Archive of authentication and password security news gathered by Bruce K. Marshall. See https://xitter.cf/t.co/9uAr4djFQ9 or new updates on https://xitter.cf/t.co/BDjgaZEXXC
Wichita KS, USA
Joined October 2012
- Tweets2.6K
- Following304
- Followers2.2K
- Likes1.1K
Pinned Tweet
OWASP released v4.0 of the Application Security Verification Standard (ASVS) in March, listing security practices for orgs to design, code, and test apps against. github.com/OWASP/ASVS There was substantial content change in the authentication section, so I'll comment on it.
PasswordResearch.com retweeted
Virtual #PasswordsCon CFP is live:
passwordscon.org/cfp/
Please submit NOW!
Streaming on November 23-24. Pre-recorded or live talks, with live Q&A sessions.
(please RT!)
PasswordResearch.com retweeted
Pre-draft call for comments just issued for #NIST SP 800-63-4 Digital Identity Guidelines. @NISTcyber csrc.nist.gov/publications/d…
PasswordResearch.com retweeted
Drop by the Authentication (1120-1220pm PDT) session at @IEEESSP to check out @Philipp_Markert speaking about our work on the security of 4- and 6-digit PINs. Q&A to follow the talk, and you can also find out more on our project web-page this-pin-can-be-easily-guess…
PasswordResearch.com retweeted
"Study found little benefit to 6-digit PINs as compared to 4-digit PINs. Participants tended to select more-easily guessed 6-digit PINs when considering the first 40 guesses of an attacker. Current PIN blacklists ineffective" @Philipp_Markert et al. 👏 this-pin-can-be-easily-guess…
PasswordResearch.com retweeted
As of Dec 2018, @OneLogin had a #2FA adoption rate of 52%.
xitter.cf/LaCaraB/status/1073652…
What is the 2FA adoption rate of your service/site?
Let me know and I'll add it to the public list of 2FA Stats: allthingsauth.com/2fastats
#infosec @LaCaraB
PasswordResearch.com retweeted
Blocking email as username login would be efficient to prevent credential stuffing / password spraying for: – at Mons, Norway
51%No effect
27%A few weeks
12%A few months
11%Years
180 votes • Final results PasswordResearch.com retweeted
Just blogged: Enhancing Pwned Passwords Privacy with Padding troy.hn/2Tn0z9T
PasswordResearch.com retweeted
Time to submit for the #Ground1234 (#PasswordsCon) track people!
I'll get back to some specific topics I'd like to see covered this year, but "Is 2FA worth it?" from a user/business perspective is one of them, & if you have deployed NIST SP800-63B we want to hear from you!
The #BSidesLV CFP is now officially open! The possibilities are endless, as there are several tracks covering dozens of topics for you to talk about.
Got something to teach or share? You have until April 15 to submit your talk or training idea to: cfp.bsideslv.org
PasswordResearch.com retweeted
#infosec #acadmictwitter
Is anyone aware of any academic or industry literature that audits the security of TOTP #2FA app, like Authy, Microsoft Authenticator, LastPass Authenticator, Duo Mobile, etc?
PasswordResearch.com retweeted
We’ve published an explainer about an idea to harden SMS-delivered one-time passwords by allowing senders to associate the codes with a website. We’ve been talking about the idea with some folks at Google, and would like more feedback. github.com/WebKit/explainers…
PasswordResearch.com retweeted
What’s the more secure option of these? also interested in the motivation*
*I know there are much better options but that’s not what I’m asking for.
Retweets appreciated
#Infosec
22%Pw 123456 + sms based 2fa
20%Pw kL82&;905:4
14%Pw 123456 + mail 2fa
44%Show results
4,301 votes • Final results PasswordResearch.com retweeted
"SIM swap" attacks have been in the news for years. They’ve enabled serious financial crimes and even a hack of the Twitter CEO's account. We spent 6 months researching how vulnerable wireless accounts are to these attacks. Our draft study is out today. issms2fasecure.com/
PasswordResearch.com retweeted
Our paper on harmful effects of mandatory implementation of #authentication tech without proper risk comm is out:
Have a read: ssrn.com/abstract=3509526
#hacs2019 #humanfactors #usableprivacysecurity
#mfa #2fa #CyberSecurity #Passwords @ljean @IUSPICE @JoshuaDStreiff @shrirangmare
PasswordResearch.com retweeted
Poll: Should random passphrase generators avoid NSFW words?
7%No preference or Other
14%Yes
49%No
30%Optionally
183 votes • Final results PasswordResearch.com retweeted
In 2019, we saw phishing attacks reach new levels of creativity and sophistication. Read about the most notable phishing techniques we spotted in the past year: msft.it/6019TV7LB
PasswordResearch.com retweeted
Dear crypto Twitter, I'm diving into formal models for PAKEs. All of the papers I'm aware of choose the password by uniformly and independently from some finite "dictionary" of passwords (as in BPR00). Anyone aware of a paper that models password selection differently?
PasswordResearch.com retweeted
#PasswordsCon 2019 livestream day 1 @internetdagarna in Stockholm will be here: youtu.be/GK17BvaMAb4
(If I have configured things properly.... :-))
Paper: "Get a Free Item Pack with Every Activation!" -- Do Incentives Increase the Adoption Rates of Two-Factor Authentication? arxiv.org/abs/1910.07269
Reddit shared 6 months of data on the number of leaked credentials from third party breaches they compared against their own users (over 6 billion) along with how many accounts they protected due to matches (over 9 million). reddit.com/r/redditsecurity/…
