Forgot Password? Yes I Did!

•

0 gefällt mir•296 views

Every month, we hear about a new data breach and billions of user passwords are being shared as we speak. How can we stop this? There is a simple solution, let’s stop using passwords! From email links to biometrics, more and more technologies are available to help developers handle different types of credentials. During this presentation, the attendees will learn about some of the alternatives and how to implement them in the context of an OAuth flow.

Internet

FORGOT PASSWORD? YES I
DID!
AN INTRO TO PASSWORDLESS AUTHENTICATION

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
ABOUT ME
@joel__lord
joellord

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
PASSWORDS ARE BAD
▸ Help desk costs
▸ Technology acquisition costs
▸ Management and operations costs

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
PASSWORDS ARE BAD
▸ 2,6G data records compromised in
2017

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
PASSWORDS ARE BAD
▸ 2,6G data records compromised in
2017
▸ https://breachlevelindex.com

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
PASSWORDS ARE BAD
▸ More computing power === easier
cracking
▸ More social media presence ===
easier social engineering
▸ Users will always be your weakest
link

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
PASSWORDS ARE BAD
▸ 23% of users admit having only
one password
▸ More than 60% of users use at
least two devices everyday
▸ We all hate passwords!

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
WHAT CAN WE DO?
▸ Use best practices

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
OAUTH - IMPLICIT FLOW

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
WHAT CAN WE DO?
▸ Use best practices
▸ Delegate

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
WHAT CAN WE DO?
▸ Use best practices
▸ Delegate
▸ MFA

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
FORGET PASSWORDS
▸ Avoid reusing passwords

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
FORGET PASSWORDS
▸ Avoid reusing passwords
▸ Use a password manager

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
ALTERNATIVES
▸ WebAuthn

DEAR DEMO GODS,
PLEASE LET THIS WORK
WEBAUTHN DEMO
Demo src: https://dist-yycvxvsyvu.now.sh/tutorial/

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
ALTERNATIVES
▸ WebAuthn
▸ Biometrics

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
BIOMETRICS
https://www.microsoft.com/en-us/research/wp-content/uploads/2008/10/ECCV_CAT_PROC.pdf

DEAR DEMO GODS,
PLEASE LET THIS WORK
BIOMETRICS DEMO
Demo src: https://voiceit.io/

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
ALTERNATIVES
▸ WebAuthn
▸ Biometrics
▸ Magic Links

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
MAGIC LINKS (POST /AUTHORIZE)

$@joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (GET /LOGIN/{MAGICLINK})$

DEAR DEMO GODS,
PLEASE LET THIS WORK
MAGIC LINK DEMO
Demo src: https://github.com/joellord/secure-spa-auth0/

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
ALTERNATIVES
▸ Yubikeys
▸ Biometrics
▸ Magic Links

@joel__lord
#phpworld
FORGOT PASSWORD? YES I DID!
RESOURCES
▸ OAuth & Open ID Connect
▸ http://bit.ly/oauth-talk
▸ JWTs
▸ https://jwt.io
▸ WebAuthn
▸ http://bit.ly/webauthn-demo
▸ VoiceIt integration with Auth0
▸ http://bit.ly/auth0-voiceit

@joel__lord
joellord
FORGOT PASSWORD? YES I DID!
php[world], Washington, DC
November 14th, 2018
THANK YOU !

Empfohlen

Does Your Web App Speak Schadenfreude? - Greg Rewis - Codemotion Rome 2017Codemotion

How To Cast Your Voice Into The Streamrbarneveld

PPI Claim - PPIClaimsHelpUK.co.ukNathan Wynne

Command Line Automation for Repetitive TasksMike Osolinski

List of ppi claims url'sNathan Wynne

Ccrt pgCompaniaDekartSRL

How I learned to stop worrying and love the .htaccess fileRoxana Stingu

Learn chinese name from getting a chinese namemiles peng

Empfohlen

Does Your Web App Speak Schadenfreude? - Greg Rewis - Codemotion Rome 2017Codemotion

