In this talk we will show how a mobile phone can promote password security by relieving users from the need to type in long and complex passwords.
The need for stronger passwords and multi-factor authentication in today's digital environment is widely recognized. There are even special hardware devices offered on the market to facilitate stronger authentication: "password typing" tokens, tokens designed to act as a second authentication factor, etc. Such solutions are often limited, e.g., they can "type" only one password, limited to certain systems, or require significant backend integration effort from software developers.
In this talk we will re-visit the idea of using mobile phones in a multi-factor authentication. Unlike previous approaches, we won't limit ourselves with sending codes over SMS or OTP generation on the device. Instead, we will turn an Android phone into a "password typing" device that acts similarly to YubiKey(R) but is not constrained to a single password. We will also show how on-device password managers can be integrated with this feature to provide a very convenient and familiar UX.
David Weinstein, aka insitusec, is a software engineer and security researcher with viaforensics. His cutting-edge work in Android and embedded systems has contributed to multiple patent-pending designs, and he has recently provided expert consulting to DARPA and other government projects on mobile security. His dream is to become an honorary member of the Icelandic Knitting Association.