 Alright folks, before we get started, today we're going to finish up authentication. Then we're going to have a little review time for whatever time is remaining. Before we do that though, I want to, so obviously assignment 2 is due tonight. And so we have the midterm on Tuesday, so we'll be able to talk about it then. We'll talk about it next Thursday, so in a week. So just so we can get a feel of the room, who thinks they have definitely not signed any adversarial keys. Your certificate authority is not sure. I'm sure everything's on the list. I have been sure that's on the list. Some of you feel good about it, you feel pretty confident. Are others of you not so confident because you know you've definitely identified a key that's fake, that you've signed, or because you just think you didn't verify all of them correctly. If you use your own key to sign it, so the server doesn't count your own key signing anything, so that's not counted in the signatures. We uploaded it, we're specifically looking for everyone else's public or adversarial key is the valid signature. If you sign somebody's adversarial key with your adversarial key, yeah, that would be you, definitely, because you're vouching then for their identity, right, even if it's your fake identity. You know, sometimes I feel like it's not going to be all because it wasn't your key. Yeah, why would that count? Well, because how would they know? I mean, how would you know? I would like, even when we go to signing the actual key, right? So we, I believe we talk in class like that, public, your actual key and adversarial key, for signatures on that, you shouldn't have to validate for people signing your key, which is which, right? The only need to know is this signed by a key that's used in the class, right? So you could get signed by other people's adversarial keys and that's fine with your public key. But you should never sign an anybody's adversarial key, right? That's the whole point. You don't know who an adversarial key is. That's the point. Well, the point is, when signing, you need to verify that it's actually the person's identity. But on getting signatures, you don't have to verify their identity to get a signature. If the adversary doesn't care. But you care. The point is you doing verification. The point is you verifying before signing. But why would the adversary verify? So you're basically giving someone trust. Yeah, because you're giving them trust even though it's... They're not classified as a trusted source material and it should be like a hacker or something. Yeah. But I'm a hacker too. I'm trying to break the system. Correct. You get your key signed 25 but all 20 of those signatures are adversarial keys. Does it count? Yeah, it's totally fine. It doesn't matter. So your public key, the signatures, both public or adversarial, it doesn't matter. That makes sense. But I'd sign people's stuff with your adversarial key, especially when you knew it was adversarial. Right. So you're trying to give each other trust, right? But, I mean, you could... If you wanted to make sure you had a conversation about this at the start. If you wanted to, you could all sign everyone's adversarial keys, right? If you all made like this suicide pact that was like, we'll get more and extra credit than we would get points taken away. Which is fine. I mean, that's kind of a similar thing. We take a little hit by signing each other's things, but then hopefully we'll be able to get enough other people to sign our keys that that way it actually looks legitimate, right? What if an adversary was signing everyone's key so that they looked more legitimate? That'd be a thing. That's a thing. I don't want to put their regular key as only their adversarial key. What? There's someone left? I don't want to put their adversarial key. They never actually did anything with their actual public key. If they don't get anything with their public key, they're going to get like, most 20 points, maybe? I don't know. Like, not a lot of points, right? Because that's like, literally missing the sign that everyone's key with their public key, right? That's like the entire assignment from the adversarial part to the little part. All right. Cool. All right. Let's get started. All right. So, salt. So, we talked about salt on Tuesday. What is a salt in the context that we're talking about and why did we want to use one? What did it actually give us? What is a salt? Well, you would, let's say, you know, so the attacker, when they get, let's say, a database dump or something, they have the hashes and the salt, right? But the point is, even if we have the same passwords, we have the same A values, right? Because there's different salts, the hashes will be different. So, you won't, even if you break one password, right? And say, okay, I know this person's password is password, you can't actually look through the database to find out what other ones also have the same thing as password unless they had exactly the same salt. So, why do we use... So, you use salts to defeat rainbow tables because the point of a rainbow table is you're able to pre-compute what the hash would be, but by altering what the default hash would be, you can no longer do the lookup, you have to recompute the hash with every salt, and then try to do something else. Definitely. Yeah, so, the key idea is we want to add some random value, some salt to the password before it's hashed. The salt is public and known, and it is unique, well, not unique, but it is different for each user, right? So, each, every single user has a different salt associated with their hash. And therefore, the idea is every password hash will be unique, right? So, if we have the same passwords, they won't hash to the same value because there's different salts being used. And thinking about this, when we thought in terms of our model, the idea here is this actually creates a different F function for however many, however large your hash is. So, if your hash is 2 to the 8, is that 65,000? I should have just gone with it, and you would have believed me. That's not right. What's 65,000? Sure, whatever, it was like the tenth or something like that. I don't know my powers are 2. Anyways, it doesn't matter. So, the idea is to use 8 bits, then it would be, yeah. Okay, that makes sense. 