Securing Your Direct to Consumer Identity Strategy
summary
Direct-to-consumer identity needs concrete choices: require YubiKey Nano 5 support and multiple MFA options but accept SMS for reach; segment users because smartphone penetration is 4%/8%/21%/47% by age groups; prefer long passphrases, allow special characters without forcing composition rules, disable regular password rotation and check new passwords against a password breach corpus; use adaptive signals and behavioral/passive biometrics, plan robust account recovery, monitor funnels and alarm on API latency, and distinguish password spray vs credential stuffing in detection.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:39How to succeed in consumer identity
- 3:32Determining Your Security Posture
- 7:27Authentication Tools
- 9:00Smartphone penetration by age
- 9:48What about our password policy?
- 13:15Adaptive authentication
- 15:46Working with Social Connections
- 19:02Account Recovery
- 25:05Instrumenting collection is not trivial
- 26:40Attack Detection
- 27:32Alarm your identity flow funnels
- 28:19Alarm API Responses
- 29:26There is no substitute for a good identity team
- 29:59Remember
- 30:25Apply What You Have Learned Today
related talks
19mAdvanced Authentication Framework
17mImplementing Multi-factor Authentication
47mThe Psychology of Multi-Factor Authentication
22mGuarding the Gate: Strategies for High Security with Passkeys
42mChallenges in User Authentication: Balancing Security & User Experience
44m(in)Security is eating the world
24mAchieving strategic outcomes with FIDO: The phishing-resistant user
17m2FA in 2020 & Beyond