CONTENTS. Professional part. Paradigm shift Virtual world real security Old rules, howto-s: good for re-thinking Passwords
|
|
|
- Richard Ball
- 5 years ago
- Views:
Transcription
1 CONTENTS Professional part Paradigm shift Virtual world real security Old rules, howto-s: good for re-thinking Passwords
2 PARADIGM
3 PARADIGM What is that, how could you describe it?
4 PARADIGM Set of generally accepted views and rules The way you think the world works In a given field In a given time period To deny them is dangerous For example: The Earth is flat De strigis, quae non sunt, nulla questio fiat PC Political Correctness
5 PARADIGM SHIFT Paradigm shift when the paradigm changes Why?
6 PARADIGM SHIFT Paradigm shift when the paradigm changes Knowledge exceeds its former limits Revolutionary new technology Book printing Steam engine Internet = digital network
7 PARADIGM SHIFT Paradigm shift when the paradigm changes Gutenberg Digital networks Internet Books, music, movies Cyber crime, cyber war
8 PARADIGM SHIFT I. Corvina codex from the library of King Matthias
9 1452, Gutenberg PARADIGM SHIFT I.
10 PARADIGM SHIFT I. One copy cca. one year, one monk 10 thousand copies few days Art Industrial process What are the consequences?
11 PARADIGM SHIFT I. Codex copying ended Books became primary tool for storing and transferring the knowledge
12 PARADIGM SHIFT II. Today the print is considered: Expensive Slow Hard to carry Copying: quality decreases (slow, expensive)
13 PARADIGM SHIFT II.
14 PARADIGM SHIFT II. Cost of copying and carrying to somewhere?
15 PARADIGM SHIFT II. Copying needs: Zero cost Zero time Quality is the same Carrying to anywhere: Zero cost Zero time
16 PARADIGM SHIFT II. Google, Ctrl-F Ván Janka
17 PARADIGM SHIFT II. Knowledge transfer has never been so easy! BUT!
18 VIRTUAL WORLD REAL SECURITY Internet has become part of everydays Amount of data increases Our dependency on data increases day by day
19 OLD RULES ARE GOOD TO RE-THINK Tivadar Földi
20 OLD RULES & HOWTO-s ARE GOOD TO RE-THINK * PASSWORDS
21 USER AUTHENTICATION METHODS
22 USER KNOWS SG. IN HIS MIND
23 USER HAS SG.
24 BIOMETRIC
25 USER AUTH METHODS Price Complexity False +/ Known incidents
26 PASSWORD RULES What makes a good password? Example? The most important rules?
27 PASSWORD RULES From the point of view of the management?
28 GOOD PASSWORD USER GENERAL POINT Must be memorable! Must NOT be guessable by others!
29 MUST BE MEMORABLE You should know
30 MUST NOT BE GUESSABLE How can you guess someone else s password????????
31 DEFAULT PASSWORDS Factory default pwds in wifi devices asdfgh, default pwds of lazy sysadmins (French bank)
32 RELATIONSHIP between person and pwd Date of birth Name of girl-/boyfriend, wife/husband Name of pet, favourite star, beer, etc. (example celebs, Obama)
33 RELATIONSHIP between username and pwd (strings) admin admin admin admin!admin, admin01
34 RELATIONSHIP between username and pwd (logical) James Bond --???
35 RELATIONSHIP between username and pwd (logical) James Bond
36 DICTIONARY ATTACK Software tries all the words from a list
37 ADVANCED DICTIONARY ATTACK Software tries all the words from a list and simple modifications Based on the known pwd structures E.g.: password password01..password99 etc.
38 BRUTE FORCE
39 BRUTE FORCE Software tries out all the possible char combinations What is the result? What is the question?
40 BRUTE FORCE Software tries out all the possible char combinations What is the result? Will find it! What is the question? How much time?