8 bits would be 256 different F functions. And as you go higher and higher, you would have more and more different F functions. So, that way, an adversary can't pre-compute. It would make it computationally infeasible and space infeasible to compute all of these different rainbow tables for all of these different F functions. One other thing when we talked about countering password guessing, so we talked about actually trying to increase the time to compute the F function, right? Because we talked about, yes, a lot of systems will actually add delay. If you log in and get an incorrect password, it will delay by half a second or something, right? But that's not quite good enough because now if somebody accesses your hatches, they can hatch as fast as their hardware can allow them to go, right? They're not constrained by any delay you put in the login function. So, the idea here is one of the actual counter-vegers is to create some kind of a slow hatch. So, to create a hatch that is purposefully slow. And usually this has a controllable work factor. So, it's actually part of the algorithm of the hatch function is having this notion of how slow do you want this to be. So, early versions of this would just take MB5 or some hatch function and would do that like a thousand times. And that would maybe take the password instead of just hatching it once. They hatched either a thousand or two thousand or four thousand or five thousand depending on the work factor. So, whatever the work factor was, that would tell you how many times to do this computation. And again, now the work factor is not a hidden value. It has to be stored for every password with the hash and the salt. So, every user should have a hash, a salt, and a work factor. But it turns out that actually just doing a hash function fast is not really good enough because adversaries can actually create dedicated so they can use FPGA boards which can calculate these things very fast. And so, that's actually not... So, what they started to do is actually create new hash functions that were deliberately designed to be slow and to be able to control how slow it is. So, BCrypt was one of the first ones designed to be slow. And you can read the details up. It has a Wikipedia page and a paper from... I don't know the exact date. It was like 99 or somewhere in like late 90s. And so, the idea was they would purposefully reuse parts, pseudo-randomly reuse parts of old computations so that that way, and I believe it's called BCrypt because it's used the blowfish encryption algorithm but made modifications to it. This is actually used on the submission server so submit, you know, all of your passwords are stored this way so if any of you actually broke into the website calculating one of these hashes on the server takes 300 milliseconds. And the server, I mean, it's an Amazon EC2 instance so it's not necessarily the fastest but at 300 milliseconds per try with unique salts per each user that's going to take you a long time to try to brute force people's passwords. There's actually a new version or a new type, kind of the latest in this area is called sCrypt and the idea is the memory usage that BCrypt forces you to use is actually fairly small so it doesn't take up a lot of memory so sCrypt was actually designed to use a lot of memory because memory, when you're building custom pieces of hardware memory is expensive, right, and fast memory is expensive but in a general purpose CPU system you can get 50 mains or 100 mains or however long it takes so the idea is sCrypt then actually forces the hashing function to use more memory. Now there's always the risk that we've talked about is somebody finds a cool shortcut that basically gets around these and actually does the hashing faster but to date these have not been known to be broken and so in that way so you have to hash them kind of the same way that the server does. Any questions on this? So this is important when you start going out there and you start developing a system and have to design a login functionality you have to think about how do we actually store passwords in our web application, in our application, in our API endpoint you should, I think actually there's pretty good general advice to just use sCrypt, like that's a good way to go I believe, yeah so anyways that's what I use, it's a good that's a good approach to say slow hashing is going to be slow, yeah What is the idea of using like you aren't using your own password system you're using someone else's password system to get access to your site would that be a better method? Possibly, it depends on your organization so we're actually talking about it later so you probably use, does anybody use a service where instead of logging into that website there's like a login with Facebook or a login with Twitter button you click on those and it goes to everybody who uses one of those something like that, that read your hands please most of you so the idea is you're essentially delegating the authentication to a third party service right saying there's a specific protocol it's called OAuth2 that allows this handshake to happen where they will go on Twitter and then Twitter will tell you back yes or no whether they're authenticated or not and there you need Twitter IDs so that you can link that up the drawbacks there are you now have a you are kind of losing your relationship with your customer depending on what information Facebook or Twitter gives you you may not even have their email address you may not have other ways to contact them so it's kind of, it's definitely a trade-off that you have to make as a business but it is important to definitely to know and for a lot of these even if you have that option very few of these will require that to be the only authentication method you can usually create an actual account on these things and then they have to deal with the password problem the passwords you have you have one main password how many, well you have to say exactly like on the order of three variations as we said but one password, three variations they may have like ten different passwords that they use that are all like really different I use a password with a different variation for your website you use the word password with different variations now you have to say that that was something I could say that even if you do, you could just tell us no and then take it yeah so what services, so what services in general do you use your passwords for? so what kind of passwords do you have just in general? I know you all have ASU passwords right? what else? laptop passwords what was that? laptop passwords your password to your physical laptop? phones phones pin code maybe finger print, other methods what else? bank well I guess I don't care about that yeah it's online banking now is so convenient that it's actually, I get really upset when I ever have to physically go into a bank like it's ridiculous like what am I doing here explaining this line to be able to do this through my phone let's say there are city public services that you need passwords for what else? it's a particularly tricky one would you use the same password for your wifi in your house that you use on your bank account? why not? you give out your wifi password to people right? one of the things social media, twitter, facebook are those important things to you? does anybody have their accounts taken over by I know somebody who had their instagram account taken over by a russian hacker but links in their bio to russian sites that were probably doing crap by downloads and stuff has anybody ever heard the stories of people will well there's