The All Things Auth Podcast

Social media & websiteEmail: connect@usable.toolsTwitter: @global_ashm, @USABLE_toolsWebsite: usable.toolsResources mentioned in episodeJon Camfield published an article titled "Where did USABLE come from?" that explains the motivation for starting the organization.The free USABLE Guidebook contains resources and activities to help trainers and facilitators to collect relevant and useful feedback from high-risk users.The USABLE blog has a ton of posts about their mission and interviews with their partner organizations.Ashley explained how USABLE gets hands-on help from design and user experience partners (Simply Secure and OKTHANKS) and accessibility partners (Accessibility Lab).Ashley shared the story of working with Thomas, the lead developer of Mailvelope, an app that allows you to send end-to-end encrypted emails. Also, check out the Mailvelope Blog.USABLE created detailed personas to help developers understand how to make their products more usable for at-risk communities around the world.USABLE has also recently supported the Secure Drop, Orbot, and KeePass XC projects. The USABLE blog has great interviews with these projects.You can find the host of The All Things Auth Podcast on Twitter @conorgil.Canonical URL: https://allthingsauth.com/podcast/010-ashley-fowler-of-usable-tools.

Social media & websiteTwitter: @shehackspurpleWebsite: dev.to/shehackspurpleResources mentioned in episodeTanya talks about enabling MFA on Tangerine Bank, WealthSimple, and PayPal.Tanya wrote a blog post titled "Multi-Factor Authentication (MFA)" that explains what MFA is for people who are not familiar with the term.The site twofactorauth.org is a community maintained database of which sites support 2FA and which do not.Conor built an open-source browser extension called 2FA Notifier, which alerts you anytime you visit a site that is known to support 2FA and helps you enable it.During Microsoft Ignite 2018, Azure shared that adoption rate of MFA among admins was only 1.7%. “The rate increased from 0.7% in 2017 to 1.7% in 2018. Yes, it doubled, but it is still terrible.”Tanya mentioned Jessy Irwin’s mantra “If you liked it, then you should have put some crypto on it” and multi-Raptor authentication.You can find the host of The All Things Auth Podcast on Twitter @conorgil.Canonical URL: https://allthingsauth.com/podcast/009-tanya-janca-of-microsoft.

Social media & websiteTwitter: @1passwordWebsite: 1password.comResources mentioned in episodeConor and Pilar frequently reference 1Password’s White Paper, which explains the security architecture and overall security philosophy of the company.Pilar mentioned the well known XKCD comic on password strength that popularized the comical phrase “correct horse battery staple”.1Password’s Watchtower has many useful features related to monitoring the security of your account passwords and your use of two factor authentication (2FA).You can learn more about Troy Hunt’s Pwned Passwords API here and here. Also, check out Junade Ali’s post on the Cloudflare blog about why and how he proposed the Pwned Passwords API should use k-anonymity.Conor mentions the NIST special publication 800-63B, which contains password best practices.1Password has a $100k bug bounty hosted on BugCrowd.You can find the host of The All Things Auth Podcast on Twitter @conorgil.Canonical URL: https://allthingsauth.com/podcast/008-pilar-garcia-of-1password.

Yixin ZouSocial: @yixinzou1124University: School of Information at University of MichiganPaper: An Empirical Analysis of Data Deletion and Opt-Out Choices on 150 WebsitesKaroline BusseSocial: @kb_usecUniversity: Institute of Computer Science 4 Security and Networked Systems at University of BonnPaper: Replication: No One Can Hack My Mind Revisiting a Study on Expert and Non-Expert Security Practices and AdviceAnthony VanceSocial: @anthonyvance, anthonyvance.comUniversity: Center for Cybersecurity of the Fox School of Business at Temple University in collaboration with Neuro Security Lab at Brigham Young UniversityPaper: The Fog of Warnings: How Non-essential Notifications Blur with Security WarningsSarah Pearman and Shikun Aerin ZhangSocial: in/sarahpearman, sarahpearman.comUniversity: CyLab at Carnegie Mellon UniversityPaper: Why people (don’t) use password managers effectivelyKyle CrichtonSocial: in/kyle-crichton-81b72359University: CyLab Usable Privacy and Security (CUPS) Laboratory at Carnegie Mellon UniversityPaper: Incentives for Enabling Two-Factor Authentication in Online GamingYou can find the host of The All Things Auth Podcast on Twitter @conorgil.Canonical URL: https://allthingsauth.com/podcast/007-soups-2019-part-2