41 BRUTE FORCE Number of possible combinations?
42 BRUTE FORCE Number of possible combinations? Char set: 80, length: 8
43 BRUTE FORCE Number of possible combinations? Char set: 80, length: ~ It means:??????
44 BRUTE FORCE Number of possible combinations? Char set: 80, length: ~ It means: length makes a good pwd, not the mixed type of chars in it. Charset: limited Length: unlimited
45 BRUTE FORCE calculations in Excel/Calc Cracking speed: Jeremy Gosney 25 AMD Radeon GPUs How many tries/sec??
46 BRUTE FORCE calculations in Excel/Calc Cracking speed: Jeremy Gosney 25 AMD Radeon GPUs ~350 billion tries/sec ~ (on NTLM hashes) Do some calculations!?
47 BRUTE FORCE calculations in Excel/Calc Charset Length Cracking time 80 8? 100 8? 80 10? 80 21?
48 BRUTE FORCE calculations in Excel/Calc Charset Length Cracking time 80 8 half hour hours months years
49 BRUTE FORCE 3 hrs 4 months: no difference 3 hrs 4 billion years: THIS is a difference
50 GUESSING METHODS SUMMARY Default passwords Relationship between Person and pwd Username and pwd (as strings) Username and pwd (logical) Dictionary Advanced dictionary Brute force
51 EXPERIENCE Length is more important than the complexity of char set!
52 SHADOW PASSWORD & HASH FUNCTION
53 SHADOW PASSWORD & HASH FUNCTION MD5: crackable NTLM: ~350 billion tries per sec Bcrypt: ~ 72 thousand tries per sec
54 MISBELIEVES Pwd should contain different type of chars: Gmail Federal Trade Commission Twitter OTP (biggest bank in Hungary) (nearly everywhere)
55 MISBELIEVES Pwd generation sw by HP
56 Stanford University MISBELIEVES
57 MISBELIEVES Stanford University Could you calculate?
58 MISBELIEVES Stanford University Could you calculate? ~ 1,6* sec
59 MISBELIEVES
60 MISBELIEVES When do you change your password? Do you use the same pwd for different sites? Can you write your pwds down? Would you use a pwd management program? Is it possible to wirte down your passwords?
61 BEST PRACTICE FOR USERS Long password Don t use a common method to generate Should be memorable, e.g.: three words at least, add some extras at three postions at least.
62 BEST PRACTICE FOR USERS E.g.: Petrovic Karadjordje was born on 3 Nov Petrovic11Karadjordje1768 Dictionary attacks are languagedependent!
63 YOU MAY HAVE THE BEST PWD Shoulder surfing Hidden camera Keylogger (hw/sw) Phishing s Bad sysadmin etc
64 SYSADMINS BEST PRACTICE Blacklist of most common passwords
65 SYSADMINS BEST PRACTICE Passwords must NOT be stored not even encrypted Shadow password: strong hash function
66 SYSADMINS BEST PRACTICE salting : concatenate with a unique string before hashing (username e.g.)
67 SYSADMINS BEST PRACTICE Change only if a security incident happened (or might happen), don t make uses change them every month.
68 CONCLUSION Passwords are free of charge Will be used in the future, too If used carefully, they are very secure You must be careful not only for yourself.
69
Frontline Information Protection
Frontline Information Protection a presentation to the Phoenix Chapter of ISACA by Hoyt L Kesterson II October 2014 OBSERVATION Most successful attacks spring from weakly-coded web pages or compromised
Goals. Understand UNIX pw system. Understand Lamport s hash and its vulnerabilities. How it works How to attack
Last Updated: Nov 7, 2017 Goals Understand UNIX pw system How it works How to attack Understand Lamport s hash and its vulnerabilities History of UNIX passwords Originally the actual passwords were stored
Lecture 3 - Passwords and Authentication
CSE497b Introduction to Computer and Network Security - Spring 2007 - Professor Jaeger Lecture 3 - Passwords and Authentication CSE497b - Spring 2007 Introduction Computer and Network Security Professor
INTERNET SAFETY IS IMPORTANT
INTERNET SAFETY IS IMPORTANT Internet safety is not just the ability to avoid dangerous websites, scams, or hacking. It s the idea that knowledge of how the internet works is just as important as being
User Authentication. E.g., How can I tell you re you?
