welcome back it is time to go on an
emotional journey with phil talking
about passwords
phil is a developer evangelist for
twilio and a google developer expert
living in melbourne australia
he loves building web applications and
tools to help developers he once helped
build a website to capture everyone's
favorite sandwich fillings and he has
way too many github repositories
away from the keyboard phil listens to
scarpunk hangs out with his miniature
dash and ruby and is on a mission to
discover the world's best beers
if you find any good ones please tell me
uh over to you phil
thank you very much yes
i want to hear about all the best ears
and
i don't think i have time sadly in this
talk to get the dog on the screen
um but yes let's take an emotional
journey with a capital letter a number a
special character an emotional journey
for that character a subplot and a twist
ending
uh this might be the longest talk title
i've ever written but i think i'm in
love with it uh mainly because it's not
even my joke but we'll get to that later
um
as we started with my name is for nash
i'm a developer evangelist at a company
called twilio uh twilio if you don't
know is a communications platform
that is we're an api that you can use to
do
almost anything you want to communicate
with or between your users uh from text
messaging voice calls emails all the way
up to video chats and full contact
centers uh twilio has something for that
um
and uh if you do want to find me online
if you want to ask me questions either
about this talk or indeed about twilio
i'm basically filmmash all over the
place but particularly on twitter or
just drop me an email filnash twilio.com
so let's talk uh about passwords because
that's what i'm here to uh berate i
guess today uh but i wanted to start
with a bit of a story
about my own uh dealings with passwords
because i've been mostly terrible uh
over my uh lifetime usage of computers
uh and indeed my first password was
approximately the least secure password
one could ever imagine uh now this
admittedly was the first time i ever had
a computer account uh on on a machine
that you know it wasn't mine
uh i was at school i think i was maybe
12 or 13
and and choosing that password to log
into the computer system at school
and i picked uh the password nash yes
my
my my last name in all lower case a good
four character long password i i like
this
um i was i was delighted with this i i
was really quick at typing it because um
it was also part of my username um i'm
sure everybody else has uh
similar kind of first password stories
or terrible passwords and if you have a
terrible password uh that you no longer
use um please do share it in the chat
i'm i'm keeping an eye on watching that
as well i'd love to see the uh the
terrible things you might have thought
were a good password at one time
um
the second password was not better
actually i i
did get hacked and i'll tell talk more
about that in a moment
and so when i changed my password i
changed it to apparently i was geeky and
into i guess chemistry at the time and
changed it to atom still four characters
still uh all lowercase uh but that one
actually stayed secure for the remainder
of at least my usage of it um but yeah i
got i got hacked my my friends of course
got into my account
uh and um
uh
and thankfully like because i was 12 or
13 because there was barely any uh email
at the time because there was barely any
internet at the time
there wasn't a lot that they could do to
damage my account reputation uh bank
balance i guess there was nothing they
could do but i learned well i didn't
really learn less and i used a second
terrible password but i certainly
learned that losing access to an account
because a password is compromised is
totally totally worse
um there you go dog is a terrible
terrible password thank you that's
amazing one less character than i
managed to fit in impressive
um
and uh
thank you for these are great i love
this uh the stars also um
love it
um
so the problem is of course passwords
are terrible we know this we all
instinctively know this as developers
and people that care uh enough about
security to be here at a security track
at a conference
um we know this uh but we also know that
we have probably a whole bunch of users
that also like to make passwords with
systems that we build
and so whilst we
whilst we probably can now make better
passwords uh than those original ones oh
my goodness uh abc123
s and the s is really throwing things
off there
um
that that uh
you know we have to
create systems in which users also end
up using passwords and how can we make
that better
well
one way that we don't make it better is
via the guidelines
and this is where my talk title comes
from and really comes from a hilarious
tweet from a long time ago
you know the idea that your password
must continually state letters a capital
a plot a protagonist with good character
development a twist and a heavy ending i
love this um because these guidelines
we've all seen them we've all had to
accommodate them at some point in our
creation of passwords right we need an
uppercase lowercase number and a special
character one of everything get a whole
lot you win passwords congratulations
uh here's a password that won't fast
that
and
uh it's not a great password i mean it's
double the number of characters that i
like to use in passwords but you know
still still not a great one uh but this
one is a great one superb strong as
anything can't be beaten it's got a
capital letter it's got a lowercase
letter it's got a number and an
exclamation point what a special
character
um
uh incredibly special character probably
the one we will think of when you first
