LOVE AND AUTHENTICATION ADDRESSING THE PROBLEM OF PASSWORD RESET
LOVE AND AUTHENTICATION ADDRESSING THE PROBLEM OF PASSWORD RESET, Google Tech Talks August 12 2008 ABSTRACT Abstract: One of the most commonly neglected security vulnerabilities associated with typical online service providers lies in the password reset process By being based on a small number of questions whose answers often can be derived using data mining techniques or even guessed many sites are open to attack To exacerbate the problem many sites pose the very same questions to users wishing to reset their forgotten passwords creating a common meta password between sites: the password reset questions At the same time as the number of accounts per user increases so does the risk for the user to forget her password Unfortunately the cost of a customer service mediated password reset currently averaging $22 is far beyond possible for most service providers In this talk an alternative technique will be presented It is fast and efficient is compatible with input constrained devices such as handheld devices and has low error rates It is in the process of being commercialized with a Fortune 500 company intending to deploy it Q109 An overview of the proposed system is available at www I forgot my password com and a demo at www Blue Moon Authentication com Speaker: Markus Jakobsson Dr Markus Jakobsson is Principal Scientist at Palo Alto Research Center He is a founder of the security startup RavenWhite which addresses security problems associated with authentication malware and click fraud He is also one of the founders of SecurityCartoon an educational approach targeting typical Internet users Previously he has held positions as Associate Professor at Indiana University Adjunct Associate Professor at New York University Principal Research Scientist at RSA Security and member of the Technical Staff at Bell Labs He is a visiting research fellow of the Anti Phishing Working Group APWG Dr Jakobssons recent books Phishing and Countermeasures Wiley 2006 and Crimeware: Understanding New Attacks and Defenses Symantec Press 2008 chart new territory in online security He received his PhD from University of California at San Diego in 1997