User Authentication E.g., How can I tell you re you? 1 The Basics Unlike real world authentication (e.g., you recognize someone s voice over the phone) computer can t recognize someone (well, not in the
Releasing the Kracken: Building and Using a GPU Password Cracker
Releasing the Kracken: Building and Using a GPU Password Cracker Jonathan Fallone About Me Jonathan Fallone Senior Pen Tester with Knowledge Consulting Group jonathan.fallone@knowledgecg.com @Shady_Wushu
What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource.
P1L4 Authentication What is Authentication? All requests for resources have to be monitored. Every request must be authenticated and authorized to use the resource. Authentication: Who are you? Prove it.
Password cracking. IN Ethical Hacking. Bruvoll & Sørby. Department of Informatics 1 / 46
Password cracking IN5290 - Ethical Hacking Bruvoll & Sørby Department of Informatics 2018 1 / 46 Agenda About passwords Cracking passwords 2 / 46 About passwords 3 / 46 Passwords as authentication Providing
Computer Security (EDA263 / DIT 641)
Computer Security (EDA263 / DIT 641) Lecture 4: Passwords Erland Jonsson Department of Computer Science and Engineering Chalmers University of Technology Sweden Bad passwords Names (own, wife, child, dog,
Lecture 3 - Passwords and Authentication
Lecture 3 - Passwords and Authentication CMPSC 443 - Spring 2012 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12 What is authentication? Reliably verifying
Authentication and passwords
Authentication and passwords Passwords The Key Idea Prover sends a password to a Verifier. The channel must be private If an attacker obtains a user s password, he can authenticate as her. Passwords must
Fundamentals of Linux Platform Security
Fundamentals of Linux Platform Security Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012 Linux Platform Security Module 2 Password Authentication Roadmap Password Authentication
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 3 User Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown User Authentication fundamental security building
Effective Password Hashing
Effective Password Hashing November 18th, 2015 Colin Keigher colin@keigher.ca ~ @afreak ~ https://afreak.ca ~ https://canary.pw Who am I? I am a Senior Security Analyst at a large Canadian company Actively
Authentication CS 4720 Mobile Application Development
Authentication Mobile Application Development System Security Human: social engineering attacks Physical: steal the server itself Network: treat your server like a 2 year old Operating System: the war
Computer Security 3e. Dieter Gollmann. Security.di.unimi.it/1516/ Chapter 4: 1
Computer Security 3e Dieter Gollmann Security.di.unimi.it/1516/ Chapter 4: 1 Chapter 4: Identification & Authentication Chapter 4: 2 Agenda User authentication Identification & authentication Passwords
Take Control of Your Passwords
Take Control of Your Passwords Joe Kissell Publisher, Take Control Books @joekissell takecontrolbooks.com The Password Problem Passwords are annoying! It s tempting to take the easy way out. There is an
Cryptographic Hash Functions. Secure Software Systems
1 Cryptographic Hash Functions 2 Cryptographic Hash Functions Input: Message of arbitrary size Output: Digest (hashed output) of fixed size Loreum ipsum Hash Function 23sdfw83x8mjyacd6 (message of arbitrary
Chapter 3: Hashing. Prof Bill Buchanan OBE
Chapter 3: Hashing Hashing Types. Hashing Methods. Salting. Collisions. LM and NTLM Hashes (Windows). Hash Benchmarks. Message Authentication Codes (MACs). OTP/HOTP. Prof Bill Buchanan OBE http://asecuritysite.com/crypto03
Password. authentication through passwords
Password authentication through passwords Human beings Short keys; possibly used to generate longer keys Dictionary attack: adversary tries more common keys (easy with a large set of users) Trojan horse
Passwords. CS 166: Introduction to Computer Systems Security. 3/1/18 Passwords J. Liebow-Feeser, B. Palazzi, R. Tamassia, CC BY-SA 2.