think of writing a special character
it's under number one anyway it's next
to the number we'd all put at the end of
that password in the first place and
this is the problem
uh
this pattern
is kind of indicative of how everybody
when given those guidelines starts to
think about their password
uh
they write you you capitalize the first
letter in that word you thought of you
stick a number normally one on the end
you stick a
special character normally exclamation
point on the end of that
ah passwords that end with a bang
exactly um
uh it's an exciting password it's a
secure password we know this and then
further those guidelines start to
suggest that you maybe change those
passwords regularly and you're like well
i already spent a lot of time thinking
of this one
and getting it to the stage in which it
was super secure so
let's keep that security let's keep it
in all in mind and just add like a
number i guess
um
or maybe another one you know like this
this kind of having to write new
passwords um just begets the same
pattern over and over again possibly
similar to those old ones
uh and this is a pattern the pat the
problem here is really the pattern
uh it's not actually the word password
that i've been using in this fake
password here but the pattern because uh
this uh to any attacker really just
looks like uh this it's an uppercase
followed by some lowercase possibly
making up a a dictionary word uh with a
single digit and then a special
character and if we have those passwords
we didn't expand the number of potential
passwords we had by adding these
requirements we actually shrunk it down
the attack space became a lot easier
because we have just a pattern to attack
and it's horrifying
so uh i have an example um i have an
example because back in 2018
um
there was an audit a security audit of
the wa government
an employee employee accounts and they
assessed 234 000 passwords which is a
pretty good you know assessment of
various people working in amongst the
government and uh a quarter of those a
quarter of those passwords are deemed
weak passwords
now these i don't know what necessarily
these uh passwords were accounts for
uh but these are people working in
government so probably you know somewhat
important and to do with people
um
yeah
we can see however
because they published the top 20 uh
passwords
and number one of course was password123
which is glorious 1464 people
in the wa government use the password
password123
and then they publish that top 20. so we
can have a look and see that all the
patterns that are there
now we can also tell that uh the wa
government did not require special
characters because no one used one um
not in that top 20 anyway
but we can see
uh all of the patterns that are there um
all of the uh dictionary words that
start with a capital and end in numbers
uh some of those numbers are dates right
we've got the the year 2017 the last
time they were made to change it clearly
uh and in fact you can imagine
that maybe a whole bunch of people uh
started at the same time and were told
kind of similar things so they all put
welcome one as their password or maybe
they all hit that uh
um
they all hit their password reset then
in august 2017 previously having seen it
in maybe spring 2017 or october 2017 and
people are just looking around their
office trying to think what am i going
to what am i going to make a password
out of they spot the calendar on the
wall and like it's monday that'll
that'll do it's the first monday
it's spring 2017. they look down at
their desk and there's a mouse there and
it says logitech on it and that's that's
the password
uh and this is the extent to people
uh kind of taking those guidelines and
turning them into passwords that we can
then
go ahead and and guess
as best we can
so
i want to tell you a little bit more
about what i thought was my best
password now this one is a password that
i lasted lasted with me for quite a
while um i don't
as far as i know actively use it anymore
but i'm not going to tell you exactly
what it is just in case just in case
there's something out there
but i will tell you a little bit about
it it had eight characters
you know i did up from the uh four of my
previous favorites
uh it was eight characters long there
were numbers and letters in there but
not special characters and actually not
lowercase uh numbers uh no lowercase
letters either uh uppercase only uh and
it was the model number of my hi-fi yes
as a and i was still relatively sort of
young at this point but i did look
around my room uh and see a hi-fi there
and just be like all right cool what's
the serial number what's the model
number on this can i remember it it's
eight characters and it's made in
numbers and letters it'll do
but this is great like it didn't
nobody stole it by seeing me type it
into a laptop uh type it into a keyboard
um
and break into my account that way
but of course i did eventually
uh get hacked
and this time around uh it's not because
it wasn't a decent password i don't
think anyone's ever gonna guess it but
um
it was down to repetition because of
course i was so proud of this password
uh so just genuinely delighted with how
strong i thought it was that i used it
everywhere
um
every single account whatever it was the
same password
and of course
unbeknown to me uh the security of uh
applications and websites on the
internet were not quite as strong as i'd
have thought they were
and uh and over the years we've suffered
many many breaches of um of uh password
data username and password data uh you
know some
where the password was stored in plain
text which is horrifying somewhere it
was just stored with a a fairly uh
breakable um hashing algorithm and so