a couple different variations but one thing is they'll break into somebody's social media account usually like facebook or something figure out who parents or grandparents are and then send them messages like oh my god I'm traveling so and so I'm stuck in this country I need you to wire western union me money like now so I can get out of jail or pay this bribe or whatever the story is that they come us with they only have to hack into your social media for that you can search for me and my dad and my grandfather and you can have all their family and all their spouses everything how do they contact you? they have a phone number right there oh yeah I mean if you can get it so actually this is another problem with phone calls it actually happens more with grandparents because they'll just call them like crying or whatever and then they'll get information out of them about who it is this also happens a lot on social media so yeah I mean all these things are important what are the passwords? the passwords that you use retirement accounts fidelity all of these some of you may not be thinking about that at this point you're still students but yeah investment accounts Schwab fidelity right he's going to have massive I mean what are we doing right good amounts of money in there you might have a family passphrase that you have to do if you have like a lot of things going on a what say it again family passphrase what is that? like if there's a dangerous situation you might have like a specific thing you say and you could have like a code word or something with your family so are all of these so you actually talked about it a little bit but are all of these sites all these equally important to you what's being most important? money so security email email why email? there's so many of the sites these sites we care about have email made a recent password whatever they can compromise that one and then they can search your email and find what accounts you have and probably what the usernames are and some sites will actually email you the plaintext username and password so that could be in your inbox in your multi-gigabyte Gmail archive yeah so bank accounts are a little bit trickier usually email won't give you access to a bank account it depends on the bank because some of that will require calling but the question I guess is could you impersonate could somebody impersonate you over the phone to a bank using all of the information in your email account an answer for me is definitely yes I don't know about anybody else so it's important to think about so if you use different passwords based on what's what the site is more or less important we already said we don't use the same password for our wifi that we use for our banks hopefully because we share our wifi password with people and we probably do not share our bank account password with people so if you use different passwords for different types of sites so I used to have three different passwords that are a similar kind of one was like a super easy one and other ones were more difficult variations with more special characters from that base password so I would use the super secret one the top level one for email and I should also use different bank accounts and the other ones I'd use depending on what I thought about the site so I guess the real question is how many of you use the same password in more than one place for more than one site I think I still do try not to a lot of people so are all those places where you're using a password to equally secure a new field what does that mean equally secure how the service is storing your passwords so part of it is how it's storing your password is the server as we saw is it actually using a good salted hash to store your password or is it storing it plain text some websites don't use each other some websites as we see as we'll see don't use HTTPS so they actually do submit your password in the clear so if you're on an open wifi network on a coffee shop anyway sniffing that network can see your password in the clear yeah how likely or often someone would try to hack into the server now what's the likelihood of that company getting hacked I mean it's hard to put a number on it but I think we can all agree a company with let's say 10 employees that sells clothes generally is more likely well the likely to be hacked is tricky let's say is more likely to have a security vulnerability that could allow a hacker access to it then maybe let's say Google or Facebook which have billions and rather than anyone have dedicated security teams that look at these things also the likelihood someone trying to hack it is also a lot lower correct that's why I didn't want to talk about likelihood yes the likelihood that you think Google, Facebook have much more targets right because they're much more valuable target they're probably getting tested constantly whereas this small company may not be but in the age of automated scanning hacking tools this actually doesn't really apply if you do a large scale scan of the internet for all of for a lot of different vulnerabilities so what happens if one of your passwords is leaked what happens next what's the impact let's say the simplest case in the first place somebody hacks you a website all the passwords are stored in plain text so what is also likely there in addition to your password your username your email address anything else possibly your phone number any information you give into that website could be in that leak right so you're an attacker you break into some website you get the list of all the username, passwords, email addresses what do you do next is that it? do you just profit off of that yeah so you know their email address so you see who has a Gmail address there now I have their email address their Google account so that's what they use on at least one site so if they reuse that password for their Gmail account I will log into their Gmail account and get access to their account but others are likely that they do not and the important thing is it really doesn't matter what the importance of that at first website was you could actually even if you wanted to be super malicious just create a startup or a company that just has people sign up for things and then record everyone's email and just try each of those values out in Gmail and you will definitely get some accounts get access to their email you can actually look up other websites so let's say basically oh I forgot my email okay we'll send email excuse me I forgot my password we'll send the password reset to your email as long as you're sitting on that email account at the time do the password reset and delete the email so they don't see it to be in their email like actually logged in all you need to do is get in once and typically what they'll do is add a filter that will silently redirect all incoming email to their another email account that they control so then they've logged out they only ever logged in once and