Passwords CS 166: Introduction to Computer Systems Security 1 Source: https://shop.spectator.co.uk/wp-content/uploads/2015/03/open-sesame.jpg 2 Password Authentication 3 What Do These Passwords Have in
Authentication SPRING 2018: GANG WANG. Slides credit: Michelle Mazurek (U-Maryland) and Blase Ur (CMU)
Authentication SPRING 2018: GANG WANG Slides credit: Michelle Mazurek (U-Maryland) and Blase Ur (CMU) Passwords, Hashes, Salt Password database Username Plaintext Password Not a good idea to store plaintext
Authentication Objectives People Authentication I
Authentication Objectives People Authentication I Dr. Shlomo Kipnis December 15, 2003 User identification (name, id, etc.) User validation (proof of identity) Resource identification (name, address, etc.)
Authentication. Steven M. Bellovin September 16,
Authentication Steven M. Bellovin September 16, 2013 1 Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to
Hashes, MACs & Passwords. Tom Chothia Computer Security Lecture 5
Hashes, MACs & Passwords Tom Chothia Computer Security Lecture 5 Today s Lecture Hashes and Message Authentication Codes Properties of Hashes and MACs CBC-MAC, MAC -> HASH (slow), SHA1, SHA2, SHA3 HASH
Authentication. Steven M. Bellovin October 1,
Authentication Steven M. Bellovin October 1, 2016 1 Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to do
The LinkedIn Hack: Understanding Why It Was So Easy to Crack the Passwords
The LinkedIn Hack: Understanding Why It Was So Easy to Crack the Passwords LinkedIn was breached in 2012 with a reported 6.5 million user accounts compromised. LinkedIn sent a request to known hacked users
MODULE NO.28: Password Cracking
SUBJECT Paper No. and Title Module No. and Title Module Tag PAPER No. 16: Digital Forensics MODULE No. 28: Password Cracking FSC_P16_M28 TABLE OF CONTENTS 1. Learning Outcomes 2. Introduction 3. Nature
Why bother? Default configurations Buffer overflows Authentication mechanisms Reverse engineering Questions?
Jeroen van Beek 1 Why bother? Default configurations Buffer overflows Authentication mechanisms Reverse engineering Questions? 2 Inadequate OS and application security: Data abuse Stolen information Bandwidth
Authentication. Steven M. Bellovin January 31,
Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to do Identification is whom you claim to be be Authentication
Attacks Against Websites 3 The OWASP Top 10. Tom Chothia Computer Security, Lecture 14
Attacks Against Websites 3 The OWASP Top 10 Tom Chothia Computer Security, Lecture 14 OWASP top 10. The Open Web Application Security Project Open public effort to improve web security: Many useful documents.
Welcome. ScrogginsGrear clients. to Cybersecurity Education Series. Password Management & Public Wi-Fi Security
Welcome ScrogginsGrear clients to Cybersecurity Education Series Password Management & Public Wi-Fi Security Presenter: Ray Cool, CEO PBSI Technology Solutions Webinar will begin at 1:00 Welcome ScrogginsGrear
Hands-On Network Security: Practical Tools & Methods. Hands-On Network Security. Roadmap. Security Training Course
Hands-On Network Security: Practical Tools & Methods Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012 Hands-On Network Security Module 4 Password Strength & Cracking Roadmap
Hands-On Network Security: Practical Tools & Methods
Hands-On Network Security: Practical Tools & Methods Security Training Course Dr. Charles J. Antonelli The University of Michigan 2012 Hands-On Network Security Module 4 Password Strength & Cracking Roadmap
Authentication KAMI VANIEA 1
Authentication KAMI VANIEA FEBRUARY 1ST KAMI VANIEA 1 First, the news KAMI VANIEA 2 Today Basics of authentication Something you know passwords Something you have Something you are KAMI VANIEA 3 Most recommended
Passwords and Equivalent Strength the loophole in the DSS
Passwords and Equivalent Strength the loophole in the DSS NORTH AMERICA COMMUNITY MEETING VANCOUVER 29 SEPTEMBER 1 OCTOBER 2015 Hoyt L Kesterson II Senior Security Architect Terra Verde The Wisdom of Dexter
PYTHIA SERVICE BY VIRGIL SECURITY WHITE PAPER
PYTHIA SERVICE WHITEPAPER BY VIRGIL SECURITY WHITE PAPER May 21, 2018 CONTENTS Introduction 2 How does Pythia solve these problems? 3 Are there any other solutions? 4 What is Pythia? 4 How does it work?
