Explore password security concepts and advanced defense strategies in this 55-minute conference talk from Passwordscon 2014. Delve into classic password cracking techniques and defenses before examining recent trends that give attackers an advantage. Learn about naive and selective brute force attacks, predictable password topologies, and real-world examples from organizations. Discover the innovative PathWell system for password topology histogram wear-leveling, including its effectiveness, implementation modes, and potential configurations. Gain insights into measuring topology changes, keyspace reduction costs, and future directions for the PathWell project.
Overview
Syllabus
Intro
Classic Password Cracking
Classic Defenses
Recent Trends: Attacker Advantage
Naive Brute Force
Selective Brute Force-Password Patterns
Predictable Password Topologies
Sample Organization #1
How about harder passwords?
Topology-Related Defenses
PathWell: Password Topology Histogram Wear- Leveling
Topology Wear-Leveling Effectiveness
Minimum Topology Change
Measuring Topology Change: Levenshtein Distance
Cost of Topology-Related Defense: Keyspace Reduction
PathWell Audit Mode
PathWell Enforcement Mode
Example Configurations
PathWell: Next Steps for the Project
Free Topologies