my username and password has leaked out
many times uh from at least some of uh
these big ones like adobe or dropbox or
bitly
lastfm linkedin discuss tumblr there's
been so many it's been so many since uh
i put some logos on the slide um
and did this i think my
mine particularly were like leaked out
of i think linkedin and maybe
last fm and i lost access to other
accounts i lost access to
um
uh in one day i lost access to a skype
account and spotify account
and i nearly lost access to a dropbox
account so i know it wasn't that breach
that caused this issue
but the dropbox account i know i nearly
lost access because i got a text message
with a two-factor authentication code in
it and i did not
text that on to anybody else so
two-factor authentication saved me there
but on the same day i lost spotify and
skype now i imagine i managed to get
both of those accounts back
eventually
um
but
and and some yeah like the spotify
account was fine but the skype account
had been used for some old genuinely odd
things
uh in which um
i actually ended up i i got really
scared of the whole thing because i did
and deleted all the kind of text
conversations that had happened in my
skype account since i uh since i'd lost
it and it turned out that peop
whoever was doing it was behaving as a
french woman kind of proposing to french
men from my skype account with my
username
very very odd
but
um i managed to get it back and stop all
of that and hopefully the frenchman did
not get scammed out of whatever they
were
being scammed with
so if you don't already know uh the way
to
uh deal with uh this and find out if
you've been in a breach if you have uh
lost your username and password is to
hit up troy hunts have ibmpone.com stick
your email address in there and find out
that's great for you um but again we
have people watching a security talk we
probably are using different passwords
in different places
and this is not super great necessarily
for our users so how do we fix all of
this this is the real important part
i've told you my terrible password
stories and those password stories are
probably the password stories of our
users of our
of our applications as well so how do we
fix it
well first up the guidelines were wrong
i'm really excited about that
um
uh the guidelines uh i think the
guidelines that most people followed and
in order to make those like uppercase
lowercase digits and and special
characters written by originally by um
nist the national institute for science
technology in the us who are uh good at
that kind of thing and they were wrong
right they they led us to this kind of
thing if we've not seen this xkcd comic
then it is glorious um
and uh and and even the example uh in
our top left panel here of uh
of this password which is pretty secure
it certainly doesn't fit the pattern i
was talking about earlier this is more
uh throwing in uh leap text by changing
o's for zeros and and uh a for four
um still includes you know maybe the
number and the punctuation are at the
end there um
but right it does not take a long time
to crack one of these passwords
and if we'd just been doing really long
passwords past phrases
then we'd have much more much more
secure passwords
and so those guidelines did change and
nist uh updated their guidelines in 2017
uh but most of the kind of uh
english-speaking worlds uh security uh
forces so nist is in the u.s uh acsc is
the australian cyber security center and
the ncse is
the national
cyber security center that's in the uk
um two countries just using national to
mean
them it doesn't really work but um but
but the uk australia and the u.s all
public have published new guidelines
mostly following this although nist
actually uh suggests at least eight
characters it's australia that says at
least 14 characters and i like that and
i think if we're building applications
which require users to have passwords
and we want to validate those passwords
to be somewhat secure making them at
least 14 characters could be the best
takeaway from this or any talk about
passwords
um
so making at least 14 characters except
all characters uh i think we should have
more emojis in passwords i don't tell
anybody what emojis you're using in
passwords but you shouldn't have to be
uh held back to any kind of ascii based
character set or anything like that
except all characters including spaces
emojis and crazy things
um not crazy
you know what i mean and then don't
allow insecure passwords um insecure uh
here uh has a bunch of meanings
uh for example
uh dictionary words uh that's a
relatively straightforward one to stop
having
people using uh then repeated or
sequential characters uh as somebody
pointed out uh u l l l lld
uh
s is too many repeated ls there so
wouldn't pass as a password under this
uh circumstance
uh no contact specific word so not the
username of the user not the application
name or the email address that they're
using and then finally passwords that
have been in a breach do not allow
passwords that have been in a breach
this is a big one
so how do we do this in python and what
have we got available to us uh in python
to to do this
well i had a little look around kind of
popular
frameworks and how this is dealt with
and django has a really good start to
this which is nice um a lot of the time
i actually work with uh javascript and
ruby and there there is nothing like
this in terms of a a good default
um set of password validators that are
available to you
um
although i say that like these password
validators in django uh so we have user
attributes similarity validator so that
is not the same as your username or your
password or other attributes in the user
model minimum length which of course you
have to set and i say 14.
