isomorphism of graphs now we have already seen that a graph G is an ordered pair of sets V and E where V is called the set of vertices E the set of edges now we have also seen what we mean by vertices and edges roughly speaking V contains some points and E contains pair of those points not necessarily all the pairs and each pair corresponds to an edge and it may so happen that there may be repetition of these pairs so that within two vertices there may be more than one edge more than one edges as well as there may be self loops now sometimes what happens is that we draw two graphs but there may be a one to one on to mapping from the set of vertices of one graph to the set of vertices of the other such that the adjacency of the vertices are maintained and in those cases we say that the two graphs are isomorphic now we go for the formal definition it says that two graphs G and G dash are said to be isomorphic well of course to each other if there is a one to one correspondence between the set of vertices and the between the sets of vertices and the sets of and the sets of edges so that the incidence relationship is preserved now let us look at an example now we have drawn two graphs let us call this graph G and this graph G prime now apparently they are different graphs but I will now give a one to one on to correspondence from the set of vertices of G to the set of vertices of G prime and the one to one correspondence one to one on to correspondence to from the set of edges of G to the set of edges of G prime and we can check that the incidence relationship is preserved or in another way the adjacencies are preserved that if two vertices are adjacent in G they will become adjacent in G prime and the corresponding edges also will be mapped to the corresponding edges so I will give the mapping so isomorphism of G to G prime so one side I write the one to one on to maps between the set of vertices the other side the one to one mark and on to mark maps between the set of edges so between the set of vertices we have a map to v1 b map to v2 c map to v3 d map to v4 and e map to v5 and among the set of edges one map to e12 map to e23 map to e34 map to e4 and five map to e5 now let us look at the first few correspondences so a is map to v1 so that means a is going over here and b is map to v2 that means that b is going to this point now a and b are adjacent to each other in the graph G now let us look what happens in graph G prime here we see that v1 is adjacent to v2 and what about the edge which is connecting a and b the corresponding edge is 5 and here we see the corresponding edge is e5 and according to our already defined correspondence we see that five maps to e5 that means according to this map a is going to v1 b is going to v2 and a b the edge a b that is labeled by five in the graph G is getting mapped to the edge e5 and which is the edge between v1 and v2 and this should happen with each vertices each vertex and each edge if it happens then we say that we have an isomorphism it is needless to say that finding out isomorphisms between two graphs is a very difficult problem and we do not have complete answer to this so that means that if I am given two graphs in general I do not have a quick or efficient way of deciding in general whether these two graphs are isomorphic or not but we can always hope to get some partial results depending on certain properties of the graphs now let us look at some partial results partial results on decision of isomorphism of graphs now what we will do here is that we will list down three rules or three conditions that two isomorphic graphs must have we will of course so later with an example that even if these conditions are satisfied it does not mean that the graphs are isomorphic what we can say is that if two graphs are not isomorphic then sorry what we can say that if these conditions are not satisfied by these two graph any two graphs then they cannot be isomorphic I repeat again we will give three conditions now what we will claim and what is very evident is that if there are two graphs for which these conditions are not satisfied then they cannot be isomorphic however we will give examples and show that there are graphs which satisfy these properties and still they are not isomorphic now let us look at the properties alright so if we have two isomorphic graphs then they must have same number of vertices and they must have the same number of edges three and equal number of vertices with a given degree now it is not difficult to directly see that these conditions are absolutely necessary for two graphs to be isomorphic that means that if two graphs are isomorphic of course these things must happen so if these things do not happen then they are not isomorphic but it is quite possible that these things do happen but still the graphs are not isomorphic let me give an example now we have a graph which we denote by G and another graph we denote by G prime now G has six vertices G prime also has six vertices now if you look at the edges G has four edges G prime sorry G has five edges and G prime also has five edges now if you look at the degrees now there are vertices with of degree one and in G there are three vertices of degree one in G prime there are three vertices of degree one and about degree two in G there are two vertices of degree two and in G prime there are two vertices of degree two and in G there is exactly one vertex with degree one sorry exactly one vertex with degree three and in G prime there is exactly one vertex with degree three now what we claim is that these two graphs are not isomorphic so we have to show that they are not isomorphic although it is now clear that if we look at these three conditions G and G prime satisfy all these three conditions now if we are trying to build an isomorphism suppose we write G as V, E and G prime as V, E prime we have to develop a one to one correspondence between V and V prime now it is obvious that the vertices of the same degrees will be mapped to vertices of the same degree because otherwise it is not possible to preserve the adjacency or incident relationship so the vertex X the vertex X has to be mapped to the vertex Y because X is the only one vertex of degree three in V and Y is the only one vertex degree three in V prime now if we look at this region this region we see that from X two vertices are connected which are of degree one but from Y only one vertex is connected which is of degree one therefore there is a structural difference between these two graphs if we think a little more we will see that no matter how we arrange our permutations or so to say the mapping between V and V dash I will never be able to map all the vertices in such a way that the incidence relationship is preserved that the reason is that as I said that this there are two vertices of degree one getting connected to the degree three vertex and here there is only one vertex of degree one getting connected to the degree three vertex therefore G and G dash are not G and G prime are not isomorphic although the satisfy they satisfy the three conditions given above although they satisfy the three conditions given above next we move on to sub graphs if we have a graph let us denoted by G equal to V, E we can always think of a subset of V well let us call it V prime which is a subset of V and we can consider a subset of E such that the end points of that subset let us name it E prime belongs to V prime such that the end points slash end vertices of the elements in E prime are in V prime then the resulting graph which is in some way a smaller graph than G getting derived from G is called a sub graph of G let me write the definition more systematically a graph G prime is said to be a sub graph of a graph G if all the edges of G prime are in G edge of G prime has the same end points or end vertices in G prime as in G so this is in a formal way of defining a sub graph but we can always remember what I have told in the beginning that a sub graph