Hem
Program
PasswordsCon – ...

PasswordsCon (Per Thorsheim), 23 november 2020:

PasswordsCon – Part 1

A conference that’s all about passwords, PIN codes, and digital authentication. Passwords are the most prevalent form of authentication in the digital age.

Passwords (PasswordsCon) is the first and only conference of its kind, where leading researchers, password crackers, and experts in password security from around the globe gather in order to better understand the challenges surrounding digital authentication, and how to adequately address them.

While large mainstream conferences tend to focus on current hot topics in the information security industry, Passwords events explore fringe conversations on everything from analysis and education to creating, securing, cracking, and exploiting authentication solutions.And unlike other events where the speaker is rushed in and out, Passwords provides an intimate environment for participants to directly engage speakers before, during, and after their presentations.

09:00-10:00

Språk engelska

Keynote-sessions

Kate Darling Robotforskare

Dr. Darling har vigt sitt akademiska liv åt den nya teknikens lagliga och etiska konsekvenser, och hur samhället kan förbereda sig på det fördjupade samspelet mellan robotar och människor. Läs mer

10:00-10:30

Fika

10:30-10:45

Welcome to PasswordsCon 2020!

A brief history of PasswordsCon 2010-2020.

Per Thorsheim
Founder of PasswordsCon
Per Thorsheim has in writing from Cormac Herley that he is pathologically obsessed with Passwords. Per is very proud of that. The license plate of his Norwegian car says "Passord". You can probably guess what it means. Twitter: @thorsheim

10:45-11:15

The Privacy Problem of Breach Notification Services

Commercial, free & “shady” breach notification services has become a thing. From big cloud providers to password managers, they can tell you, warn you and even block you from using & reusing old & bad passwords. Does this represent a security or privacy risk? And if the answer is ‘yes’, what can and should we do about it?

Per Thorsheim
Founder of PasswordsCon
Per Thorsheim has in writing from Cormac Herley that he is pathologically obsessed with Passwords. Per is very proud of that. The license plate of his Norwegian car says "Passord". You can probably guess what it means. Twitter: @thorsheim

11:15-11:45

On the Usability of Risk-based Authentication

Risk-based Authentication (RBA) is recommended in NIST SP800-63B and
protects against security risks such as password database leaks,
credential stuffing, insecure passwords and large-scale guessing
attacks. But how do users feel about it? We did multiple studies to
gather qualitative and quantitative user feedback on RBA's usability and
security perceptions.

We show how users perceive RBA compared to other authentication methods.
We also show RBA pitfalls, where state-of-the-art RBA solutions* can be
improved, and why "magic links" are not a good solution for RBA
re-authentication.

* See the talk from #PasswordsCon 2019: https://youtu.be/7hHD-Onx0gw

Website: https://riskbasedauthentication.org

Stephan Wiefling
PhD Student, Data-and Application Security Group (H-BRS), Sankt Augustin, Germany
Stephan Wiefling is a PhD student in Sankt Augustin, Germany (Data-and Application Security Group, H-BRS). His current research spans areas of Authentication and Usability. Twitter: @SWiefling

11:45-12:15

PINs (TBA)

TBA

Philipp Markert
PhD Student, Ruhr University Bochum
Philipp is a PhD student from Ruhr University Bochum in Germany. He is supervised by Prof. Dr. Markus Dürmuth and member of the Mobile Security Group. His research focuses on usable security with a special interest in authentication. He holds a BSc and MSc in Information Security from Ruhr University Bochum and studied at Drexel University as an exchange student in 2016. Twitter: @Philipp_Markert

12:15-13:15

Lunch

13:15-13:50

Språk engelska

Keynote-sessions

Tom Chatfield Techfilosof

Chatfield är en av Storbritanniens mest insiktsfulla tänkare kring digitalisering, ny media, dataspel och framtidens kompetensområden. Läs mer

14:00-14:30

Hello? Who is this?: A journey to stronger verification practices

If you have customers, you have customer data—even on a secure system that relies on encryption. When those customers reach out for help, it must first be confirmed that they indeed have a right to receive the information they seek, or that the requested account changes can be performed.

At 1Password, we have historically relied on a customer’s control of the email address provided when the account was created as verification for most support requests. This policy, however, depends heavily on human discretion, so a more robust solution was deemed necessary. In response, two technical solutions were developed which verify the identity of the user for the purposes of email and phone support.

Pilar Garcia
Privacy Officer, 1Password
Pilar Garcia completed her Bachelors in physics at the Universidad de las Américas Puebla (Mexico), and received her Masters in Pure and Applied Logic from the University of Barcelona. Now based in Toronto, Canada, Pilar is a Privacy Officer for the award-winning password management app, 1Password, where she’s known as the _XORcerer_.

14:30-15:00

A Report on the 1Password Cracking Challenge

In 2018, 1Password ran a password cracking challenge. The aim was to help us at 1Password better understand how effective our slow hashing of Master Passwords (MPs) is at raising the costs for attackers who might be in a position to crack a MP. We succeeded at this, coming to the conclusion that in late 2018 prices, the cracking costs are approximately 6 USD per 2^32 guesses.

This talk will describe how we arrived at that conclusion, how and why we designed the challenged the way we did, and how and why we had to make several adjustments during the course of the challenge, including quadrupling the prizes and the mechanism of hints.

Jeffrey Goldberg
Defender Against the Dark Arts, 1Password
Jeffrey Goldberg has been at 1Password for nearly a decade, where he is now the Chief Defender Against the Dark Arts, overseeing product security. He loves thinking like a criminal& doing magic with math. He also focuses on how people perceive and interact with system. He can’t keep to 300 charact

15:00-15:30

Fika

15:30-16:00

Print Spooler to Domain Admin in 30 Minutes or less

This talk walks through the MS-RPRN Print Spooler Notify Service and how to force a domain controller to authenticate with you with an NTLMv1 hash of its Active Director Machine Account. The NTLMv1 is then reversed to NTLM so that a Silver Ticket can be generated and a dcsync executed. NTLMv1 is now a liability and this talk demonstrates how.

Dustin Heywood
EvilMog, Team Hashcat

16:00-16:30

Advances in Deep Learning for Password Generation

We propose several novel password guessing methods inspired by state-of-art generative deep learning solutions for text. The approach is based on architectures such as autoencoders, generative adversarial networks (GANs) and attention-based models (Transformers). In the present work we provide in-depth quantitative and qualitative analysis. We demonstrate the effectiveness of our models on several well-established datasets.

Authors: David Biesner, Kostadin Cvejoski, Rafet Sifa, Bogdan Georgiev.
Institution: Fraunhofer IAIS, Sankt Augustin, Germany.

David Biesner
Machine learning researcher, Fraunhofer Institute IAIS, Germany
David Biesner is a PhD student at Fraunhofer IAIS and University of Bonn. He is part of a research team working on natural language processing with a focus on deep learning text generation methods. Twitter: @dvdbsnr https://fzml.fraunhofer.de/team/

17:10-18:00

Språk engelska

Keynote-sessions

Steve Wozniak Teknikpionjär

"Woz" var med och grundade världens största teknikbolag Apple, och är en av de viktigaste utvecklarna av de första hemdatorerna. Läs mer