The Future of ATO
summary
Coinbase reports ~30 million users in 103 countries and sees ~10% of ATO attempts as targeted ATO; credential-stuffing yields ~2.5% validated pairs so defenses feed fake success rates back to degrade seller reputations. Practical controls that work include device verification requiring an email click from the same IP, injected 48‑hour cooling‑off delays, KYC selfie rechecks for account recovery, phone‑port/sim‑swap feeds, and nudges that raise SMS→TOTP conversion to ~10%. Adoption of physical tokens is currently ~1% but u2f works.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:00Future of ATO
- 10:58Sim Swapping
- 18:44Account Recovery Abuse
- 23:50Critical Phishing
- 26:50Credential stuffing
- 28:00Botnet proliferation
- 28:32Ratelimiting
- 31:21Challenges
- 32:35List Validation
- 36:04Social Engineering
- 39:51Answer Mocks
- 42:29What do we do
- 43:20Banking malware
- 44:59Bottom line
- 46:34Questions
related talks
17m2FA in 2020 & Beyond
48m2FA2Furious: New Threats to MFA
24m2FA in 2020 and Beyond
45m[T]OTPs Are Not As Secure As You Might Believe
42mChallenges in User Authentication: Balancing Security & User Experience
39m2FA, WTF?
44mThe Unpatchables: Credential Stuffing Quantification and Classification
26mIntegrating Identity and Fraud