now that's good because now they have access to all of your new emails which can get all those emails that they wanted to do recon on you they could then try to do iMapper pop to try to pull down all of your old emails and so what's the enabling what's the problem here why does that cannot happen likely to succeed yeah because it's the title of the slide we reuse passwords we literally use passwords so you gotta think about we talk about threats we talk about threat modeling I don't think one thing we've touched on quite yet is the tax surface so could we talk about that so we use kind of our go back to our old house analogy let's say 10 storey huge house has a lot of different ways that an attacker could get into it because there's a lot of windows a lot of doors, a lot of different entry points so the tax service there is really large whereas let's say a house that's like underground with only one elevator entrance in and out the tax service there would be a lot smaller to most threats because there's only one point of entry and progress so the attack surface there is a lot smaller so the idea is every place you reuse a password on a website or any service you're now increasing the attack surface of any of that so think of it as a union a set union if any of those websites gets compromised you can kind of consider that all of them will get compromised so now rather than just ensuring that your data is safe on one website you have to worry about every time this password is reused across multiple websites that could potentially be a huge security problem but do we need to worry about this or are passwords ever leaked? 2013 it actually just came out who first tried to say there was only quote quote 1.25 billion 1.25 billion accounts that were leaked then it turned out this year that they actually were incorrect 3.5 billion Yahoo accounts that were stolen and leaked so these are definitely email addresses I don't know the specifics of all of these about how the passwords were hashed or what they were hashed with I think in this case it was pretty bad in 2016 402 million adult friend finder accounts were and released and I'll assume that you're not familiar with this so this is a network of sites where the purpose is to find partners to commit adultery with was the purpose of these sites so what would you do with this if you're an attacker blackmail which happened actually a lot you could use the names and the email addresses find information about people like we saw then you could blackmail them see if they had spouses or were married if you find that information out and blackmail them and say you're going to tell their spouse they pay up and this actually happened a lot from the results of this leak Adobe had 152 million accounts released ebay had 145 million released this happens constantly all the time your password is if you were using these sites at these around these points your passwords were probably out there and if your password is something that could be group force and found then it was probably found in your password I understand that Adobe hack part of the problem is they actually put username and password next to each other and their actual data tables you actually in which one in the Adobe hack so where they store the password the username and password are right next to each other so basically if they got the table they got everything so actually look at this so the Adobe breach there's just one case study to illustrate how bad this problem is and Adobe actually released a statement saying that hey this is not you know it's a big deal obviously but it's not that big of a deal because we encrypted the passwords did you feel safe for that news or unsafe unsafe why they just said that encryption is right next to you yeah so why why should you how do they encrypt it how did they encrypt it why didn't they say they salted and hashed it like normal people and tell you exactly which hash function they used because that's what a good security person would say is the password or salted and hashed with a leading edge hash function and so we think obviously it's a big deal but we don't think people with strong secure passwords probably don't have a lot to worry about so Adobe said that they encrypted it I don't think I have the details here it turns out they were using like triple desks to encrypt it with a key that was not leaked so the key itself was not leaked but what's another thing so we talked about what things are in that you give to a website so you have your ID, your username your email address, your hashed password what else do you give to websites so what's another way what's another way when you forget your password that they give you access to the account phone number possibly what's that what's a security question yeah what's the concept of a security question right so it's another piece of information so when you create an account they ask you these questions like what's your what was your dog growing up what sports teams do you like which in theory are things that only you you gave to the website and you initially created an account just like the password but they don't ask you for those information every time they only ask you for the password and if you say ah I forgot my password they'll say okay then tell us prove that it's you the same person that initially created this account tell us your dog's name tell us whatever other information that they have asked you these in general I guess we're what we're talking about now they're in general incredibly poor wife so not unique what else a lot of the questions answered a lot of the questions answered by looking at facebook so if I want to get into your specific account I can either just get you to friend a random fake facebook account that I created or I can try to hack into and break the passwords of any of your friends on facebook to get access to their account to then be able to look at all your information or maybe make all that information public that's definitely another one so what about so the password reset so how would you actually implement that if you were writing that so we talk about how to do passwords right how about hatching, salting what are these security questions often people store this in plain text they don't actually hatch it which it seems like a crazy thing but the security perspective it makes slightly more sense when you think sometimes when you use these you're going to a person so the person wants to verify that you know basically what's in there not necessarily exactly what's in there so a human could do that what about does do anybody using windows 10 what information did it ask you when you created an account password country did you supply a password hint I can't remember what windows 10 does that I believe so so you could write a message that will show up whenever you enter your password incorrect so Adobe had this and those password hints were stored in the same table as the user ID, the