will have lesser possibly a lesser number of vertices and edges will pick up the edges from the set of edges of G which has got end points in that subset of vertices now we have got some observations related to a sub graph one every graph is its own sub graph well this is of course obvious then to sub graph a sub graph of a graph G is a sub graph of G this two is something that goes without saying and third a single vertex in a graph G is a sub graph of G that is also direct from the definition and for a single edge in G together with its end points is also a sub graph of G we see that these are more or less straightforward now we will move on to certain special types of sub graphs which are important in several applications of graph theory now we come to edge disjoint sub graphs edge disjoint sub graphs two or more sub graphs G1 G2 of a graph G said to be edge disjoint if G1 and G2 have no edge in common now let us look at an example suppose we have a graph like this so let us label the vertices V1 V2 V3 V4 and V5 and label the edges E1 E2 E3 E4 E5 and E6 so let us call this graph as G now let us look at a sub graph of this type V3 E4 no it is not E4 over here so V3 this is the vertex V3 E3 is over here E1 is over here V1 E2 and V2 and another sub graph V3 V4 here this is V5 so this is V5 like this and we have E4 E5 and E6 now suppose I write G1 as V1 V2 V3 E1 E3 E2 and G2 as V3 V4 V5 and E4 E5 and E6 then G1 and G2 are edge disjoint sub graphs see that this is the set of edges for G1 and this is the set of edges for G2 and there is no common edge but it does not mean that they do not have common vertices we see that the vertex V3 appears in both the sets of vertices of the sub graphs now we come to vertex disjoint sub graphs to edge disjoint sub graphs are said to be vertex disjoint if they do not have any common vertex now let us look at an example of a sub graph of a graph let us consider this graph where the vertices are labeled by 1 2 3 4 5 6 and the edges are labeled as A B C D E F G now let us consider another graph now this is of course a sub graph of the original graph so let us name it G and let us name it G prime G prime is clearly a sub graph of G before I end today's lecture I will introduce few more terminologies one is an isolated vertex a vertex of degree 0 is said to be an isolated vertex then a pendant vertex a pendant vertex and a null graph a graph with no edge is said to be a null graph now for isolated vertex an example may be like this suppose I have a graph over here a vertex like this suppose this is V1 V2 V3 V4 and a vertex is over here which is called let us say V5 this V5 is called an isolated vertex and a pendant vertex will be a vertex which has got only one degree so possibly like this V1 V2 V3 V4 and V5 this is a pendant vertex and a null graph will be graphs of this type which has got only vertices but the set of edges is a null set and then there is an idea of regular graphs a graph in which each vertex has same degree is called a regular graph and if this degree is let us say D then it will be called a D regular graph now we think of again the isomorphism problem here we will see that it is very difficult to solve the isomorphism problem for 2 D regular graphs whatever with the value of D which has the same number of vertices and the same number of edges with this I end today's talk thank you.


I am here to present a comparative study of the role of CT and ultrasonography in blunt abdominal trauma. Ames and objectives to study various radiological findings associated with blunt abdominal trauma to analyze and compare the efficacy of ultrason and CT in the diagnosis of blunt abdominal trauma to compare the individual merits and demerits and their superiority in the diagnosis. In this prospective study, 30 cases of blunt abdominal trauma were evaluated by Ultrason and CT in the Department of Radiology, BGMC Amhadabad between January 2021 to May 2021. Patients with abnormal physical examinations and abdominal symptoms, macroscopic hematuria, progressive abdominal distension, abdominal tenderness were included in the study. All patients underwent both CT and Ultrason and the time gap between the two was tried to keep the minimum. Ultrason was performed using the Samsung Okavix machine and CT was performed using 128 slice Siemens Sumetum Definition machine. Imagine technique was plain CT followed by IV contrast, oral induction contrast was given as per patient needs. Images were acquired following contrast in arterial venous and delayed phases. Reconstruction of the images with 1.25 mm sections was done. Multiplenar reformation and 3D reconstruction were done when wherever necessary. 70 ml of IV contrast was given, pre-scanned delay of 22 seconds for arterial and 48 seconds for venous phase was given and 5 minute delay was given in case of renal injuries, mainly to evaluate pelvic-alysal system injuries. No routine sedation was done. All images were viewed in soft tissue as well as long window settings beside bone window. Observation and analysis, blunt trauma in this series as health care in the world was found to be affecting the relatively younger age group 20 to 40 years who occupy about 58% and much more common in the male population, liver and spleen trauma. A liver injury accounted for about 50% on USG and about 67% on CT and spleen accounted for about 7% and 17% on USG and CT respectively. CT had detected 5 cases of hepatic trauma that were missed on USG and most of them were grade 1 injuries. CT had detected 3 cases of spleenic trauma which were missed on USG. Of these 2 were grade 1 and 1 was grade 3 injury. This is AAST grading for liver injury and spleen injury. Grade 4 and grade 5 includes vascular injuries, renal and pancreatic trauma, renal injuries occupy about 17% on USG and about 20% on CT. Pancreatic injuries occupy about 3% on USG and 13% on CT. CT had detected 1 case of renal trauma missed by USG which is a grade 1 injury and CT had detected 3 cases of renal trauma missed on USG due to obscuration by bubble gas. These are the AAST grading for kidney as well as pancreatic injuries. Coming to bladder and bowel injuries. In this study CT detected 1 case of bladder injury which was missed on USG. The reason for this could be the partially filled bladder and also CT's historiography was done when there was a doubt on blind scan. CT detected 1 case of bubble injury missed on USG which was 3% among all the cases of blunt injury to the abdomen. Though accurate localization was not possible pneumo peritoneum was found to be highly specific for bubble injuries in the form of perforation. Coming to hemoperitoneum. In this study there were 25 cases of hemoperitoneum which were detected both on USG and CT which is 83% among all the cases of blunt injury to the abdomen. And there were 3 cases of retroperitone hemorrhage which were detected on USG and CT which is 10% among all cases of blunt injury to the abdomen. And there were 2 cases of peritoneum which were not detected on USG but were detected on CT and which accounts for about 7% of cases of blunt injury to the abdomen. CT also picks up spine fractures. It is particularly excellent in depicting pelvic fractures also. This is the sensitivity and specificity of USG as compared to CT. In USG performed poor in detecting bladder and bubble injuries and also in periter wall hematoma and also in spleen and pancreatic injuries. These are the positive predictive value and negative predictive value of USG. Discussion The challenge in imaging of abdominal trauma is to accurately identify injuries requiring early exploration and at the same time avoid unnecessary operative intervention in cases that can be managed conservatively. In recent years CT and USG have replaced all other modalities of investigation up to a greater action. Omission of oral contrast agent in suspected bubble injury cases was not to be of any significant disadvantage in this series as one bubble injury which was detected on CT was confirmed on