CSCE 548 Building Secure Software Entity Authentication. Professor Lisa Luo Spring 2018
CSCE 548 Building Secure Software Entity Authentication Professor Lisa Luo Spring 2018 Previous Class Important Applications of Crypto User Authentication verify the identity based on something you know
Computer Security & Privacy
Computer Security & Privacy Melissa Winstanley (mwinst@cs.washington.edu) (based on slides by Daniel Halperin) How exploration sessions work You get 1/3 point of extra credit for each session Attendance
Lecture 14 Passwords and Authentication
Lecture 14 Passwords and Authentication Stephen Checkoway University of Illinois at Chicago CS 487 Fall 2017 Slides based on Bailey s ECE 422 Major Portions Courtesy Ryan Cunningham AUTHENTICATION Authentication
CSE509 System Security
CSE509 System Security Authentication Nick Nikiforakis nick@cs.stonybrook.edu Controlling access One of the things that makes security hard is that we want fine-grained access to systems, networks, and
Network Security Fundamentals
Network Security Fundamentals Security Training Course Dr. Charles J. Antonelli The University of Michigan 2013 Network Security Fundamentals Module 4 Password Strength & Cracking Roadmap Password Authentication
Passwords. EJ Jung. slide 1
Passwords EJ Jung slide 1 Basic Problem? How do you prove to someone that you are who you claim to be? Any system with access control must solve this problem slide 2 Many Ways to Prove Who You Are What
Information Security CS 526
Information Security CS 526 Topic 7: User Authentication CS526 Topic 7: User Authentication 1 Readings for This Lecture Wikipedia Password Password strength Salt_(cryptography) Password cracking Trusted
Introduction to Information Security Prof. V. Kamakoti Department of Computer Science and Engineering Indian Institute of Technology, Madras
Introduction to Information Security Prof. V. Kamakoti Department of Computer Science and Engineering Indian Institute of Technology, Madras Lecture 09 Now, we discuss about the insecurity of passwords.
Lecture 9 User Authentication
Lecture 9 User Authentication RFC 4949 RFC 4949 defines user authentication as: The process of verifying an identity claimed by or for a system entity. Authentication Process Fundamental building block
Computer Security 3/20/18
Authentication Identification: who are you? Authentication: prove it Computer Security 08. Authentication Authorization: you can do it Protocols such as Kerberos combine all three Paul Krzyzanowski Rutgers
Computer Security. 08. Authentication. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 08. Authentication Paul Krzyzanowski Rutgers University Spring 2018 1 Authentication Identification: who are you? Authentication: prove it Authorization: you can do it Protocols such
Computer Security 4/12/19
Authentication Computer Security 09. Authentication Identification: who are you? Authentication: prove it Authorization: you can do it Paul Krzyzanowski Protocols such as Kerberos combine all three Rutgers
COMPUTER NETWORK SECURITY
COMPUTER NETWORK SECURITY Prof. Dr. Hasan Hüseyin BALIK (3 rd Week) 3. User Authentication 3.Outline Electronic User Authentication Principles Password-Based Authentication Token-Based Authentication Biometric
TABLE OF CONTENTS. Lakehead University Password Maintenance Standard Operating Procedure
TABLE OF CONTENTS 1.0 General Statement... 3 2.0 Purpose... 3 3.0 Scope... 3 4.0 Procedure... 3 4.1 General... 3 4.2 Requirements... 4 4.3 Guidelines... 4 5.0 Failure to comply... 6 2 1.0 GENERAL STATEMENT