username, the hash password and the email address can you probably guess what this person's password is from that password hint can anybody read that it says try colon space qwerty123 and that's a terrible password already b, putting that in the password hint it's not actually a hint it's just giving you a password and it's stored in plain text so the people and I've included a link below that I took you can just run, they actually have a nice in-depth analysis of this dump and so the password dump so you can look through that for all the technical details the idea is so they looked at the password they saw it as base64 encoded base64 decoded all the passwords and then put the hash values and so what they looked at they wanted to try to figure out how was this being done so they looked at the password data and they looked at the password hint and they saw that they were all at least I don't know how many let's say 32 bytes I actually don't know so based on this so a do you think that it's hash based on this no why not different sizes right so if they were hashed they'd all be exactly the same length and they did this by using an Instagram and seeing that the password length how many of the password data size and you can see they all had roughly 8 to 16 so they did some digging they figured out it was using D triple desks which is desks three times like we didn't go into this it's not really I'd say because it's not really used anymore but clearly that's not necessarily the case so the idea is then they wanted to actually try to see okay these look like they're encrypted right but how are they encrypted so one of the different types of ways we can actually use encryption different modes that we started studying it is this like I don't know the exact terms that refer to where you encrypt everything every value encrypts to the same thing as opposed to feeding your encryption back in on itself so that yes so ECB versus CBC so ECB mode so A if this was CBC mode there need to be an initialization vector block so you would have no one block elements so that's a first sign that it's not the second sign is you would look and see how many of these blocks are duplicated right because duplicate blocks would mean that they are the same password hashing of the same value which is exactly what they did so they looked at and found that this block was used in 1.6% of passwords which seems like a small percentage except when you realize it's 143 million or how many million right so 1% of that is still a million people that's crazy right and then they were they what they did they actually use previous data so they use a password breach that I didn't talk about because it was smaller and we focused on the top ones so gocker media was leaked and I don't know if it was plain text or not but they were able to get of the 180,000 passwords that were released they were able to identify the top 8 well 6 most used passwords 1, 2, 3, 4, 5, 6 password 1, 2, 3, 5, 6, 7, 8 which is funny because 1, 2, 3, 5, 6, 7 is not on here so Y is up to 8 more life hack is one that so life hacker or life hack is one of the blogs so that's probably why that password was used so they basically use this as kind of a base to think okay we can think that those are the passwords and remember now this is something they can't they don't necessarily have the DES key that was used to actually encrypt all these things so they don't have that key so they can't just brute force things but they can do is put all these password blocks together right group them see what all the password hints are and so you get something like this so you can start writing passwords so you can say that this one the most frequently used password in their list was 1, 2, 3, 4, 5, 6 which you can easily tell by the password hint this looks like a program this is a very bad person because they should know better numbers 1-8 which is actually a little bit better a little bit slightly more cryptic 8 digit this one is pretty bad the password is password actually looking at these you can see that they probably had a mechanism to make sure that the password hint is not exactly the same as the password right which is why many people probably can't use a way to do this so this is one so this is how you can still breach you can still break passwords even and leak people's information and you know these are passwords these are all have associated email addresses with them right I mean this isn't a bad just curious currently there is like well recently like with facts like you can leave a bunch of social securities I don't I didn't want to talk about them there hasn't been enough details released about specifically what data has been leaked so I didn't want to go over that but yeah aqua facts is a huge recent one but next time I teach this I will definitely probably talk about that so how do we fix this right so as end of so A1 problem is as a website owner it's actually difficult to prevent your use right because you're only one site one authentication mechanism so the what I do is I actually have random past like I have unique random passwords for every single website that I use and I use a password manager so the idea is keep track of passwords and generates random passwords per website so if you were to ask me what's my ASU password I literally don't know like I never type it in I don't know what it is so what's the so the pro here should be pretty obvious right the pro is hey you're using good unique passwords for every single website so you don't have to worry if that website is ever compromised because what do you care your password is something random that's not used on any other websites what's the con manager then they get everything else if they break into the password manager they can break into all my passwords the password manager like you have no way to access your accounts if you lose your password to the password manager yes the one thing we're going to talk about is usually the way most of these work is your password database is actually encrypted with your master password so you do have to know and memorize one really good password and that unlocks the database so different there's all different types of doing this I actually I mean I use last pass which I'll talk about in a second the way they work is they actually don't even store your passwords they store the encrypted database in your passwords your extension or your your iphone app hold down that encrypted database and when you want to use it you type in your master password so even if somebody were to break into last pass and steal all the encrypted passwords they shouldn't be able to derive and break any of those passwords because they don't have my master password what are some other cons we had some people in this course set up a certificate authority would you trust them to set up a password authority a password manager you can be honest I see people taking their heads would you trust the I wouldn't