surgical exploration. Results In this study hepatic trauma was the most common injury detected on both USG and CT and this is a variation from standard surgical description of more common splenic injuries. The reason might be that surgically occult liver lesions are picked up more with the use of abdominal CT. Renal and spleen injuries were also common and were the most common injuries detected after hepatic trauma on both USG and CT. Pancreatic and urinary bladder trauma were low in frequency in accordance with literature. Immoperative is quite high in incidents probably derived from multiple sources. Few cases of retroperitone injuries, abdominal and pelvic fractures were also detected mainly by CT. Compared with CT, USG has low sensitivity for pancreatic, bubble and bladder injuries. Compared with USG, CT is extremely accurate and valuable in predicting occult bubble injuries in the form of traumatic perforations even without the use of contrast opacification of bubble. USG along with CT has a very vital role in accurate diagnosis, source localization, quantification, management decision making in hemoperitoneum. CT is excellent in diagnosis of associated injuries of spine, pelvis, skeleton and hence it is a single setting complete examination technique for a trauma patient. Conclusion CT is a superior diagnostic modality in the diagnosis of abdominal trauma. USG can be valuable in investigation, however USG can miss crucial injuries and may lead to inappropriate management in some patients. Hence it is imperative that all USG positive cases should be followed by CT. Similarly, CT must also be performed in symptomatic patients with negative USG scans and in patients with suboptimal USG scans. Although a higher USG or CT scoring of hemoperitoneum increases the chances of surgical management, hemodynamic instability and accurate imaging diagnosis or the main determinants which dictate the type of management strategy. It appears that asymptomatic patients with normal clinical examination and ultrason scans can be followed up without CT scan or indoor admission, restricting CT for only USG positives and USG negative symptomatic patients and for unsatisfactory USG examinations. These are the references I took for my study, thank you.


Welcome back, everyone. Sorry for the glitches there for a moment. So we are back for our last talk of the day, and I have just ceremonially cracked open one of the many NorthSec beers. This is the last one that remained in my apartment. So I'm very excited to welcome this next speaker. She spoke last year at NorthSec and was a really well-received talk. And the talk is going to be designing customer account recovery in a 2FA world by Kelly Robinson. Kelly works on the account security team at Twilio. Previously, she worked in a variety of API, platform, and data engineering roles at startups. Her research focuses on authentication user experience and design trade-offs for different risk profiles and 2FA channels. Kelly lives in Brooklyn, is an avid home cook, and spends way too much time on Twitter. I'm sorry, I editorialized with the way too much time. Apologies, it was just too much time. She tweets at Kelly Robinson. Yeah, please give her a virtual hand of applause. Welcome, Kelly, excited for this. Cheers. Thank you. Disappointed that I do not have one of those beers as well, but I will be ceremoniously cracking one up after I give this talk. So thank you everyone for joining us today. Thank you for sticking around for the end of the day and for this talk. I can tell you the exact moment that I was inspired to give this talk. Like a lot of things in security, user experience is one of the most important parts, and getting that balance right between usability and necessary friction is always something that we're going to have to keep in mind. And so when I tried to reset my password for this website, and they told me that resetting the password would just deactivate my 2Factor authentication, I was a little upset. But I think that this whole balance of usability and friction is especially true with authentication because it's one of the most common security measures that everybody deals with. And we deal with it on a repeated basis. We're logging into websites repeatedly day after day into multiple websites every single day. And so this is something that everybody kind of around the world is dealing with and is familiar with. And so we as security professionals have to be designing these systems in a way that makes sense. So no one expected to be quarantined for a good chunk of 2020, but I think one of the outcomes of this is that we're all doing a lot more business online, and that makes it increasingly important to shore up our online authentication and think about how we're allowing customers to regain access to their accounts. So I'm gonna be sharing some of the things that I think are good options for designing account recovery when users have 2FA enabled. I'm specifically calling out customer account recovery here because I think there's a different way of thinking about this problem for user facing applications compared to something like internal employee account recovery. So I'm gonna focus on consumer applications and end user security. So my name is Kelly Robinson. I have been working at Twilio for about three years. I specifically support Twilio's account security products for things like user verification and phone intelligence. This team has been evolving a lot since it was acquired. So the Opi team was acquired by Twilio about five years ago. Opi is our free consumer application for 2FA that you may be a user of. And this talk is going to incorporate both a lot of the things that I've learned from working on security products for the last few years, working with our developers and our customers on their authentication challenges, but also some of the things that we've learned from running a two-factor authentication product and a product that has an account recovery option, a product that has a lot of security considerations that we have to make around recovery and how that affects our customers that are using it. If you're watching this in a logged in Twitch account, Twitch is an Opi customer. So if you set up 2FA with Twitch that you're going to be using Opi for that. And I can tell you that when Twitch users need to reset their two-factor authentication, they're dealing with our support team and our support team are very, very lovely people. And we have to make a lot of considerations around how to make sure that people can get back into their Twitch accounts without having those accounts taken over. So of course we hope that users don't lock themselves out of their accounts, but there's a lot of common reasons that we have to take into account when we're designing these systems and we're designing account recovery. People forget passwords, that's a common one. They change their phone numbers, that's also common, especially in cases where two-factor authentication involves a phone number, which a lot of cases do. People lose devices, that could be an authenticator application or a physical hardware security key or they upgrade to the latest iPhone. Maybe they don't lose something, but they're getting a new device and they forget that there was anything important on that old device. But we have to figure out how to address these issues while still guarding against attackers and guarding against account takeover attempts. And addressing this is expensive. This can cost companies up to $70 per support call to unlock an account. So we have to be thinking about how we can minimize this cost while still protecting user accounts. So one thing I wanted to look at was the different factors that we have access to and how we can evaluate using these factors for account recovery. And one thing to note is that the more of you these that you collect from the user first signs up, the more that you'll have to trust and verify against when they attempt an account recovery. So