common password validator is uh
that's a checks against a list of 20 000
common passwords which is very good and
the numeric password validator is just
it's not all numbers now these
validators are available
in jagger but they're not actually on by
default but you can just add them in by
default so
i think that's really cool
i think it's very cool
um
then there's things like wt forms which
seems popular amongst uh flask um has
some validators available to it but
again if you just if you just whack in
that you know length min 14
uh then we're gonna make things mostly
happy i reckon
um
yeah
so uh so any suggestions on this uh just
to enable all those django validators
they're great or if you don't have that
make your password at least 14. and
finally my final recommendation is a
library called zxcvbn
uh it seems um
maybe hard to remember this one but uh
uh if you look down at your keyboard in
front of you you'll find uh if you're
using a qwerty keyboard that's just the
first six characters the bottom row it's
actually really easy to remember and it
makes a terrible password uh so don't
use it as a password
um but i'm just gonna i really love
zxcvbn um because of what it can tell
you about a password and it works with
that kind of idea of entropy rather than
uh
just length or um filling in those
guidelines
uh so i'm gonna
i'm gonna start to use zx zvb
zx cvbn uh just to have a look at a
couple of passwords if you have any
passwords you want checked
uh through this drop them in the chat
and i'll see them in about 30 to 40
seconds
uh meanwhile i'm just going to import
uh
from zx cdbn import zx2 vpn
and uh and just check
my favorite uh go to let's just start
with password password one uh and have a
look at that so zxcvbn gives you a load
of information about this uh for a start
um like the number of guesses it might
take
um in this case it's getting about 379
passwords uh guesses before you get this
um it tells you that it's a dictionary
word which is uh cool
um
and and excitingly it kind of tells you
some some display times that you can
show for like how long this will take to
crack
and so if you were trying passwords at
100 per hour
password one will be cracked in about
four hours
uh but if you can do that real fast uh
it's gonna be less than a second and
then finally and really really usefully
um
we uh it also gives some feedback for
users as well so this is a common
password here are some suggestions add
some more words
capitalizing the p wasn't particularly
helpful
um password dogs that's not gonna go too
well is that capitalist for capital
security
um
again similar uh similar to password in
this case we've got a dictionary word
it's gonna take a day this time if you i
can only do a hundred passwords an hour
uh and then four minutes at ten per
second
uh it's very common add another word but
more words are better um
uh
what do we our chat has run away oh my
goodness
uh
line of ducks
uh so zxcbn is is sweet for this there
is a web demo thank you for sharing that
matt um
i like to uh to check um other things
uh so
it also has uh what i wanted to point
out was there's a score and the score
goes from zero to four where four is the
strongest and so four is is the kind of
thing you're trying to drive people
towards uh really simple things like
hello is a score of zero i think dogs
with a capital s there came as a one
because at least there was a
capitalization in it um but if we want
to uh you know get to
strong ones we start using those
passphrases like correct horse battery
staple not a password you should use but
look at that score is four it's going to
take centuries to get anything that long
and i'm excited about that so zxcv bn
allows you not only to check passwords
in a sensible manner it actually gives
you those
gives you great feedback
uh to your users
to see why a password failed and help
them get a better
password what about insecure passwords
uh this kind of ticks off the guideline
problem but what about those um
uh insecure passwords uh that that we
talked about
well i mentioned uh have i been pwned um
troy hunt service for telling you
whether your uh email has been phoned
but that also exposes an api uh known as
the phone passwords api that has 613
million 584 246 passwords that have been
previously exposed in data breaches and
so we can use
uh phone passwords to check whether any
of the passwords our users are trying to
use with us
have been previously exposed in data
breaches
um
uh i have been exposing data breaches
and it has an api um now you might be
wondering aren't we just going to breach
a whole bunch more passwords if we start
swinging passwords over the network to
another api but don't worry about that
um the api is a bit more sensible than
that and uses what is called
a key anonymity uh model to um
not expose the password uh not share
passwords over the network
so what you do instead is you get the
sha1 hash of the password you want to
check
you take the first five characters that
hash
and then use that in the api request
