OWASP released v4.0 of the Application Security Verification Standard (ASVS) in March, listing security practices for orgs to design, code, and test apps against. https://t.co/E5oqj7BaYx There was substantial content change in the authentication section, so I'll comment on it.
@_BSidesKC Thank you to the organizers, speakers, and volunteers for putting on the con! Nice to see the local community gather to share, learn, and have some fun.
@spazef0rze I haven't done much lately to keep it updated, but certainly have logged a lot of hours trying to gather good info in the past. Thanks for the recognition!
Virtual #PasswordsCon CFP is live:
https://t.co/v8TCU4gl2S
Please submit NOW!
Streaming on November 23-24. Pre-recorded or live talks, with live Q&A sessions.
(please RT!)
Drop by the Authentication (1120-1220pm PDT) session at @IEEESSP to check out @Philipp_Markert speaking about our work on the security of 4- and 6-digit PINs. Q&A to follow the talk, and you can also find out more on our project web-page https://t.co/ExaBz96fIF
"Study found little benefit to 6-digit PINs as compared to 4-digit PINs. Participants tended to select more-easily guessed 6-digit PINs when considering the first 40 guesses of an attacker. Current PIN blacklists ineffective" @Philipp_Markert et al. 👏 https://t.co/EiCZfk3vzo
As of Dec 2018, @OneLogin had a #2FA adoption rate of 52%.
https://t.co/u3KHyvw87K
What is the 2FA adoption rate of your service/site?
Let me know and I'll add it to the public list of 2FA Stats: https://t.co/FNIKPkD3pI
#infosec@LaCaraB
Time to submit for the #Ground1234 (#PasswordsCon) track people!
I'll get back to some specific topics I'd like to see covered this year, but "Is 2FA worth it?" from a user/business perspective is one of them, & if you have deployed NIST SP800-63B we want to hear from you!
#infosec#acadmictwitter
Is anyone aware of any academic or industry literature that audits the security of TOTP #2FA app, like Authy, Microsoft Authenticator, LastPass Authenticator, Duo Mobile, etc?
We’ve published an explainer about an idea to harden SMS-delivered one-time passwords by allowing senders to associate the codes with a website. We’ve been talking about the idea with some folks at Google, and would like more feedback. https://t.co/kc9fzsGo7m
What’s the more secure option of these? also interested in the motivation*
*I know there are much better options but that’s not what I’m asking for.
Retweets appreciated
#Infosec