generally, and I'll be walking through more concrete recommendations towards the end of the talk, but generally, even if you're having a user log in with two factors, you probably want to be collecting at least three factors at some point during an authenticated session so that they can make sure that they can log in with at least two factors if they lose one of the ones that they were using. So let's start with looking at them and the knowledge factors or things that you wouldn't know. And these could be passwords, security questions or specific account information. And these could be things like recent transactions or hopefully other secret details about the account. Knowledge factors are great because they're easy to use and to set up and they can't exactly be lost. The reason security questions became so popular as a recovery mechanism is because things like your mother's maiden name or the name of your first pet, those aren't things that are going to change and you'll likely remember those details. However, knowledge factors like passwords can of course be breached and many security questions or account details could be searched. It's not impossible to find the street that someone grew up on or guess the color of their first car. And so humans are of course forgetful. So anything like a password could also be lost that way. Looking at inheritance factors are things that you are like your fingerprints, your voice or even the way that you type or another way to identify you. The benefits of these is that you can't lose or forget these but the downside is that you can't really change these. So the risk is really high for these getting breached which makes implementation of inheritance factors delicate I would say. And it's a big reason that these aren't widely supported. So if you saw the fingerprint cloning talk from earlier you also know that these can be cloned which is very scary. But moving on to possession factors these are something that you have and these tend to be more secure than passwords because they can be harder to fish and don't get leaked in data breaches. So these could be things that you have like your phone, backup or recovery codes and hardware security tokens like Ubiquiz. Of course when it comes to something you have people are people, we're all human and we tend to lose and replace things. And that means it's hard to guarantee that these will be available for account recovery. And so possession also introduces additional friction when you try to set something up and that could be additional friction especially compared to something that you know or something that you are if it requires that you have access to a physical object then it's going to be a little bit of additional friction during that setup phase and that's something that you're probably also going to want to keep in mind. I specifically wanted to highlight one type of possession factor that we see a lot for account recovery and that's backup or recovery codes. And so these are given to you. So they're a little bit more likely to be longer and less likely to be reused. And so in that sense, they're a secret string that is a little bit more secure than a password but that means that people have to store backup codes somewhere and while some sites will give you specific options, some sites will tell you write them down, print them out and store them in a safe place, save them in your password manager, email them to yourself. I think that's a reasonable option. This is a screenshot from Instagram when you set up two factor authentication and they give you your backup codes. These backup codes are fake but the messaging here is real and they don't really give you any useful guidance. They just say make sure you keep them in a safe place and so what am I supposed to do with that? And while I haven't found any research on this and please if anybody has any research on how many people actually have access to backup codes when they need them, please share that with me but my hunch, my hypothesis here is that most people don't actually save these and so these become a somewhat useless form of recovery. And so like what is the solution here? There's a debatable solution here that you could email the recovery codes to the user. That's like automatically do that not tell the user to store them themselves but actually email them to them. Of course if they lose access to their email then they're locked out or if somebody gets into their email then all of a sudden it's not really 2FA anymore. They're also screwed if that's the case but it could be a better solution for some people and is that any better or worse than those of us who store our backup codes in our password manager? We're kind of all concentrating risk in one area. So I just have a lot of opinions about backup codes and so this is something that I kind of wanted to call out specifically as a recovery option. You know I'm not really saying that you should start automatically emailing users your backup codes but it might have a higher usability than whatever most people are doing today. So let's spend a little bit of time looking at a few companies and their account recovery processes. A lot of companies can be intentionally vague about this but some have really good documentation about their processes and some of these are companies that I've personally dealt with. So let's start with a pretty questionable example. So this is a financial services company that you may or may not know, I'm not gonna name them. They use a pretty interesting form of 2FA. It's a proprietary form of 2FA so I can't use you know, Authy or another authenticator app that allows backup. They just as a weird aside that doesn't really have anything to do with account recovery. They have you append the 2FA code at the end of your password, which is a little weird. But the thing that annoys me about this company is that so when you get a new phone there's not an automated process for transferring your 2FA to that new phone. You have to call the help desk of this company. As a millennial of course I hate calling anyone but it's not just that. When you call the company to reset your 2FA, what you have to do is authenticate yourself over the phone and like they don't really do any actual authentication. All they require is your username and your phone number in order to change this on your account. And so that's a little bit frustrating. It's kind of the worst of both worlds. It's not self-service online. So they're not like foregoing extra security for usability. They're making it a little bit harder to reset this process but it's also not even that secure. And since account recovery over the phone is so common make sure your company is securing your contact center with the same rigor that you secure your website. This is what I spoke about last year at NorthSec but I still think this is really important. So here's a blog post that I wrote this week about how to do call center security well. So you can find that on the Tbilio blog. Next let's look at Authy. So we're one of those companies that we don't outline in our public documentation everything that we do for account recovery but we basically require 2FA for any kind of account recovery. And so if the user has access to some of their factors and those factors could be a backup password, a sync device their mobile number and email the process is a lot smoother. So if they lose access to one of their factors but they still have access to at least two of their other secure factors then the account recovery process is going to go pretty smoothly but we also do enforce a waiting period that can be anywhere between one to four days depending on which factors you still have access to. And so if the user doesn't have access to some of the more important phone numbers or factors like phone numbers then we consider phone number an important factor here because so much of 2FA is still done via SMS. We do have additional requirements to allow them to