PasswordResearch.com

Archive of authentication and password security news gathered by Bruce K. Marshall. See or new updates on

[PasswordResearch.com @PwdRsch]

OWASP released v4.0 of the Application Security Verification Standard (ASVS) in March, listing security practices for orgs to design, code, and test apps against. https://t.co/E5oqj7BaYx There was substantial content change in the authentication section, so I'll comment on it.

[PasswordResearch.com @PwdRsch]

@_BSidesKC Thank you to the organizers, speakers, and volunteers for putting on the con! Nice to see the local community gather to share, learn, and have some fun.

[PasswordResearch.com @PwdRsch]

@spazef0rze I haven't done much lately to keep it updated, but certainly have logged a lot of hours trying to gather good info in the past. Thanks for the recognition!

[PasswordResearch.com @PwdRsch]

@jwerre I do in occasion. What are you looking for?

[PasswordResearch.com @PwdRsch]

@TychoTithonus @m33x @pdo Glad you remembered, because I didn't see this.

[Per Thorsheim @thorsheim]

Virtual #PasswordsCon CFP is live:
https://t.co/v8TCU4gl2S
Please submit NOW!

Streaming on November 23-24. Pre-recorded or live talks, with live Q&A sessions.

(please RT!)

[PasswordResearch.com @PwdRsch]

@Baybe_Doll @jmgosney Sometimes you can block those with CATCHAs.

[PasswordResearch.com @PwdRsch]

@Hydraze @thorsheim @m33x There are definitely more papers analyzing luds style policies, but hopefully that gets you started.

[PasswordResearch.com @PwdRsch]

@Hydraze @thorsheim @m33x Of passwords and people: measuring the effect of password-composition policies https://t.co/BmOTS1qeVj

[PasswordResearch.com @PwdRsch]

@Hydraze @thorsheim @m33x Can Long Passwords Be Secure and Usable? https://t.co/Bd8NqamxW5

[PasswordResearch.com @PwdRsch]

@Hydraze @thorsheim @m33x Here are a few I know of: Password Creation in the Presence of Blacklists https://t.co/LXb0aErOTl

[Jim Fenton 🇺🇸🇨🇦 @jimfenton]

Pre-draft call for comments just issued for #NIST SP 800-63-4 Digital Identity Guidelines. @NISTcyber https://t.co/xd24Kh1kRh

[Adam J. Aviv @adamaviv]

Drop by the Authentication (1120-1220pm PDT) session at @IEEESSP to check out @Philipp_Markert speaking about our work on the security of 4- and 6-digit PINs. Q&A to follow the talk, and you can also find out more on our project web-page https://t.co/ExaBz96fIF

[Michal Špaček @spazef0rze]

"Study found little benefit to 6-digit PINs as compared to 4-digit PINs. Participants tended to select more-easily guessed 6-digit PINs when considering the first 40 guesses of an attacker. Current PIN blacklists ineffective" @Philipp_Markert et al. 👏 https://t.co/EiCZfk3vzo

[Black Lives Matter @conorgil]

As of Dec 2018, @OneLogin had a #2FA adoption rate of 52%.

https://t.co/u3KHyvw87K

What is the 2FA adoption rate of your service/site?

Let me know and I'll add it to the public list of 2FA Stats: https://t.co/FNIKPkD3pI

#infosec @LaCaraB

[Per Thorsheim @thorsheim]

Blocking email as username login would be efficient to prevent credential stuffing / password spraying for:

[Troy Hunt @troyhunt]

Just blogged: Enhancing Pwned Passwords Privacy with Padding https://t.co/UMndtU3Wc1

[Per Thorsheim @thorsheim]

Time to submit for the #Ground1234 (#PasswordsCon) track people!

I'll get back to some specific topics I'd like to see covered this year, but "Is 2FA worth it?" from a user/business perspective is one of them, & if you have deployed NIST SP800-63B we want to hear from you!

[Black Lives Matter @conorgil]

#infosec #acadmictwitter

Is anyone aware of any academic or industry literature that audits the security of TOTP #2FA app, like Authy, Microsoft Authenticator, LastPass Authenticator, Duo Mobile, etc?

[Ricky Mondello @rmondello]

We’ve published an explainer about an idea to harden SMS-delivered one-time passwords by allowing senders to associate the codes with a website. We’ve been talking about the idea with some folks at Google, and would like more feedback. https://t.co/kc9fzsGo7m

[John Opdenakker @j_opdenakker]

What’s the more secure option of these? also interested in the motivation*

*I know there are much better options but that’s not what I’m asking for.

Retweets appreciated
#Infosec