Password Security: From Zero to Hero

This talk walks you through the evolution of password security over the years, and also discusses the best possible methods for locking down your user passwords.

Transcript

1. Password Security From Zero to Hero! @rdegges @gostormpath
2. Why is Password Security Important?
3. LOVE YOUR USERS
4. Security Samurai
5. I’m Randall Developer Evangelist, Stormpath https://stormpath.com Python Hacker Formerly Co-Founder / CTO, OpenCNAM
6. Stormpath User Management API for Developers • Authentication • User Profiles • Groups and Roles • Python/Flask SDK
7. The Simplest Thing
8. Plain Text
10. Who would ever do this?!
11. http://plaintextoffenders.com
12. One Step Up The Hash
13. MD5 / SHA1
15. Brute Force
18. Rainbow Tables • SHA1 • SHA256 • SHA512 • MD5 • etc.
19. https://crackstation.net
20. Collisions abc123 == omgno!
21. Moving On The Salt
23. The Good • Rainbow tables won’t work! • Still easy to brute force. • Have to store your salt in the database. The Bad
24. Let’s talk about speed.
25. Slower is Better
26. bcrypt is slow
27. scrypt is slower!
28. But … Complexity Still Matters
29. Quick Recap
30. Next Up Storage
31. ? ? ? ?
33. Tips for Mitigating DB Attacks
34. Distributed Hash
35. Encrypting Hashes
36. Rotating Keys
37. Summary • Use bcrypt (or scrypt, if you live on the edge). • Lock your server(s) down. • Encrypt output if necessary. • Prevent human access.
38. Security is Hard, We can Help
39. Flask-Stormpath
40. So... • Don’t store passwords in plain text! • Check out Flask-Stormpath on Github: https://github. com/stormpath/stormpath-flask • If you liked this presentation, tweet us! @gostormpath
41. You are Awesome