change their phone number or regain access to the account. And so while users may be annoyed at some of these restrictions people tend to be more understanding about additional frictions when it comes to security products. If you're somebody that's taken the effort to sign up for an authenticator account then you're probably somebody that cares a little bit about security and is going to understand that this is something that's necessary. Next let's look at GitHub and GitHub is an interesting one. Fortunately I've never had to go through the account recovery process there but they have really extensive documentation about their 2FA setup and recovery process. And they also offer a lot of options for recovering your account. So one option here is recovery tokens. So make sure that you save your GitHub recovery token somewhere that's the easiest way to recover your account if you lose access to your primary form of 2FA. They also will let you fall back to SMS if you choose to do so. You don't have to fall back to SMS and I think that's an important distinction. And that would be if you have a stronger form of 2FA enabled like TOTP or WebOPN. They also do an interesting thing where you can configure your Facebook account to store recovery token. And this is an option that Facebook allows. You can get more information about how GitHub sets this up in their docs that I have linked here including the recover accounts elsewhere link. And so that's an interesting way to kind of store a trusted token on another device. The downside of this is that they assume that you have a Facebook account. They offer plenty of other options for you if you don't have a Facebook account. But the upside here is that you're able to, you know, you're probably more likely to be able to access your Facebook account than you are your GitHub account if you get locked out of that. But interestingly, I wanted to tell this anecdote. A friend of mine went through the account recovery process with GitHub and said kind of in line with this warning that's shown here. They told her that she could unlink her email address so that they could use it again to create a new account for her stuff and then in six months if the old username was still dormant they would release it to her. And so that's a pretty extreme form of a waiting period but that is one way that they can kind of slow down the process of an attack or taking over a trusted GitHub username. It's pretty extreme. It's pretty unforgiving six month waiting period is pretty long. And I don't know if that's true for all accounts. Maybe their account was especially high risk but definitely make sure that you as a, you know somebody that might be working with developers and working in code yourself have some recovery options configured on your GitHub account. Speaking of Facebook though, one option for account recovery on Facebook that I wanted to highlight is somewhat unique or at least tied to the features of that product. And so Facebook is interesting because they allow you to nominate three to five friends that can confirm your identity before giving your account back to you. And so this is a pretty cool idea. If your product has a social component like Facebook this could be a reasonable solution. I don't know if I would recommend building a social component just for this but that could be something that if there's other reasons that you have that in your product this could be a way that you could build account recovery and it's also a way to think about what are the unique aspects of your product that you could use for account recovery. One thing challenge here is getting users to set this up maybe a challenge. I'm not much of a Facebook user but I did so I had to dig into profile settings to find this generally. You don't want people to have to dig into profile settings to find these types of security features but maybe they haven't prompted me for it just because I don't log on very often. So those are some examples of what different companies are currently doing. And now I wanna talk through some concrete recommendations of what you can do through your company. And so the first one is that you want to have users register more factors than they need for everyday login. And so this is true both for one FA or for two FA but the benefit here is that you have additional trusted factors to compare against when the user loses access to one of their made login factors. And so the more factors that you have access to and the more factors that user has previously registered the more confident that you can be the right person is trying to gain access to their account and the higher chance that the user will still have access to at least two of their factors. And so generally if the user is logging in with two FA you wanna make sure that you're verifying at least two factors for them to regain access to their account. So you could register these at sign up that's a pretty guaranteed way to make sure that the user has these on their account or it could be during a different authenticated session. That's also really common. Get users signed up as quickly as possible and then have them add additional security later if they start to become an active user of your site. Requiring users to register additional factors at sign up is going to create some additional overhead in that process. If you have the notion of like a sign up or a growth team you might wanna be talking to them about how they're implementing this and how it will affect your registration numbers but it's definitely justifiable in certain use cases. If you're doing any kind of financial services or anything that is going to have a level of fraud detection and in place for creating making sure that people that sign up are real users. That's certainly a use case where you could have them register additional factors. ING Bank for example supports virtual video calls to verify new customers. But if you're an internet retailer you probably don't wanna be asking a user to upload a government ID. Another recommendation is that you do wanna design your recovery process based on the value your business is protecting. And so this means that you want to do some threat modeling watch Alyssa's great talk from earlier on that look at your account takeover costs and understand how much you're actually using. You wanna make sure that you're making the right level in an investment for your business. If you're in a higher value industry like financial services this could mean adding that additional friction to your recovery process but also make sure that you're considering this from your customer's perspective too. Do they understand the value of their account? So if a user is signing up for a service like Gemini you know a cryptocurrency exchange that user probably is willing to opt into more security than they would for like a DoorDash account. And this is a great quote from the security researcher Cormac Hurley where he argues that users reject a lot of good security advice but for good reason because a lot of security advice involves taking a lot of time and they either don't understand that time is a risk to them in their account that they're trying to add security measures too. They don't understand at the time they might risk losing or they might just not care. I was surveying some of my security friends about what they think of backup codes. And it was interesting because there was one person that was like, yeah I have this very detailed folder structure that I keep on a USB and a locked safe. And I was like, that's really great. I'm glad that you do that but like I'm not even willing to do that. I keep my backup codes in a variety of other places that is not that organized. But if that's something that me as somebody that thinks a lot about authentication and you know talks a lot about authentication and it has this kind of elevated paranoia compared to the average person. If I'm not willing to go to that level that's certainly not something