Miranda WeiTwitter: @_weimfUniversity: Security and Privacy Research Lab at University of Washington (work done at SUPERgroup at University of Chicago)Paper: “What was that site doing with my Facebook password?” Designing Password-Reuse NotificationsEva GerlitzUniversity: Institute of Computer Science 4 Security and Networked Systems at University of BonnPaper: "If you want, I can store the encrypted password." A Password-Storage Field Study with Freelance DevelopersMariano Di MartinoTwitter: @dimartinomarUniversity: Expertise Center for Digital Media (EDM) at Hasselt UniversityPaper: Personal Information Leakage by Abusing the GDPR 'Right of Access'Elham Al QahtaniUniversity: Lab of Information Integration, Security and Privacy (LIISP) at UNC CharlottePaper: Messaging Campaigns for Motivating Users to Adopt Duo at a University Paper: The Effectiveness of Fear Appeals in Increasing Smartphone Locking Behavior among Saudi ArabiansAndreas GutmannTwitter: @kryptoandiCompany: onespan.comUniversity: Information Security Group at University College LondonPaper: Taken Out of Context: Security Risks with Security Code AutoFill in iOS & macOSYou can find the host of The All Things Auth Podcast on Twitter @conorgil.Canonical URL: https://allthingsauth.com/podcast/006-soups-2019-part-1

Michal Špaček shares the story of how the Password Storage project has convinced hundreds of companies to publicly disclose their password storage practices and assigned each a grade based on how well they follow best practices.We discuss hashing algorithms and the technology behind storing passwords securely. Learn why a company who follows the technical best practices might still not earn an A grade if they do not have a public disclosure, or if they rely on an Invisible Disclosure.We compare the Password Storage project to other fantastic security tools, including SSL Labs and Mozilla Observatory.Michal outlines how the grading criteria will change in the short term, highlights the desire to get more companies included in the data set, and contemplates how the project will continue to grow over time.This episode was initially published in August 2019, the 5 year anniversary of Michal’s talk at BSides Las Vegas 2014, which planted the seeds that eventually grew into the Password Storage project. Happy birthday, Password Storage!Social media & websiteTwitter: @PasswordStorage, @spazef0rzeWebsite: Password Storage disclosures, michalspacek.comResources mentioned in episodeMichal launched Password Storage at BSides Las Vegas in 2016. You can see the slides from his talk here.Bruce K. Marshall is a researcher and consultant dedicated to improving the application of authentication technologies, products, and good practices. He founded PasswordResearch.com to better share the password information he was collecting.You can find Bruce on Twitter @PwdRsch.Michal’s wrote an article titled “Upgrading existing password hashes” that explains how to gracefully migrate passwords hashed with a legacy algorithm to a secure and modern algorithm.To get your website listed in the Password Storage project, check out the FAQ.You can find the host of The All Things Auth Podcast on Twitter @conorgil.Canonical URL: https://allthingsauth.com/podcast/005-michal-spacek-of-password-storage

Simon Moffatt, a Technical Product Manager at ForgeRock, joins me to discuss why a Product Manager is a critical role within any organization that aims to create usable security and privacy technologies. We discuss what, exactly, a PM actually does and why they are the critical hub between all departments, teams, and areas of the business.While most companies have a never ending list of TODO items, Simon explains why it is important to have a DO NOT list.Should PMs come from a technical background, a sales background, or is it better to be a polyglot with a range of experience? How can companies create product road maps that they will actually stick to and avoid the trap of sales-driven engineering?We also discuss security compliance and how market failures lead to standards and regulation to protect end-users.Social media & websiteTwitter: @SimonMoffatt, @ForgeRockWebsite: simonmoffatt.com, forgerock.comLinkedIn: @simonmoffattResources mentioned in episodeSimon mentions how The Lean Startup advocates a quick learning cycle to capitalize on user feedback to improve your products.Simon also writes articles on The Cyber Hut.You can find the host of The All Things Auth Podcast on Twitter @conorgil.Canonical URL: https://allthingsauth.com/podcast/004-simon-moffatt-of-forgerock

