hunter2: A Symphony of Password Horror
summary
History of password failures: plain‑text files at MIT, a nuclear launch code set to eight zeros, and leaks of “password” and “123456” persist. Practical fixes: always pbkdf2 (or argon2/bcrypt) with unique salt and many rounds, enable HTTPS and account lockouts (django-axes), offer multi‑factor via YubiKey (U2F) and TOTP not SMS, support diceware long passphrases and surface live strength feedback with zxcvbn, and avoid using standalone biometrics as the sole factor.
AI-written summary · about
chapters (20)
- 0:00Intro
- 1:26hunter2 A Symphony of Horror
- 5:57WE have to fix this.
- 6:49Once upon a time...
- 8:05Once upon another time...
- 9:19and we all lived?
- 9:30Once upon a 1902...
- 13:03Salt and hash
- 15:00Django to the rescue!
- 15:50django-axes
- 16:34Multifactor authentication
- 19:19django-two-factor-auth
- 20:00Enable more than one Mra
- 21:34Good password policies.
- 22:21ralvage goggles bunkhouse legroom encode
- 23:264a. Educate people about
- 24:23Password managers
- 24:58zxcvbn-python
- 25:43Rethink biometric auth
- 28:551. Salt and harh. 2. Implement MFA! Support U2F. 3. Enable more than one MFA. 4. Write proper password policies.
related talks
31mhunter2: A Symphony of Password Horror
46mRequiem for the Password
40mFantastic Passwords and Where to Find Them
23mFantastic Passwords and Where to Find Them
27mAccount Security for the Fashionable App Developer
32mPasswords are so 1990
43mPlease pass the salt: Serve up passwords with a side of entropy
01h 05mPasswords are not going away