that I'm gonna start recommending to the average person. But getting back to more recommendations you definitely want to be intensionable about who you're allowing to reset to FA or if you allow people to reset to FA. And so this is along the lines of looking at your threat model. Definitely be intentional about this. This was a conversation that I had in Twitter DMs where I was able to get customer support to reset my account completely, turn off my two FA. And that was just by giving them my phone number and my email. And so my Twitter account, it is my full name but that account is not tied to that profile at all. And so they might have done some validation there but I highly doubt that they did. And I'm not saying that like this company shouldn't be letting their support team do this but like I was wary enough of this that I don't want to tell you who this company was. And so because I'm more paranoid than the average person you know, this is something that I was like a little wary of but from a service perspective it was really easy to deal with. So there's that trade off but I'm not really sure like whether or not this was the right answer. And also the reason that I had to reset this this is just like completely a side note but the reason I had to reset my two FA code for this company is because it's not a company that I log into very frequently. And I wasn't getting any two FA codes sent to my phone. So when I was trying to log in they were like, check your phone, we sent you an SMS. And I tried to do that and I just wasn't getting any SMS tokens but it turned out that I had set up this account using AFI. And so all the two FA messages were telling me to check my SMS messages but they were actually not doing that because I had set up a TOTP token. And so that's just like a kind of a side that if you're one way to like help hopefully prevent two FA is to be clear on the messaging when you're sending two FA tokens make sure that you're sending them and messaging that you're sending them to the channels that users actually have configured. Another thing that you can do is prompt users to confirm information that could be used for recovery when they log in. And so this is one way that Twitter does that. This is the same idea behind things like security checkups and email notifications to review your account. I mentioned that digging into profile settings probably isn't going to be a very good way to get users to update their security settings. These types of prompts are one way to get users to either add additional factors and make sure that the factors that they have registered are up to date. And these reminders are relatively cheap and easy to implement. And this is especially compared to the cost of what a customer lockout or account recovery would be. Another recommendation, more than general prompts is that you can also time these reminders and get specific with them. And so time them around the holidays and around new iPhone releases. This is something that, you know, from the off the side of things we always see a higher volume of support tickets around the holidays when people get new phones and around new iPhone releases. And so that's when people are changing their phones. That's when they might get locked out. It makes a lot of sense. Like there's not really anything too crazy that's happening there. But an example of this is an email I got from Save Year last winter as just reminder to save your recovery codes so that you don't get locked out of your account. You know, all things used to be one of the only authenticator apps to support backups. That's no longer the case. This may be less of a problem now that more authenticator apps are starting to support this feature. And you know, usually when you change a phone at least in, you know, a lot of Western countries you don't change your phone number but this is something that in some countries people, you know, don't use their phone number as the same type of identifier and don't have that kind of static identity that we think of here. But even actually Google Authenticator just rolled out a token export feature for Android. It's not totally the same as the authenticator apps that support backups but it's one way to make that process of changing 2FA tokens between phones a little bit easier.  And so in a 2018 study that focused on the usability of Ubiquis, researchers found that setup success varied a lot depending on the platform that customers were trying to log into. And so users logging into Google had an 83% success rate of enabling 2FA but when they were trying to log into Facebook they only had a 32% success rate of enabling 2FA. And one thing that's interesting is 19% of people actually locked themselves out of Windows 10 because the system allowed them to enable the factor without ever doing a successful verification. And so a lot has changed since 2018 but I think this study is a really interesting look at how onboarding UX impacts user success. And so it sounds obvious but make sure that your users are completing at least one successful authentication before they ever enable that factor. And finally, the last recommendation that I have that you want to make sure you do is add waiting periods to deter hackers and give users real time or real users time to dispute any takeover attempts. Remember that your solution is not going to ever perfectly prevent attacks but in most cases you're trying to build something that's basically going to discourage people from trying. And so like Alyssa Miller was saying earlier in her talk about threat modeling, I think the goal here is to slow down an attacker and this is one very explicit way to do that. And this gives you as the website and as a service time to respond and protect legitimate users. So this is pretty common for high risk account resets. So GitHub, this is their notification that account recovery may take up to three to five business days. And so because this is business days you can assume that maybe there's like a real human that's reviewing some of these. Maybe they send these to their security team for review, I'm sure it's some kind of at least semi-automated process. Gemini which is a cryptocurrency exchange enforces a waiting period on any kind of withdrawals just for a password reset. And so this is not even resetting your second factor but this is one of the factors if you're resetting it and doing an account recovery here they're still enforcing that waiting period. And then I just kind of wanted to throw in some ideas into the ring for debate too. I already mentioned automatically emailing backup codes really curious to see what people think about that idea. We kind of talked about trusted contact authorization. Curious to see like if people have tried this and what the downsides are that's not something that we've decided to implement but I think it could work for the right context. What about like something like link site authorization? This is what Keybase pre Zoom was actually trying to do. The idea here was that if you know my account foo website is the same person as my Twitter account if you already have those linked could I tweet something that builds some kind of trust that I am the one that's trying to log back into foo website? That's certainly possible. Like I don't know how reasonable the implementation there is. And then one of the last things that I wanted to kind of talk about was SMS fallback. Like I've heard a lot of debates and had some debates about this whether that's a good option for recovery of a TOTP or hardware token or whether it defeats the point and it might defeat the point but I think it's better than nothing and it's probably going to lower overhead for support and that's something that's always important to consider too. So my general advice there is like offer SMS as a fallback option but don't make people use that as a fallback option. You wanna really delight your security conscious users and so GitHub does this like they offer