Account Security for the Fashionable App Developer
summary
Uses concrete tools and numbers: Dropbox’s password estimator zxcvbn blocks the top ~30,000 common passwords in the browser, Django 2.1 ships a similar 30k list, and Troy Hunt’s haveibeenpwned offers a privacy API that takes the first five SHA‑1 chars (the full breach dump is ~11 GB compressed). Hardware U2F keys stop many phishing attacks (Google reports eliminating corporate takeovers), sessions can be invalidated by storing a password HMAC in session and Django elevate/sudo mode forces fresh auth for sensitive actions.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 0:33Meet Philip and Asheesh
- 1:35Account Security
- 2:52Advice
- 3:49Most popular passwords
- 4:32NIST rules
- 5:24Screenshots
- 6:43Troy Hunt
- 7:35Raw Passwords
- 8:41Integrating with Jango
- 9:13Multifactor Authentication
- 9:59SMS
- 10:18Google Authenticator
- 11:09U2F
- 12:09Sponsors
- 12:43Logging into Slack
- 14:12Django Token Off
- 15:51Help Your Users
- 16:39Notifications
- 17:41Django Code
- 18:12Django Messages
- 18:57Password Changes
- 19:38Sample Code
- 20:53Breach Notifications
- 23:53How many people are logged in
- 24:20Pseudomode
- 24:35Django View
- 24:53sudo mode
- 25:04URL
- 25:43Deleting Accounts
- 26:14Recap
related talks
31mhunter2: A Symphony of Password Horror
30mhunter2: A Symphony of Password Horror
58mTaking the pain out of passwords and authentication
21mGoing Passwordless
40mFantastic Passwords and Where to Find Them
23mFantastic Passwords and Where to Find Them
48mPractical Django Secuirty
46mRequiem for the Password