Keybase is a Slack-like app that supports chat and file sharing, but it is fully end-to-end encrypted. You might be familiar with other well known apps that support end-to-end encryption, like WhatsApp and Signal, but Keybase has a fundamentally different security architecture. Max explains why this is so important and helps us understand the cryptography that makes the service work.Before starting Keybase, Max was the co-founder of OkCupid. He shares the story about how he went from running a dating app to focusing on making public key cryptography approachable for the average internet user. Towards the end of our conversation, we discuss how Keybase approaches user research, how Keybase makes enough money to keep the lights on, and how they plan to grow the service in the future.Social media & websiteWebsite: keybase.ioTwitter: @keybaseio, @maxtacoKeybase: @maxAfter installing Keybase, you can request to join the team keybasefriends.Resources mentioned in episodeKeybase BlogThe post Keybase's New Key Model explains how you cryptographically link all of your devices so that you can use Keybase on all of your devices at the same time.The post Introducing Keybase Teams explains the user experience and underlying cryptography that powers the Keybase teams functionality.In Keybase is not softer than TOFU, Keybase explains what Trust on First Use means and how Keybase approaches this problem differently than any other app providing end-to-end encrypted communication.The Keybase documentation contains technical explanations of how Keybase is designed and architected.The Verge: Google, WhatsApp, and Apple slam GCHQ proposal to snoop on encrypted chatsYou can find Conor, the host, on Twitter @conorgil. Canonical URL: https://allthingsauth.com/podcast/003-max-krohn-of-keybase

Alex shares the story of how Krypton first started as a secure messaging app, then evolved to help developers manage SSH keys, and today aims to make phishing resistant two factor authentication a realistic option for average internet users.We get Alex’s thoughts on Google’s recent focus on allowing Android phones to be used as security keys, what happens if you lose your phone, and different approaches to account recovery.Social media & websiteKryptco: krypt.co, @kryptco, hello@krypt.coAlex Grinman: www.alexgr.in, @alexgrinmanResources mentioned in episodePhishing resistant two factor authentication (2FA) comes from implementing the FIDO2: WebAuthn & CTAP specifications.Krypton’s blog post, Our Zero-Trust Infrastructure, explains how the Krypton app pairs your phone to your browser to guarantee secure communication.You can find all of Kryptco’s open source software on GitHub.Google Security Blog - Advisory: Security Issue with Bluetooth Low Energy (BLE) Titan Security KeysYou can find Conor, the host, on Twitter @conorgil. Canonical URL: https://allthingsauth.com/podcast/002-alex-grinman-of-kryptco

Conor explains what security keys are and why they provide a stronger level of security than other methods of 2FA. He shares the story about how he created and sold his first open-source security key on Amazon while he was an undergraduate studying Computer Engineering and how that project evolved into a wildly successful Kickstarter project that launched SoloKeys the company.Towards the end of the conversation, Conor shares his thoughts on the recent trend of using phones as security keys and highlights Somu, the next exciting product that he and his team are working on right now.Social media & websiteSoloKey’s Twitter: @SoloKeysSecSoloKeys websiteConor Patrick’s Twitter: @_conorppResources mentioned in episodePhishing resistance two factor authentication (2FA) comes from implementing the FIDO2: WebAuthn & CTAP specifications.U2F Zero security keyIn his blog post, Designing and Producing 2FA tokens to Sell on Amazon, Conor explains how he created and sold an open source security key named U2F Zero while an undergrad in university.You can access the hardware designs and software in the GitHub repo conorpp/u2f-zero.You can build your own U2F Zero by following the instructions in the Build a U2F Token wiki page.SoloKey security keySoloKeys, the company, launched after raising $125,000 in a hugely successful Kickstarter project.In his blog post, Designing Solo, a new U2F/FIDO2 Token, Conor explains The hardware and software for SoloKey’s open source hardware security key, Solo, is available in the GitHub repo solokeys/solo.Google Security Blog: Now generally available: Android phone’s built-in security keyNitroKey security keyNitroKey, a commercial provider of security keys, based their open source U2F security key on Conor’s U2F Zero project. You can access the Nitrokey firmware and hardware in the GitHub repo Nitrokey/nitrokey-fido-u2f-firmware.NitroKey is also building security keys based on SoloKey’s current design as well.Somu: A tiny FIDO2 security key for two-factor authentication and passwordless loginCanonical URL: https://allthingsauth.com/podcast/001-conor-patrick-of-solokeys