Information Security in Systems and Networks
Information Security in Systems and Networks November 30, 2006 Damira Pon University at Albany, SUNY 1 Password Protection 2 Passwords Everywhere the Eye can See 3 Passwords Basic Problem How do you prove
14 - Authentication in Practice
14 - Authentication in Practice Engineering & Public Policy Lorrie Cranor, Blase Ur, and Rich Shay February 26, 2015 05-436 / 05-836 / 08-534 / 08-734 Usable Privacy and Security # Today s class Biometrics
Authentication. Strong Password Protocol. IT352 Network Security Najwa AlGhamdi
Authentication Strong Password Protocol 1 Strong Password Protocol Scenario : Alice uses any workstation to log to the server B, using a password to authenticate her self. Various way to do that? Use Ur
Password & Tutorials Packet
& Tutorials Packet Print, staple, and use this & Tutorials Packet Sign up for Secure Backup Service: visit rowleyservices.com for a free trial & setup info Follow attached: Check iphone Camera Settings
Authentication. Steven M. Bellovin September 26,
Authentication Steven M. Bellovin September 26, 2009 1 Authentication Another trilogy: identification, authentication, authorization ACLs and the like are forms of authorization: what you re allowed to
User Authentication and Passwords
User Authentication and : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 31 October 2012 Y12S2L11, Steve/Courses/2012/s2/css322/lectures/passwords.tex,
A SIMPLE STEP-BY-STEP GUIDE FOR COMPUTER BEGINNERS
A SIMPLE STEP-BY-STEP GUIDE FOR COMPUTER BEGINNERS EXPLORING THE INTERNET through HOBBIES AND INTERESTS. LEARN HOW TO KEEP IN TOUCH WITH FRIENDS AND FAMILY USING THE INTERNET In these busy times it s easy
COMPUTING FUNDAMENTALS I
FALL 2017 / COMPUTER SCIENCE 105 COMPUTING FUNDAMENTALS I DAY 2 27 SEPTEMBER 2017 COURSE ADMIN COURSE ADMIN NOTECARDS - ATTENDANCE & FEEDBACK Name Student ID One of: What did you learn or find most interesting?
Chapter 1 Computers and Digital Basics
Chapter 1 Computers and Digital Basics Computer Concepts 2014 1 Chapter Contents Section A: All Things Digital Section B: Digital Devices Section C: Digital Data Representation Section D: Digital Processing
Chapter 1 Computers and Digital Basics. Computer Concepts 2013
Chapter 1 Computers and Digital Basics Computer Concepts 2013 1 Chapter Contents Section A: All Things Digital Section B: Digital Devices Section C: Digital Data Representation Section D: Digital Processing
18-642: Security Mitigation & Validation
18-642: Security Mitigation & Validation 11/27/2017 Security Migitation & Validation Anti-Patterns for security mitigation & validation Poorly considered password policy Poorly considered privilege management
Assistance with University Projects? Research Reports? Writing Skills? We ve got you covered! www.assignmentstudio.net WhatsApp: +61-424-295050 Toll Free: 1-800-794-425 Email: contact@assignmentstudio.net
Best Practices for Mobile
Email Best Practices for Mobile Welcome to a Fishbowl Best Practices Webinar Hosted by: Liz Friscino Online Marketing Consultant Agenda Why Mobile Best Practices for Email Design Integrating Mobile into
I made a 5 minute introductory video screencast. Go ahead and watch it. Copyright(c) 2011 by Steven Shank
Introduction to KeePass What is KeePass? KeePass is a safe place for all your usernames, passwords, software licenses, confirmations from vendors and even credit card information. Why Use a Password Safe?