SMS as a fallback option but you don't have to opt into that. You don't have to opt into SMS as a 2FA channel if you don't trust it. And of course, you know, what about blockchain? I'm just kidding. Please don't save your compute resources for something else but you know, debate that if you want to. So you know, I did mostly wanna focus on the positives here but I do have a couple of things that you shouldn't do. Don't for instance, let people only use one factor to regain access to accounts where they have 2FA enabled. We saw a wave of account gets hacked because they were protected with a password and SMS based 2FA. And then the attackers were able to sim swap the customer and bypass the password because they had a second factor even though the users had strong passwords. And so that's something that you really want to avoid. And also just like, please don't be this company. If you're going to disable the second factor on account recovery, honestly just like don't offer 2FA at least send a fallback message to the SMS. In this case, like I did still have access to my second factor for some reason I just hadn't saved the password in my password manager. And finally, don't let this discourage you. There's a lot of ways that you can think about designing this but don't give up on 2FA. This Google research shows that even SMS codes sent to a recovery phone number helped prevent 76% of targeted attacks and up to 100% of automated bots. So this is really good coverage and protect a lot of people from account takeover. Just put a little bit of thought into designing this process and you'll be golden. So like everything, this will depend on your business but here's some of the things that you might want to monitor as you adjust your 2FA onboarding, as you adjust your user experience and think about designing that and how you do recovery. Definitely be friends with your support team and make sure that you're aligned on how much friction you're forcing your users to endure because support costs may go up as a result of adding additional factors as a result of adding additional security to your authentication process. But that's okay if it's actually decreasing the relative amount of compromised accounts or the losses that you're suffering from account takeover. So I really hope that this talk is giving you some ideas for how to think about your account recovery processes. Again, my biggest thing here is that there's not a right answer here but I really just want you to think about it. Think about what's right for your business. Think about what's right for your users and adjust accordingly and introduce the right level of friction. So if you have any questions, please add them to the Slido or you can reach out to me on Twitter, this is my Twitter handle. Once again, my name is Kelly Robinson and thank you for listening. All right, the first question is from a bravely named user, Godel, I think. How is email a solid solution to store backup codes? If email is down, everything will go with it. Yeah, exactly. I didn't say it was a solid solution. I said it was a solution. And so like with everything, like you're gonna have to balance that against how usable it is. The benefit of that is that users are probably more likely to have access to their email account than they would to whatever piece of paper they printed out when they originally like store their backup codes. And so like this is one of those things that like I don't have the answer here. I don't know if there is a good answer for backup codes. I really want somebody to do this study. Maybe I'll just have to, you know, work with somebody in academia to design that myself. But yeah, I mean, there's a lot of benefits of like usability in these solutions. And so that's something that you're just gonna have to decide whether or not you want to take the risk there. Gotcha. All right, so next one. If I sum it up, register three plus factors for 2FA, right? Yes. Awesome. All right, at this one, I'm actually very interested in myself. Should we roll our own 2FA or use a third party provider? Or maybe if I can rephrase that, if I may, what are the risks of rolling your own?  So it depends, there's like some factors that are gonna be a lot easier to implement yourselves. Like there's a lot of libraries out there and most major languages for doing things like TOTP. You know, but that's something that's a somewhat complicated solution. Like you're gonna have to start dealing with things like time drifts and what you do when somebody gets locked out of it. Obviously I am biased since I work for a security vendor that offers 2FA. But the thing that you're gonna have to keep in mind is that a lot of channels like SMS, you're gonna have to outsource the actual sending of the messages anyway.  And so, you know, definitely like look at your options and see how many people you have available to support this, like anything that's with a build versus buy situation.  But the risk to building your own is that you're going to have to think about a lot more edge cases and then you're going to have to probably have more people around to support those and also support people when they, you know, get locked out. One of the other reasons that, you know, like a company like Twitch ends up coming to us for their 2FA is that we support the end user support when they get locked out of their accounts where they end up calling Twilio's account security team or Twilio's support team instead of Twitch's support team. That makes a lot of sense. Never have I ever been screwed over by a time drift. All right. So next one, how widespread is hardware token support? So you see this a lot more with internal like enterprise employee security right now. It's, you know, hardware tokens are based on top of something like Fido 2 or U2F or Web Auth N which are all like vaguely under the same umbrella of support. And not every device like or not every website has support for that yet. And so it's not super widespread, especially on the consumer side, but like you will start to see this a lot more with, you know, internal employees support and that kind of thing. And that's because it's a lot easier for the account recovery, honestly. So if you lose your hardware security key, like there's not like a lot of good ways to get past that if you want to make sure that that's something that is used to log you into an account. And so what a lot of people end up recommending is that you get two hardware tokens. And so you essentially have the same factor and then a backup duplicate of it that you would keep in an account or something. And that's, excuse me, that's gonna be something that's really hard to get a lot of consumers to do because there's a lot of overhead and setting that up. And, you know, there is a huge risk there. If somebody loses that token, like are you going to let them use a different factor for recovering that if they don't have access to that? So the short answer is it's not very widespread on the consumer side yet. I think that will start to change as more devices that we already have, like our phones adopt the WebAuthn standard. Google started doing this with Android phones, but right now, as far as I know, Android phones are only able to be a WebAuthn compatible authenticator for Google websites. Gotcha. So, Sorry asks, location can be an unseen factor. For example, when I went on holiday and wanted to log on to an app on another device, it wouldn't let me do that. How can users be informed? So there's a lot of these types of like silent authenticators that are starting to be introduced. And this can be part of like a biometric type authenticator that's basically using things about who or where you are to try to suss out whether or not that's something that we are comfortable with, letting you have access to things. The problem with these is that they're not transparent to the users. And so users can't really configure the settings around these. We see some exceptions to that, right? Like