: shift constraints toward what people do… | ||
| Random Passwords Aren't Good Enough | Rob Yoder | 28m |
Shows that drawing uniformly from an allowed alphabet fails to guarantee required character classes, so 1Password replaces separate sliders with on/off… | ||
| The Wide Diversity of Password Requirements – And how to cope with it | Moritz Horsch | 27m |
An automated crawler extracts password rules from live sites and produces a uniform PRD database for 185,696 services; only ~57,000 (≈30%) publish any… | ||
| Protecting medical data with passwordless authentication | Carl Svensson | 17m |
KRY/LIVI builds a passwordless system that generates a private key on the phone and stores the public key server-side, using public-key challenge-response for… | ||
| WebAuthn and security keys - unlocking the key to authentication | Christiaan Brand | 29m |
Claims that 43% of users still fall for phishing and that Google found 3.3 billion credentials online drive the need for stronger auth; Google says it… | ||
| Everything but the User: Reducing Password Reuse | Miranda Wei | 21m |
A study collects 24 notifications found and runs two user surveys (180 and 588 respondents) plus manual coding of five leaked datasets (top 1,000 passwords… | ||
| Authentication Beyond SMS | Kelley Robinson | 25m |
Passwords and SMS 2FA are often bypassed: carriers’ SS7 handoffs and SIM swap attacks let attackers intercept codes, and Reddit’s Aug 1 incident shows… | ||
| nothing matches | ||