trust I don't know enough about crypto exactly I mean not to fault you guys or anything right it's about um so they can't yeah do you have a comment I was just going to say it kind of goes back to when they were securing our house obviously they're coming and they can break into the house I want to use them someone out there whoever administers this password manager knows they're a single password they're going to be right so yeah you want either cryptographic guarantees that they don't do that I mean even though I know that last pass doesn't store the encrypted version there's no nothing that says that they don't so I enter my master password and just send that master password back to them you could definitely do that technically right there's nothing stopping it from doing that the only thing stopping it is the company and their reputation and the only reason I do this is that I trust in them that they will actually do this so it really comes down to who do you trust who do you trust to do this um and so you can the idea is you should think about this problem and understand the scope of it and understand the who do I trust versus not trust um you get different there's different usability and security tradeoffs so there are some things like I believe uh it was a key pass well there uh key pass I believe allows you to have a local encrypted copy and key pass is also open source so you can analyze it and you could convince yourself whether it's secure or not whether you have the expertise to do that or not hiding anything there that's another thing but you could start from the source analyze it you could compile it yourself on your machine so you know that they're not adding any backdoors to the compilation process um I believe key pass uses a local encrypted database so it stores a database encrypted encrypted with your master password but it never touches their servers uh at least I believe that I think that's true um and so you just kind of have to make if you want to know this route you can you have to make your own decisions and your own um ideas about whether that tradeoff is worth it so for me I use last pass because I want to use the same pass manager on your phone and on my browser and uh to me that's much more useful having that syncing feature than having the security just having a local database um I also another thing you want to think about when you think about these things is what's the incentive of the company so like last pass actually you can use them for free you can use them for free as soon as I started to use them I was like no I'm going to pay them money to do this because I want to keep them around right I don't want them to have and I believe it's insanely cheap I think it's 12 dollars a year for um a last pass subscription and they have additional cool features like you can share passwords with people so if I wanted to give you access to my Netflix account or some other account um I can share that password with you if you're using last pass and then you don't actually know the password because the auto fills it in so I can just revoke that through last pass I can be relatively confident that you'll know the password right um there's probably still technical work around but assuming you semi trust people that's kind of uh the honest but curious adversary anybody use password managers nice anybody use anyone that's not in this list that they want to plug Google Google has a password manager yeah that's the problem I've been really giving Google everything anybody use anything else Google literally already has a lot of my stuff so so there's a lot more about you know and if usability is you think is a problem I can tell you that I've gotten uh both my mom and my dad to use last pass and to actually use it um it does require some tech support phone calls that are once in a while but not a lot but the security benefit here is much uh much more proof uh okay so we actually talked about this so we um we talked about password recovery right this is another important part of password based self dedication what happens when you forget your password right it's really easy for us as security people to design things and trust that the user will always do exactly what we tell them and instruct them to do right I've created at least four or five passwords for people in the class who forgot their password um and so the idea is are you completely locked out of your account at that point is there nothing you can do sometimes you know because it's a terrible business decision right because if the business relied on you using your password they would let you choose the easiest password ever because they just want to do business with you right um so we talked about most of them will send an email to your email account with a link to reset your password or a new password or so what does it mean if a website sends you an email with your username and password when you say most likely they're in storing it in plain text yeah the only thing could be if they're storing it kind of like the adobe thing where it's encrypted and they can decrypt it but as we've seen that actually causes a lot of problems because they're not doing a good insulting and hashing method right so that definitely causes problems cool so an important component of most types of security so we've looked at passwords right so which type of authentication mechanism something you know it's something you know right so the idea is well to increase the security of that right should I ask you two things you know should I ask you three things you know or four things you know you can is it improve the security over just asking for one thing you know significantly on the inside no right because I mean I guess it kind of does depend a little bit on how you do it right so if I ask you for it so let's say you had I asked you when you signed up um what's your favorite dog or what's the name of your favorite dog and a password and then every time you logged in I would ask you what's the name of your favorite dog and I'd ask you for your password and only if those were two were correct I'd allow you to begin right well in that case the name of your dog is essentially part of your password now right it's basically equivalent the way it could get interesting is if you let's say you signed up for like five different things and they randomly asked you one of those things in addition to your password so in order for somebody to break into your account they need to wait until they saw and knew the answers to all those pieces of information but really the way we like to think about it is if you're asking for multiple things that they know right that doesn't really significantly improve the security of the system so if somebody is asking you about two factor authentication and you talk about passwords and security questions that is not two factor authentication that is a single factor of authentication because the factor here is we're talking about