within the url here so it's under
arranged with that five character prefix
and back from that you receive
all the hashes that start with those
five characters you receive the
remainder of all those hashes and then
counts of those
to show how many times that has appeared
in
the uh
in the data set itself and so you check
if the remainder of your hash is in this
result and at that point you can say
this uh this password has either been
breached or hasn't which is pretty cool
um and there's a phone password library
of course available in
uh and we'll go have a look at that
right now i just noticed that yeah i got
the wrong password it was dogs
jugs with a capital
or the exclamation point
and thankfully that's going to take a
little bit like still need a score of
one uh for the uh
and if it was dogs with a small ass oops
ah yeah no it's gonna take days uh days
if you're gonna do 100 per hour still
less than a second
uh because it's just words um
so again uh i'm now gonna
just gonna get um
opponent the passwords library in uh
imports
and now we can do things like uh check
those passwords so we can check
uh for example uh my first password
again i can check that uh it's actually
been a password
3219 times uh i've been in breaches 3219
times which is horrifying that uh my
childhood password has been used and
breached that many times
uh although it does prove that my second
attempt was slightly better with less
than half the number of breaches um
we had uh
dogs
um 152 times been breached out of the
capital
ah well dog with a capitalist an
exclamation point still not going to
take very long to crack but has not been
breached before which is nice to see
and if you were wondering
why you shouldn't use correct horse
battery
staple
it has been breached five times
so some people out there are not only
using the password correct horse battery
staple they're using it in places that
lost access to all the passwords and
gave it away
horrifying right
um
so that is the prompt passwords api i
highly recommend checking out and using
it to keep an eye on this kind of stuff
and like i said there is uh both uh
plain um phone passwords library
and there is a django
validator as well
so you might want to replace say the
common words validator in django with uh
the phone passwords validator
and the common words validator actually
generates its twenty thousand words uh
from the havon phone data set uh and so
it could be useful to try and use them
kind of in collaboration
um
so uh
um
if you wanted to hit like the common
words data set first and then if it's
not in there uh farm out to the api uh
but honestly the api returns so fast and
is uh is fully cached in cloudflare it's
it's um pretty impressive uh so it's
quick and it's always up
um incorrect host batteries they thought
well i want to check that now
not there cool that'll secure done
so i'm running out of time uh but i will
tell you that the next level beyond
making sure these passwords are actually
secure for all of your users is of
course to add a second level uh of
authentication a two-factor
authentication
um
i have that turned on in almost every
account i can and uh and if i can i do
it for an app if i can't then via sms is
still better than not having a second
factor of authentication at all so think
about that
and ultimately
uh my lesson for today is passwords are
terrible uh but not necessarily because
those um
not necessarily
it's not necessarily user's fault the
guidelines have been terrible uh but
users are pretty bad at this i'm pretty
bad at this although i've now got better
and of course have my own uh password
manager but passwords are terrible and
not everybody does that
password guidelines are worse uh
although the update to the guidelines
made them better so the next time you
see somebody else telling you need a
special character or a digit or an
uppercase letter tell them they're using
out-of-date guidelines because they are
bad
make passwords longer again make them at
just at least 14 characters and we're
probably going to solve a lot of these
problems for a lot of people
um check against those breaches and
against dictionaries check those words
up against the phone passwords api it's
it's actually a super useful and free to
use api
uh and finally implement two factor
authentication just just
make passwords less of a problem that
way
uh that's all i've got time for uh
thanks so much thanks for uh suggesting
uh things in the chat um and for all
your uh uh playing along with my
terrible passwords and um
uh yeah um enjoy the rest of python
thank you very much phil
you have come
right up to the time so if anyone's got
any questions please do ask them in the
hallway chat uh phil did say he's happy
to to answer any questions and i'm sure
you'll have a hundred different
passwords you want to run through these
two um i just i just bought a piece of
dishwasher yeah
it's looking good
[Laughter]
we will be back at quarter past 4
australian eastern time
for our next talk so enjoy your break
everyone we'll see you shortly
you