📙 The Great Credential Caper: How to Perform and then Defend Against the (Nearly Impossible) to Defend 🏗️
summary
Claim: 41% of logins match previously exposed credentials and during a Black Friday week 95% automated during Black Friday week, attackers use Claude Code with Playwright plus residential proxies to perform credential stuffing and defeat CAPTCHAs (turnstile, hCaptcha, reCAPTCHA v2, GTest) in under a minute in demos. Evidence includes public breaches, a 16 billion‑password corpus, and real incidents (British Airways $250M ATO, DraftKings $300k). Defenses shown: shrink password supply (passkeys, managers), rate limits and proxy detection, session/behavioral step‑ups, hashed user IDs and agent proofs.
AI-written summary · about
chapters (16)
- 0:00Introduction and setup
- 1:44Speaker introductions
- 3:07Scale of credential stuffing problem
- 8:04Live credential stuffing demo
- 10:53AI evading bot detection
- 12:17Real-world credential stuffing attacks
- 15:02AI agents and the Ralph Loop
- 17:31Demo of CAPTCHA solving
- 19:15Troy Hunt and Have I Been Pwned
- 20:38Defensive strategies overview
- 21:42Layered defense approach
- 25:14End of human trust boundary
- 25:55Summary and no silver bullets
- 28:44Live password breach demo
- 31:08AI-generated Hamilton meme
- 32:10Q&A session
related talks
41mThe State Of Credential Stuffing And The Future Of Account Takeovers
29mBecoming You: A Glimpse Into Credential Abuse
44mThe Unpatchables: Credential Stuffing Quantification and Classification
31mLog In Through the Front Door: Automating Defense Against...
40mYou have a security problem - your users
40mWeb Attacks and Fraud: Lessons Learned from the Deep End of the Pool
26mIntegrating Identity and Fraud
49mBeyond Takeover: Attacker’s in. Now what?