Hate Passwords? You’re Not Alone: Why We Still Have Passwords in 2020

There are few things in the world more ubiquitously despised than passwords.  How many times have you tried to login to a website, only to realize that you “forgot your password,” or tried to create a new password only to have every attempt rejected because it is not secure enough?   And then, after satisfying all of these requirements, you get a text with a “security code” that you have to type in — not ideal. How did we get ourselves in this situation, and does any of this even help from a security point-of-view?  

In this talk, I will present a brief history of passwords and discuss the evolution of authentication.  Then, I will dive into the details of real-world attacks against passwords, and provide insights as where the various security measures (e.g., strict passwords requirements and text messages) do and do not help.  My goal is to pull the curtain back on the various forms of password-based authentication and let you be the judge if you should be frustrated with or grateful for the various “security” hops that you must jump through on a daily basis.