Password Intelligence Project - Advanced Password Recovery and Modern Mitigation Strategies

Explore advanced password recovery techniques and modern mitigation strategies in this conference talk from DerbyCon 3.0. Delve into recent enterprise password failures, the historic password problem, and how modern passwords work. Learn about password complexity, length, and common compromise methods. Discover how to obtain and dump Windows credentials into password cracking programs. Examine inherent password problems, recovery sequencing, and various attack dynamics including dictionary and brute force methods. Understand how to reduce key space complexity and implement the "Wheel of Fortune" recovery methodology. Compare presumed vs. guaranteed key space complexity and evaluate brute force password resistance. Gain insights on establishing multiple passwords, considering password vault services, and implementing effective solutions such as salting and encrypting stored credentials. Explore compromise detection strategies and strong multi-factor authentication types. Analyze the differences between 2-step and 2-factor authentication, comparing hard and soft tokens. Investigate 2FA application development and contemplate the future of two-factor authentication in this comprehensive exploration of password security.

DerbyCon 2013
Objectives
Recent Enterprise Password Fails
The Historic Password Problem
How Modern Passwords Work
How Password Complexity Works
How Password Length Works
How Passwords Are Compromised
Obtain and Dump Windows Credentials into Password Cracking Program
Inherent Password Problems
Recovery Sequencing
Dictionary Attack Dynamics
Dictionary Recovery Tricks
Brute Force Recovery (10)
Brute Force Lowercase (26)
Brute Force Advance Techniques
Removing Restricted Password Lengths
Reducing the key Space "Wheel of Fortune" Recovery Methodology . abcdefghijklmnopqrstuvwxyz - 8 Characters - 217,180,147,158
Presumed vs. Guaranteed Key Space Complexity
Brute Force Password Resistance
Length Trumps Complexity
Establish Multiple Passwords
Consider a Password Vault Service
Fixing the Problem
Salt and Encrypt Stored Credentials
Compromise Detection Strategies
Strong Multi-Factor Authentication 3 Types of Authentication
2Step != 2Factor Authentication
Hard Tokens -Strongest Most Expensive Protection
Soft Tokens - Good Protection at a Reasonable Price
2FA Application Development
The Future of 2FA?
Conclusion: 2FA - Knowledge is Power!