How To Cast Your Voice Into The Streamrbarneveld

PPI Claim - PPIClaimsHelpUK.co.ukNathan Wynne

Command Line Automation for Repetitive TasksMike Osolinski

List of ppi claims url'sNathan Wynne

Ccrt pgCompaniaDekartSRL

How I learned to stop worrying and love the .htaccess fileRoxana Stingu

Learn chinese name from getting a chinese namemiles peng

Forgot Password? Yes I Did!Joel Lord

Mot de passe oublié? Absolument!Joel Lord

Forgot Password? Yes I Did!Joel Lord

Cloudbrew 2019 observability driven developmentGeert van der Cruijsen

Effective codereview | Dave Liddament | CODEiDCODEiD PHP Community

Codemotion Milan 2018 - AI with a devops mindset: experimentation, sharing an...Thiago de Faria

Thiago de Faria - AI with a devops mindset - experimentation, sharing and eas...Codemotion

FITC Spotlight HTML5 - The state of the webFrédéric Harper

Magento 2 Performance: Every Second CountsJoshua Warren

GDG DevFest 2018 - Progressive Web Apps 101Frances Coronel

GDG SF Meetup - Progressive Web Apps 101Frances Coronel

Death to passwords - DroidCon Paris 2014Paris Android User Group

Observability driven developmentGeert van der Cruijsen

Api Designsumithra jonnalagadda

DevOps Patterns & Antipatterns for Continuous Software Updates @ NADOG April ...Baruch Sadogursky

Codemotion Berlin 2018 - AI with a devops mindset: experimentation, sharing a...Thiago de Faria

Thiago de Faria - AI with a devops mindset - experimentation, sharing and eas...Codemotion

The Original Hypertext PreprocessorDrew McLellan

Agile WordpressFilippo Dino

Data driven devops as presented at Codemash 2018Baruch Sadogursky

From Ceasar Cipher To Quantum CryptographyJoel Lord

I Don't Care About Security (And Neither Should You)Joel Lord

Weitere ähnliche Inhalte

Ähnlich wie Forgot Password? Yes I Did!

Forgot Password? Yes I Did!Joel Lord

Mot de passe oublié? Absolument!Joel Lord

Forgot Password? Yes I Did!Joel Lord

Cloudbrew 2019 observability driven developmentGeert van der Cruijsen

Effective codereview | Dave Liddament | CODEiDCODEiD PHP Community

Codemotion Milan 2018 - AI with a devops mindset: experimentation, sharing an...Thiago de Faria

Thiago de Faria - AI with a devops mindset - experimentation, sharing and eas...Codemotion

FITC Spotlight HTML5 - The state of the webFrédéric Harper

Magento 2 Performance: Every Second CountsJoshua Warren

GDG DevFest 2018 - Progressive Web Apps 101Frances Coronel

GDG SF Meetup - Progressive Web Apps 101Frances Coronel

Death to passwords - DroidCon Paris 2014Paris Android User Group

Observability driven developmentGeert van der Cruijsen

Api Designsumithra jonnalagadda

DevOps Patterns & Antipatterns for Continuous Software Updates @ NADOG April ...Baruch Sadogursky

Codemotion Berlin 2018 - AI with a devops mindset: experimentation, sharing a...Thiago de Faria

Thiago de Faria - AI with a devops mindset - experimentation, sharing and eas...Codemotion

The Original Hypertext PreprocessorDrew McLellan

Agile WordpressFilippo Dino

Data driven devops as presented at Codemash 2018Baruch Sadogursky

Ähnlich wie Forgot Password? Yes I Did! (20)

Forgot Password? Yes I Did!

Mot de passe oublié? Absolument!

Forgot Password? Yes I Did!

Cloudbrew 2019 observability driven development

Effective codereview | Dave Liddament | CODEiD

Codemotion Milan 2018 - AI with a devops mindset: experimentation, sharing an...

Thiago de Faria - AI with a devops mindset - experimentation, sharing and eas...

FITC Spotlight HTML5 - The state of the web

Magento 2 Performance: Every Second Counts

GDG DevFest 2018 - Progressive Web Apps 101

GDG SF Meetup - Progressive Web Apps 101

Death to passwords - DroidCon Paris 2014

Observability driven development

Api Design

DevOps Patterns & Antipatterns for Continuous Software Updates @ NADOG April ...

Codemotion Berlin 2018 - AI with a devops mindset: experimentation, sharing a...

Thiago de Faria - AI with a devops mindset - experimentation, sharing and eas...