Create strong passwords
Create strong passwords Passwords are the first line of defense against break-ins to your online accounts and computer, tablet, or phone. Poorly chosen passwords can render your information vulnerable
Internet and Mini.K.G Senior Scientist, FRAD, CMFRI
Internet and E-Mail Mini.K.G Senior Scientist, FRAD, CMFRI Email: mini.anish02@gmail.com 28 Introduction to Internet Internet is a worldwide system of interconnected computer networks. It connects several
Jérôme Kerviel. Dang Thanh Binh
Dang Thanh Binh Jérôme Kerviel Rogue trader, lost 4.9 billion Largest fraud in banking history at that time Worked in the compliance department of a French bank Defeated security at his bank by concealing
Berner Fachhochschule Haute cole spcialise bernoise Berne University of Applied Sciences 2
Table of Contents Hacking Web Sites Broken Authentication Emmanuel Benoist Spring Term 2018 Introduction Examples of Attacks Brute Force Session Spotting Replay Attack Session Fixation Attack Session Hijacking
Overview. Terminology. Password Storage
Class: CSG254 Network Security Team: Enigma (team 2) Kevin Kingsbury Tejas Parikh Tony Ryan Shenghan Zhang Assignment: PS3 Secure IM system Overview Our system uses a server to store the passwords, and
How does your password measure up? The effect of strength meters on password creation
How does your password measure up? The effect of strength meters on password creation Blase Ur, Patrick Gage Kelley, Saranga Komanduri, Joel Lee, Michael Maass, Michelle L. Mazurek, Timothy Passaro, Richard
Backend IV: Authentication, Authorization and Sanitization. Tuesday, January 13, 15
6.148 Backend IV: Authentication, Authorization and Sanitization The Internet is a scary place Security is a big deal! TODAY What is security? How will we try to break your site? Authentication,
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A. Authentication
T H E U N I V E R S I T Y O F B R I T I S H C O L U M B I A Authentication What is Authentication? Real-world and computer world examples? What is a result of authentication? What are the means for in
Undergraduate programme in Computer sciences
What is authentication? Security Engineering MSc in Computer Science EIT Master on Security and Privacy Lecture 12 Authentication Massacci Fabio It is the process of verifying a claimed identity by r for
KeePass - to improve your process
KeePass - to improve your process Before proceeding with the article, please take this quick password safety test. Password Safety Test Score one point for every YES answer.: Scoring: 1. Do you write your
How To Change My Wordpress Database
How To Change My Wordpress Database Password On Instagram Account Built by one of the world's largest Instagram browsers INK361, this comprehensive widget that can showcase your Instagram account in the
Strong Password Protocols
Strong Password Protocols Strong Password Protocols Password authentication over a network Transmit password in the clear. Open to password sniffing. Open to impersonation of server. Do Diffie-Hellman
Passwords CSC 193 WAKE FOREST. U N I V E R S I T Y Department of Computer Science. Spring 2014
Passwords CSC 193 WAKE FOREST U N I V E R S I T Y Department of Computer Science Spring 2014 Unix Passwords In Unix, users are identified by user names Authenticated by passwords Therefore to login as
CIT 380: Securing Computer Systems
CIT 380: Securing Computer Systems Passwords CIT 380: Securing Computer Systems Slide #1 Topics 1. Password Systems 2. Password Cracking 3. Hashing and Salting 4. UNIX Password Systems 5. Windows Password
Topics. Authentication System. Passwords
Passwords Topics 1. Password Systems 2. Password Attacks 3. Mitigating Attacks 4. Graphical passwords 5. One-time passwords Authentication System A: set of authentication information information used by
Authentication Using Grid-Based Authentication Scheme and Graphical Password
Authentication Using Grid-Based Authentication Scheme and Graphical Password Vijayshri D. Vaidya 1 Department of Computer engineering SND COE & RC Yeola, India Imaran R. Shaikh 2 Department of Computer
Cross-site request forgery Cross-site scripting Man-in-the-browser Session hijacking Malware Man-in-the-middle DNS cache poisoning DNS spoofing DNS hijacking Dictionary attacks DDoS DDoS Eavesdropping
Homework 2: Symmetric Crypto Due at 11:59PM on Monday Feb 23, 2015 as a PDF via websubmit.
Homework 2: Symmetric Crypto February 17, 2015 Submission policy. information: This assignment MUST be submitted as a PDF via websubmit and MUST include the following 1. List of collaborators 2. List of
Client-side Defenses for Context-Aware Phishing and Transaction Generator Spyware
Client-side Defenses for Context-Aware Phishing and Transaction Generator Spyware Collin Jackson Dan Boneh John Mitchell Stanford University Web Threats Phishing Spoof website convinces user to log in
CS 161 Computer Security
Popa & Weaver Fall 2016 CS 161 Computer Security 10/4 Passwords 1 Passwords are widely used for authentication, especially on the web. What practices should be used to make passwords as secure as possible?