the authentication categories that we talked about right so it needs to be something that you know and what else something that you have or something that you are right so this would be so anybody use two factor authentication on google you should definitely use this mmm yeah so this is so A we just talked about your emails probably one of your most important accounts you saw me use do a security for ASU ASU student workers or anything like that yeah I know it's annoying but so is bringing your keys with you everywhere because you're going to get locked out of your house if you leave your keys at home right or you lose your keys right yes it's annoying but it proves that hey not only do you know this person's password but you have access to their phone so for instance I can show you my google authenticator so for those that haven't seen it I will briefly wave it at you I will definitely not record it so I have google drop box in the last pass all up here on two factor authentication so you can see that it's randomly generated some sick digit numbers and these numbers are only valid for I think a minute you can't see it in the lower right there's a timer counting down for each of these and that's the length of time that this security token is valid so why can't I show this to you A it's going to change so it's just changed right now so you've had to use it in that time period that I showed it to you what else do you need you need my password you need my google password like I told you I don't even know what that is it's something long and random I am very confident that I can show you these and none of you will be able to break my account now let's say that I was not so savvy and I was like we talked about reusing passwords on multiple websites right so I have my password of 1 2 3 on account site A, site A gets hacked it's called Adobe for A gets hacked it has my email address they find out that's my password, they try it on gmail and let's say now I'm using two factor authentication so now what happens to the attacker do they have access to the account what do they need to access the account yeah my phone well technically my phone or the way these things work is so the other reason why I can show you these is these numbers based on the current numbers you cannot predict the next number so it's a pseudo random sequence and it's all based off of a starting secret key so the server knows the secret key it transmitted it to this phone the QR code that you scan and so that way both the server and my phone know the secret key and so they can keep infinitely generating keys that are completely random but the server will be able to check that that random value is one of these values so what this means for authentication is I can only log into Google or Dropbox or LastPass if I have this phone what are the downfalls there what else is on the downfalls if someone steals your phone somebody steals my phone what can they do depending if they already know your passcode you get in or if you have weak security to open up your phone now they have your phone so when they ask for MFA they can just open up the app yes so that's good so but it requires that somebody who steals my phone also knows my password so this is where the two factors come into play so I think we can agree that it may cost some value for somebody to steal my password it may cost some other value to the attacker to steal my phone but for somebody to do both they have to actually do both and pay both for that cost so it's definitely possible it doesn't completely protect me but it does kind of add an additional layer of security and additional I'm much more sure about my password to my account you could also do so who has fingerprints enabled on their phone is that two factor it's just a replacement of a one factor exactly it's replacing one factor your pin code with your fingerprint hopefully you can see that these kind of simplified models don't necessarily always translate 100% because most phones if you restart it or if your fingerprint fails three times it will ask you to pin code so it's a little bit it's using different factors but it's not necessarily requiring two factors I mean even Google even the ASU, the Duo Security stuff I can tell Google to remember this computer for 30 days which means it won't ask me for that second factor again for 30 days on this computer which means that if somebody steals my factor and logs in for another computer they'll get challenged but if Mahler is executing on my machine and goes to Gmail it can read everything and see everything because it has the token and if my machine is compromised well the attacker could see me typing the password and see me typing in that six digit code for my authenticator anyways so I'm kind of screwed hopefully if I don't trust this machine questions on two factor and then two factors obviously just said NFA so that would be multi factor authentication that would be more than one so this would be if I had to do a fingerprint scan and have a token and have a password I highly recommend you look at your stuff, look at your online world and think about signing up for these things because these are really important and actually do I think this is an easy step that you can use to measurably improve your digital security whoever faced a capture before I don't have a good transition for these yeah what is it, what is the capture improve your data robot so captures are completely automated public terming test to tell computers and humans apart this is what it stands for if you've ever seen it you see something like this right so the idea is to proceed you need to type in what those words are this is an inquiry to be able to proceed so talk about that in a second is capture authentication are humans authentication proving that you are someone or that you are the someone that is trying to access something well you tell me you studied authentication that's with my definition of authentication this would be because you're not proving you're you're not proving you're someone to access something specific you're getting past you're proving that you are a someone well I guess it would be more akin to having to get past a door right the door is not necessarily locked but you still have to get through interesting it's not proving who you are proving at least is what you're not proving proving what you're not in the sense that you're not in this case you're proving you're not a robot but it's not proving that you are who you tried to log in as I would argue that you can use authentication interesting yeah Carlos do you have any opinions on this it's a tricky question I think you could maybe try to twist authentication into especially when you start thinking about groups maybe you just want to authenticate that you're a member of a group of humans or something like maybe your system doesn't care but yeah no I definitely agree I mean I kind of I would say yes it's not really authentication