The Original Hypertext Preprocessor

Agile Wordpress

Data driven devops as presented at Codemash 2018

Mehr von Joel Lord

From Ceasar Cipher To Quantum CryptographyJoel Lord

I Don't Care About Security (And Neither Should You)Joel Lord

Asynchronicity: concurrency. A tale ofJoel Lord

Learning Machine LearningJoel Lord

WTH is a JWTJoel Lord

I Don't Care About Security (And Neither Should You)Joel Lord

WTH is a JWTJoel Lord

Asynchonicity: concurrency. A tale ofJoel Lord

I Don't Care About Security Joel Lord

I Don't Care About Security (And Neither Should You)Joel Lord

Secure your SPA with Auth0Joel Lord

Learning Machine LearningJoel Lord

Rise of the NodebotsJoel Lord

Let's Get PhysicalJoel Lord

Mehr von Joel Lord (20)

From Ceasar Cipher To Quantum Cryptography

I Don't Care About Security (And Neither Should You)

Asynchronicity: concurrency. A tale of

Learning Machine Learning

WTH is a JWT

I Don't Care About Security (And Neither Should You)

WTH is a JWT

Asynchonicity: concurrency. A tale of

I Don't Care About Security

I Don't Care About Security (And Neither Should You)

Secure your SPA with Auth0

Learning Machine Learning

Rise of the Nodebots

Let's Get Physical

Kürzlich hochgeladen

Rohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No AdvanceCall Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure

Call Girls In Saket Delhi 💯Call Us 🔝8264348440🔝soniya singh

Rohini Sector 6 Call Girls Delhi 9999965857 @Sabina Saikh No AdvanceCall Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure

Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...tanu pandey

𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...Neha Pandey

AWS Community DAY Albertini-Ellan Cloud Security (1).pptxellan12

Call Girls In Sukhdev Vihar Delhi 💯Call Us 🔝8264348440🔝soniya singh

FULL ENJOY Call Girls In Mayur Vihar Delhi Contact Us 8377087607dollysharma2066

Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝soniya singh

SEO Growth Program-Digital optimization SpecialistKHM Anwar

Rohini Sector 26 Call Girls Delhi 9999965857 @Sabina Saikh No AdvanceCall Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure

Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...SofiyaSharma5

'Future Evolution of the Internet' delivered by Geoff Huston at Everything Op...APNIC

On Starlink, presented by Geoff Huston at NZNOG 2024APNIC

Dwarka Sector 26 Call Girls | Delhi | 9999965857 🫦 Vanshika Verma More Our Se...Call Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure

Challengers I Told Ya ShirtChallengers I Told Ya Shirtrahman018755

Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts servicesonalikaur4

Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRLimonikaupta

Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$kojalkojal131

Delhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Callshivangimorya083

Kürzlich hochgeladen (20)

Rohini Sector 22 Call Girls Delhi 9999965857 @Sabina Saikh No Advance

Call Girls In Saket Delhi 💯Call Us 🔝8264348440🔝

Rohini Sector 6 Call Girls Delhi 9999965857 @Sabina Saikh No Advance

Pune Airport ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready...

𓀤Call On 7877925207 𓀤 Ahmedguda Call Girls Hot Model With Sexy Bhabi Ready Fo...

AWS Community DAY Albertini-Ellan Cloud Security (1).pptx

Call Girls In Sukhdev Vihar Delhi 💯Call Us 🔝8264348440🔝

FULL ENJOY Call Girls In Mayur Vihar Delhi Contact Us 8377087607

Call Girls In Pratap Nagar Delhi 💯Call Us 🔝8264348440🔝

SEO Growth Program-Digital optimization Specialist

Rohini Sector 26 Call Girls Delhi 9999965857 @Sabina Saikh No Advance

Low Rate Young Call Girls in Sector 63 Mamura Noida ✔️☆9289244007✔️☆ Female E...

'Future Evolution of the Internet' delivered by Geoff Huston at Everything Op...

On Starlink, presented by Geoff Huston at NZNOG 2024

Dwarka Sector 26 Call Girls | Delhi | 9999965857 🫦 Vanshika Verma More Our Se...

Challengers I Told Ya ShirtChallengers I Told Ya Shirt

Chennai Call Girls Porur Phone 🍆 8250192130 👅 celebrity escorts service

Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL

Call Girls Dubai Prolapsed O525547819 Call Girls In Dubai Princes$

Delhi Call Girls Rohini 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call

Forgot Password? Yes I Did!

