It’s 99 degrees at about 9:30 pm here in Vegas, as I complete my first day at PasswordsCon, which is technically a “track” at a larger two-day hacker conference called BSides Las Vegas. (The mother of all hacker conferences, DEFCON 23, begins on Thursday and I’ll be sweltering at that, too.)
My interest in passwords and authentication rose dramatically last fall, after my piece on StateoftheNet.Net, The Big Password mistake that Hackers are Hoping You’ll Make, also went viral on both Huffington Post and Alternet. Clearly, the subject is of great interest to the public.
So here I am at an event devoted entirely to passwords.
Today, I attended these talks, which I’ll discuss in more detail in follow-up posts:
Password Privacy and Keystroke Dyamics
Unspeakable Passwords
Pushing on String: Adventures in the ‘Don’t Care’ Regions of Password Strength
What Would Fix Passwords?
Tell Me Who You Are and I Will Tell You Your Lock Pattern
Scrutinizing WPA2 Password Generating Algorithms in Wireless Routers
Some of these talks were quite accessible to someone like me who lacks any serious expertise in hacker techniques, while other talks were quite technical. I’ll give you the gist of what all of them mean to the average person. I did learn a lot from these talks about:
Ways of tracking users online that I hadn’t dreamed of (and I’ve been covering online privacy for 20 years!)
Why password strength isn’t always as important as it’s cracked up to be
Just how weak Android lock patterns can be
How we humans’ predictability and laziness undermines so much of online security
How truly lousy router security remains
On day two of PasswordsCon, I’ll be hearing about, among other things, those annoying security questions we all have to answer, forgotten passwords, multi-word pass phrases and whether you actually need passwords.
I must give a big shout out out here to Genevieve Southwick (@Banasidhe), Executive Producer and President of the Board of Security BSides Las Vegas, Inc., who helped me get my credentials for BSidesLV after I had royally screwed up my registration process. Thanks, Genevieve!