Security Awareness. Chapter 2 Personal Security
Security Awareness Chapter 2 Personal Security Objectives After completing this chapter, you should be able to do the following: Define what makes a weak password Describe the attacks against passwords
ID protocols. Overview. Dan Boneh
ID protocols Overview The Setup sk Alg. G vk vk either public or secret User P (prover) Server V (verifier) no key exchange yes/no Applications: physical world Physical locks: (friend-or-foe) Wireless
Information Security CS 526
Information Security CS 526 Topic 7: User Authentication CS526 Topic 7: User Authentication 1 Readings for This Lecture Wikipedia Password Password strength Salt_(cryptography) Password cracking Trusted
Operating Systems Security: User Authentication
The Internet Dog Operating Systems Security: User Authentication Ozalp Babaoglu ALMA MATER STUDIORUM UNIVERSITA DI BOLOGNA The New Yorker, 5 July 1993!2 Introduction User Authentication When you first
OpenSSL Hacks Anthony J. Stieber Abstract OpenSSL contains a command-line tool to do nearly everything possible within the OpenSSL library. Even better, it's probably already installed on your system.
BTEC Level 3. Unit 32 Network System Security Password Authentication and Protection. Level 3 Unit 32 Network System Security
BTEC Level 3 Unit 32 Network System Security Password Authentication and Protection Passwords Why are they important? Passwords are cheap to deploy, but also act as the first line of defense in a security
Attacking Your Two-Factor Authentication (PS: Use Two-Factor Authentication)
Attacking Your Two-Factor Authentication (PS: Use Two-Factor Authentication) 08 Jun 2017 K-LUG Technical Meeting Rochester, MN Presented by: Vi Grey Independent Security Researcher https://vigrey.com Who
CSE 484 / CSE M 584: Computer Security and Privacy. Web Security. Autumn Tadayoshi (Yoshi) Kohno
CSE 484 / CSE M 584: Computer Security and Privacy Web Security Autumn 2018 Tadayoshi (Yoshi) Kohno yoshi@cs.washington.edu Thanks to Dan Boneh, Dieter Gollmann, Dan Halperin, Ada Lerner, John Manferdelli,
Why Your Business Needs Enterprise-Strength Password Management
Why Your Business Needs Enterprise-Strength Password Management White Paper 2017 The Emergence of the Password and Hacking Secret Keys For over a half a century, the password, a secret sequence of characters
COMP 250. Lecture 27. hashing. Nov. 10, 2017
COMP 250 Lecture 27 hashing Nov. 10, 2017 1 RECALL Map keys (type K) values (type V) Each (key, value) pairs is an entry. For each key, there is at most one value. 2 RECALL Special Case keys are unique
COMPUTER PASSWORDS POLICY
COMPUTER PASSWORDS POLICY 1.0 PURPOSE This policy describes the requirements for acceptable password selection and maintenance to maximize security of the password and minimize its misuse or theft. Passwords
OS Security. Authentication. Radboud University Nijmegen, The Netherlands. Winter 2014/2015
OS Security Authentication Radboud University Nijmegen, The Netherlands Winter 2014/2015 What does an OS do? Definition An operating system (OS) is a computer program that manages access of processes (programs)
Hashes, MACs & Passwords. Tom Chothia Computer Security Lecture 5
Hashes, MACs & Passwords Tom Chothia Computer Security Lecture 5 Today s Lecture Hash functions: Generates a unique short code from a large file Uses of hashes MD5, SHA1, SHA2, SHA3 Message Authentication
CSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 9: Authentication Department of Computer Science and Engineering University at Buffalo 1 Lecture Outline Definition of entity authentication Solutions password-based
PASSWORD POLICIES: RECENT DEVELOPMENTS AND POSSIBLE APPRAISE
PASSWORD POLICIES: RECENT DEVELOPMENTS AND POSSIBLE APPRAISE Hazel Murray Department of Mathematics and Statistics/ Hamilton Institute, Maynooth University, Ireland David Malone Department of Mathematics