1. FORGOT PASSWORD? YES I DID! AN INTRO TO PASSWORDLESS AUTHENTICATION

2. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ABOUT ME @joel__lord joellord

3. PASSWORDS ARE BAD

4. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! PASSWORDS ARE BAD ▸ Help desk costs ▸ Technology acquisition costs ▸ Management and operations costs

5. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! PASSWORDS ARE BAD ▸ 2,6G data records compromised in 2017

6. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! PASSWORDS ARE BAD ▸ 2,6G data records compromised in 2017 ▸ https://breachlevelindex.com

7. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! PASSWORDS ARE BAD ▸ More computing power === easier cracking ▸ More social media presence === easier social engineering ▸ Users will always be your weakest link

10. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! PASSWORDS ARE BAD ▸ 23% of users admit having only one password ▸ More than 60% of users use at least two devices everyday ▸ We all hate passwords!

11. @joel__lord #phpworld

12. @joel__lord #phpworld

13. @joel__lord #phpworld

14. @joel__lord #phpworld

15. WHAT CAN YOU DO?

16. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! WHAT CAN WE DO? ▸ Use best practices

17. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! OAUTH - IMPLICIT FLOW

18. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! OAUTH - IMPLICIT FLOW ⛔

19. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! OAUTH - IMPLICIT FLOW

20. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! OAUTH - IMPLICIT FLOW

21. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! OAUTH - IMPLICIT FLOW

22. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! OAUTH - IMPLICIT FLOW

23. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! OAUTH - IMPLICIT FLOW

24. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! OAUTH - IMPLICIT FLOW

25. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! WHAT CAN WE DO? ▸ Use best practices ▸ Delegate

26. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! WHAT CAN WE DO? ▸ Use best practices ▸ Delegate ▸ MFA

27. FORGET PASSWORDS

28. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! FORGET PASSWORDS ▸ Avoid reusing passwords

29. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! FORGET PASSWORDS ▸ Avoid reusing passwords ▸ Use a password manager

30.

31. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ WebAuthn

32. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ WebAuthn

33. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ WebAuthn

34. DEAR DEMO GODS, PLEASE LET THIS WORK WEBAUTHN DEMO Demo src: https://dist-yycvxvsyvu.now.sh/tutorial/

35. @joel__lord #phpworld

36. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ WebAuthn

37. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ WebAuthn ▸ Biometrics

38. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! BIOMETRICS https://www.microsoft.com/en-us/research/wp-content/uploads/2008/10/ECCV_CAT_PROC.pdf

39. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! BIOMETRICS https://www.microsoft.com/en-us/research/wp-content/uploads/2008/10/ECCV_CAT_PROC.pdf

40. DEAR DEMO GODS, PLEASE LET THIS WORK BIOMETRICS DEMO Demo src: https://voiceit.io/

41. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ WebAuthn ▸ Biometrics

42. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ WebAuthn ▸ Biometrics ▸ Magic Links

43. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ WebAuthn ▸ Biometrics ▸ Magic Links

44. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (POST /AUTHORIZE)

45. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (POST /AUTHORIZE)

46. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (POST /AUTHORIZE)

47. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (POST /AUTHORIZE)

48. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (POST /AUTHORIZE)

49. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (POST /AUTHORIZE)

50. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (POST /AUTHORIZE)

51. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (POST /AUTHORIZE)

52. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (GET /LOGIN/{MAGICLINK})

53. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (GET /LOGIN/{MAGICLINK})

54. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (GET /LOGIN/{MAGICLINK})

55. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (GET /LOGIN/{MAGICLINK})

56. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (GET /LOGIN/{MAGICLINK})

57. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (GET /LOGIN/{MAGICLINK})

58. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! MAGIC LINKS (GET /LOGIN/{MAGICLINK})

59. DEAR DEMO GODS, PLEASE LET THIS WORK MAGIC LINK DEMO Demo src: https://github.com/joellord/secure-spa-auth0/

60. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! ALTERNATIVES ▸ Yubikeys ▸ Biometrics ▸ Magic Links

61. FUTURE OF IDENTITY MANAGEMENT

62. @joel__lord #phpworld FORGOT PASSWORD? YES I DID! RESOURCES ▸ OAuth & Open ID Connect ▸ http://bit.ly/oauth-talk ▸ JWTs ▸ https://jwt.io ▸ WebAuthn ▸ http://bit.ly/webauthn-demo ▸ VoiceIt integration with Auth0 ▸ http://bit.ly/auth0-voiceit

63. @joel__lord joellord FORGOT PASSWORD? YES I DID! php[world], Washington, DC November 14th, 2018 THANK YOU !

64.

65. TEXT

66. TEXT