because it's not identifying you right this is something that literally any human should be able to pass or any human that looks like knows English so how do you break this are from recapitia which these the overall some inquiry examples oh no I just gave the robots the answer those words actually come from scanning books so you're actually performing OCR and digitizing books by correctly answering these values so it's actually can be a good thing in some sense so it's using this not just as an annoying thing but as a good but how would you break this yeah so you could use natural language processing use computer vision, use machine learning any of these techniques there's actually a lot of work that's been done on breaking captures, a lot of research it used to be fairly simple you could easily chunk up the characters and use image recognition or machine learning to identify each character so that's why you get these kind of wavy things so it's harder to chunk up each characters Ticketmaster so they have I wouldn't say they probably still have a big problem with bots and people automatically buying tickets to then later resell on the market I was reading an article and it turns out that one of the people who who did this and automated this breaking in captures they actually only had like 60,000 different captures so they figured this out they downloaded every single capture image and then broke it by hand and kept that in a table and just hashed the image and then figured out which one it was and they looked at it and that's how they broke it yeah can you just say that this recapture of broken widget thing crowdsources digitizing books yes some of the things like google's line uses like house numbers and other types of things from the google street view of the google and that thing stuff usually what they'll do is they'll that's why they have two words so it's one that they know the answer to so they can check and then another one to then test you on basically and then over time they see obviously answers will be much more correct than other ones other ways to do this that you probably don't think about so if I'm a bad guy and I want to break a capture because I want to do some automated thing against your system what they do is they either just pay humans to do it so they can use something like mechanical Turk and just send the image to somebody else get the answer back and then you put that answer to continue or they will create a let's say an enticing website that tries to get people to visit and see the content to that website but they will put captures before you're allowed to see the content and those captures aren't their captures they're actually captures from whatever system they want to break or use so they'll go see a capture because they're doing some automated crawling or scanning then send that to their other site which is on an illicit or I think enticing content it's probably the best way to put that and then they'll throw that capture to a human who really wants to solve it they'll solve it, send the answer back to the original one so you can think about it as like capture it in the middle of passing captures so additional things we have talked about token based authentication which is kind of what we talked about with two factor authentication so these random tokens can be hardware based so actually I believe Google just released this like Google advanced security for accounts where they ship you a special key that looks pretty interesting a dress based authentication and then we talked about let's say restrict so your company restricting access to the VPN or some server if you say okay I will whitelist and only IP addresses that I know of can access this site so you can restrict kind of a sense of address which could be physical or physical in the case of location based authentication this is actually super cool so oh I don't have my key I should have brought it so my car key actually when I'm close and when I open the door I'll actually unlock the car door when I'm close so you think that should be pretty easy you share some secret you exchange something to prove that you're there the problem is when I'm here at ASU I don't know that one of you isn't standing with a big antenna to talk to my key to then transmit that signal either wirelessly to somebody else in the garage or something else or over some other beam to identify that signal so it gets from the car to my key so they actually have a whole bunch of location based authentication so that actually keeps time into account so that the server sends a challenge and time stamps it and you have to reply with literally like within the physical timeframe it takes from light to travel to the car to the max distance and back and if you don't reply that time then the server will drop and will not do it and you can't do these extension attacks which are super interesting biometrics as we talk about fingerprint, voice, face there's a lot of future research to be done in the area of authentication this is not something that's a solved problem I mean you're even seeing this now with the rise of two-factor authentication tokens things are constantly changing one thing we talked about continuous authentication so rather than just verify the user once and give them access to everything you either authenticate them constantly or you choose different areas Amazon is usually really good about knowing who you are and log in so you'll go to Amazon and they'll say hello whatever in the upper right but when you try to look at your task orders it will then ask you for your task order so you can try to think about the different levels of security for different parts of your functionality maybe some things you require two-factor authentication some things one factor is okay there's a whole push to try to replace passwords as we've said it's the worst system but it's better than anything else we've tried yet so FIDO if you want to look this up is a cool authentication mechanism where it's done 100% transparently and keys are stored on a physical device so you authenticate to the device and that allows you access to any website so if you authenticate you it's a really cool protocol and as we talked about access slash authentication delegation so OAuth 2.0 actually you'll see this of ASU's online services so anyway use the Outlook the OWA Outlook Web Access or ASU so when you go there you go to Microsoft server you go to Outlook.Whatever ASU password it redirects you then to an ASU login page where that logs you in checks your password with ASU's database then tells Microsoft yes this person's authenticated and this is who they are so you think about that is this way is great for Microsoft because they don't want your ASU username or password they just want to handle your email and get money from ASU for doing so they don't want your passwords because they want ASU to deal with that any questions on this? 2 minutes for any minutes or questions go