The Path of Secure Digital Identity
summary
Provides a three-tier rule: classify data by risk then match authentication and session controls. Level 1 allows single-factor passwords; use use password_hash (PHP 7.2 / Argon2), allow all characters and paste, check against breached-password lists, and hash with a modern KDF. Level 2 requires multi‑factor auth not SMS (app or token); Level 3 requires hardware cryptographic keys. Session rules: long random IDs, regenerate session on login, set timeouts/absolute lifetimes, Secure and SameSite=strict cookies. Cites Deloitte admin breach, SS7 bank attacks, and 11 million Ashley Madison passwords cracked.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:12Deloitte Data Breach - March 2017 • Attack vector • Password only protected admin interface (no MFA) • Compromised: • Firm's global email server through administrator's account that gave privileged, unrestricted access to all areas.
- 8:01Security Level 1 • Reserved for lower-risk applications that don't contain Pll or other private data. • Only single factor authentication is required, typically through the use of a password.
- 13:321 Don't limit the characters - Alow all ASCII printable characters, including space, ALL UNICODE characters • Permit to use "paste" functionality - Check against a list of bad password • Minimum characters length • Offer guidance, such as a password-strength meter . Allow users passwords as long the want, within reason
- 16:124 Strong cryptographic algorithms • PBKDF2 (salt, password, workFactor): • bcrypt where resisting most hardware accelerate attacks is necessary but enterprise support isn't scrypt where resisting any/all hardware accelerated attacks is necessary but enterprise support isn't
- 17:173 Use a Credential-Specific Salt • Protect (salt, password); · Salt must be unique per user · Salt must be cryptographically random
- 20:10Security Level 2 • For higher-risk applications that contain: • self-asserted PII . other personal information • Multi-factor authentication through secure protocols
- 20:38Multi-Factor Authentication Multi-factor authentication - a combination of - Something they know-password or PIN - Something they own-token, smart card or phone
- 22:31Draining Bank Account with SS7 flaw Exploit on German Banks - 2017 1. Phishing attack-collect: Mocno, passwords, mobile numbers, etc 2. Call intercepting and forwarding
- 24:18Required when the impact of compromised systems could lead to: . personal harm • financial loss civil or criminal violations. • Requires strongest level of authentication assurance . Based on possession of a hardware cryptographic authenticator.
- 29:07Session Generation and Expiration Security controls to consider: • Ensure that the session id is long, unique and random • The application should generate a new session during authentication/re-authentication prevents session fixation • The application should implement : . a timeout after a period of inactivity • an absolute maximum lifetime for each session, after which users must re-authenticate.
- 31:34Browser Cookies Defences to consider when using browser cookies
- 32:50Takeaways • Identify the appropriate level of security for your own application, depending of the type of data. • Implement the appropriate level of digital authentication assurance • Implement security controls for session management
related talks
55mYou Shall Not Password: Modern Authentication for Web Apps
30mhunter2: A Symphony of Password Horror
29mSecurity by(e) Design?
30mInsecurity protocols: an overview of modern authentication
51mYou Shall Not Password: Modern Authentication for Web Apps
45mRedefining Security: From Passwords to Biometrics and Digital Signatures
01h 01mSecurity: From basic principles to PHP specifics
50mIn the world of Password123, be someone's #@%^)*!