IDENTITY AND AUTHENTICATION Chad Spensky Allthenticate WHO AM I? - - PowerPoint PPT Presentation

identity and authentication
SMART_READER_LITE
LIVE PREVIEW

IDENTITY AND AUTHENTICATION Chad Spensky Allthenticate WHO AM I? - - PowerPoint PPT Presentation

IDENTITY AND AUTHENTICATION Chad Spensky Allthenticate WHO AM I? WHO AM I? Chad Spensky (Professional) Ph.D. Student Computer Security Researcher Founder of Allthenticate WHO AM I? Chad Spensky (Social) Beach Volleyball


slide-1
SLIDE 1

IDENTITY AND AUTHENTICATION

Chad Spensky Allthenticate

slide-2
SLIDE 2

WHO AM I?

slide-3
SLIDE 3

WHO AM I?

  • Chad Spensky (Professional)
  • Ph.D. Student
  • Computer Security Researcher
  • Founder of Allthenticate
slide-4
SLIDE 4

WHO AM I?

  • Chad Spensky (Social)
  • Beach Volleyball Player
  • Country Music Enthusiast
  • Fried Chicken Connoisseur
slide-5
SLIDE 5

WHO AM I?

  • Shortman (Online)
  • Hacker
  • CTF Player
  • You?
slide-6
SLIDE 6

THE PROBLEM

I should have access to some things, and not others

slide-7
SLIDE 7

THE PROBLEM

My Bank Account Your Bank Account

slide-8
SLIDE 8

THE PROBLEM

Your E-mail My E-mail

slide-9
SLIDE 9

THE PROBLEM

Your House

slide-10
SLIDE 10

AUTHENTICATION

Convincing a digital entity that I am me

slide-11
SLIDE 11

AUTHENTICATION

Convincing a digital entity that I am me authorized

slide-12
SLIDE 12

AUTHENTICATION

Only permitting authorized users to access a resource

Chad

slide-13
SLIDE 13

AUTHENTICATION

Real World Digital World

slide-14
SLIDE 14

AUTHENTICATION

  • What you know
  • What you have
  • What you are
slide-15
SLIDE 15

WHAT YOU KNOW

******* A Secret Personal Details

slide-16
SLIDE 16

WHAT YOU HAVE

slide-17
SLIDE 17

WHAT YOU ARE

slide-18
SLIDE 18

THE GOOD

  • Know: Always with you
  • Have: No mental burden
  • Are: Just be yourself
slide-19
SLIDE 19

THE BAD

  • Know:

You must remember it. always.

  • Have:

You must always have it.

  • Are: What if you temporarily change? (e.g., cold or injury)
slide-20
SLIDE 20

THE UGLY

  • Know:

You must be better than a computer.

  • Have: What if it gets stolen?
  • Are:

You can never share or revoke who you are.

slide-21
SLIDE 21

PASSWORDS

1990s

******* ******* *******

slide-22
SLIDE 22

PASSWORDS

1990s

chad1 ******* *******

slide-23
SLIDE 23

PASSWORDS

1990s

chad1 chad86 *******

slide-24
SLIDE 24

PASSWORDS

1990s

chad1 chad86 NotChad!

slide-25
SLIDE 25

PASSWORDS

  • Attackers were blinding guessing or cracking offline credentials
  • Stronger passwords are harder to guess/crack

1990s

slide-26
SLIDE 26

PASSWORDS

Today

More than 15 usernames More than 150 saved passwords 3 dedicate apps cspensky@gmail.com cspensky@ucsb.edu cspensky@mit.edu chad.spensky@ll.mit.edu cspensky@unc.edu chad@allthenticate.net chad@cspensky.info cspensky@comcast.net cspensky@cs.ucsb.edu cspensky@alumni.pitt.edu cspensky@alumni.unc.edu ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* ******* *******

slide-27
SLIDE 27

PASSWORDS

  • Attackers are phishing users to steal the credential outright
  • Password strength is completely irrelevant

Today

slide-28
SLIDE 28

HARDWARE TOKENS

Employee

Second Factor Hardware Credential Portable Computer

slide-29
SLIDE 29

HARDWARE TOKENS

  • Attackers can still phish second factors
  • Most hardware credentials can be outright stolen
slide-30
SLIDE 30

BIOMETRICS

Fingerprint Voice Recognition FaceID

slide-31
SLIDE 31

BIOMETRICS

Fingerprint Voice Recognition FaceID

slide-32
SLIDE 32

BIOMETRICS

  • Easily accessible (e.g., pictures, recordings, or fingerprints)
  • Once replicated, are gone forever
slide-33
SLIDE 33

FINDING THE RIGHT FIT

Security Requirements Value of Asset

slide-34
SLIDE 34

FINDING THE RIGHT FIT

Security User Burden

slide-35
SLIDE 35

FINDING THE RIGHT FIT

Security User Burden

*******

slide-36
SLIDE 36

FINDING THE RIGHT FIT

Security Implementation Cost

slide-37
SLIDE 37

FINDING THE RIGHT FIT

Security

*******

Implementation Cost

slide-38
SLIDE 38

THE PROBLEM

There are too many options

slide-39
SLIDE 39

MORE IS NOT BETTER

More user burden More bugs More overhead

slide-40
SLIDE 40

WE NEED FLEXIBILITY

slide-41
SLIDE 41

WE NEED FLEXIBILITY

*******

slide-42
SLIDE 42

MORE SECURITY. LESS BURDEN.

chad@allthenticate.net www.allthenticate.net