bank fraud is a good example where you can tell your bank, hey, I'm going to be traveling to X country for the next two weeks. Like if you see activity on my card there, don't like turn it off. But outside of banking, I don't know of a ton of examples where companies let you explicitly like give permission for that. And so that's going to be something that's challenging from the user management side of this. The other problem here is like, there's just like less, we don't have as much confirmation on this yet about whether some of these biometric authenticators, like there's some debate about like whether voice recognition is a good use case or a good authenticator for, we see this a lot in like over the phone support. People are trying to use this to help like save time in phone support. But there's also been studies that things like voice recognition are proven to be racist. And so is that a good option if you're going to be discriminating against the set of your users might not be. All right, I think we have time for one last one. It seems to have to deal with a bunch of the other ones that I'm seeing. What about FIDO U2F? So this is kind of what I was talking about with hardware security keys. So this is, you know, U2F is the universal second factor. And I think where we'll start to see more of this converges in FIDO2, the whole goal around using web authentication as a factor is that we want to replace passwords. And so we still might have two factor authentication, but the major factors that we're going to be using will no longer include a password. And so I don't know if like U2F is going to be the term that we're going to be using going forward. I think, you know, just for semantic purposes, web off-end and is going to be like, well, we'll see a lot more of. And to that point, like I think as the devices that we already have, like our phones start to become trusted authenticators, like we'll start to see that pick up a lot more because I'm not as likely to like lose my iPhone as I would be likely to, you know, lose a hardware security key that I only use to log into a handful of websites perhaps. And so the challenge there is like, how do we use the backup? How do you register another trusted secure factor in case somebody does lose their phone? Because that's something that, you know, we definitely have to deal with right now and giving some level of control to the user of what they want to allow as a trusted backup and trusted recovery device. In the case of lost phone is going to be something that I think we'll have to start explicitly giving users control over when they register those factors. Awesome, thank you so much. All right, thanks so much for being here again. Wish it could have been physically in Montreal. It's been a really great talk and thanks for closing out the afternoon, evening, whatever time is at this point in such an awesome way. Really appreciate it.


So, you went out with someone, hoping to be more than just a friend. In your mind, it felt like more than a date, but it turned out the other person had a different idea. It was just a hangout to get to know each other. Now you're confused, was it a date or a hangout? Love is always risky, because the potential for hurt is so great. The scariest thing about pursuing love is rejection. Someone you love could also move away before you could make your feelings known. In the words of Rolling Stones, you can't always get what you want. So we decided it might be helpful to share some ways to get over someone you were never with. Number one, accept those feelings. Right after a rejection, you're probably feeling raw. Sadness is inevitable, and you may even feel a little angry. While we can't say the feelings are rational, they are certainly understandable. Denying those feelings will only slow down the process of moving on. You'll be hung up on your feelings, insisting you don't care. Accepting negative emotions has been shown to reduce their effect and make people react better to stressors later on. It's okay to care. It's okay to feel hurt. Number two, ask yourself why. Once you have come to terms with your feelings, try to reflect on what happened, what went wrong. Perhaps you were too needy or didn't make a good impression. There's also a genuine chance that this person just wasn't into you. And that's okay. Through the whole reflection process, try to put yourself in their shoes. It's also important not to play the blame game and to try to remain objective. At this point, it isn't about who was right or who was wrong. Remember, the goal is moving on with a better understanding of how you approach your passionate feelings and relationships. Number three, repair your self-esteem. The sting of rejection can have a big impact on your self-esteem. You don't want this event to define how you see yourself. Feeling like you don't deserve good things or relationships can result from low self-esteem. So, to move on, we need to keep our heads high.  But this is unlikely to help in the long term. Rather than looking for external validation, try to build on a strong foundation by improving on the things that may be keeping you from feeling proud and accomplished. In other words, number four, invest in your growth. This sounds like business lingo, but it doesn't necessarily have to do with money or a career. You could use this time to improve your career as being single means you don't have an extra person to consider when making career decisions. But it can also mean becoming proficient in your hobbies and the things you enjoy. Most importantly, no matter what you do to improve your self-esteem, do not fuel it with bitterness. Improve for yourself and your inner well-being. Make sure that the decisions you make are about being happy and about genuinely improving and growing as a person. Number five, make some boundaries. It may feel like setting boundaries with someone you were never with doesn't make sense.  These boundaries are about you. It can be something as simple as muting them on social media. Sometimes people need these boundaries because after a night of drinking with friends, it can be all too tempting to send an embarrassing message out of the blue. And then, once again, things are awkward between the two of you. Other boundaries can be not doing favors for them anymore or limiting when and why you see them. Your boundaries should be in place to help you move on and should not be an excuse to behave rudely or emotionally manipulative. This is a tough time. Your heart must be feeling tender, so don't feel ashamed for still wanting to talk to them or to find another way to make things work. The best thing you can do is to talk to somebody about it. If not a professional, then you should, number six, embrace your other relationships.  The most commonly given reasons for having friends were to socialize, to be with people you like and, most importantly, to receive support. After facing any kind of rejection, time with your friends can be incredibly healing and vital for your mental health. Hitting over someone is not easy. Those butterflies in your stomach won't want to leave. Those warm, fuzzy feelings are hard to let go. Don't give up. To quote the Rolling Stones one more time, if you try sometimes, you just might find you get what you need. Moving on can only help you. What you need could be just around the corner. If you found today's video helpful, leave a like on the video. For more psychology facts, subscribe to Psych2Go and we'll see you next time. You've got this.


Hi, I'm Kate Young, and you're listening to This is Purdue, the official podcast for Purdue University. As a Purdue alum and Indiana native, I know firsthand about the family of students and professors who are in it together, persistently pursuing and relentlessly rethinking. Who are the next game changers, difference makers, ceiling breakers, innovators? Who are these boiler makers? Join me as we feature students, faculty and alumni taking small steps toward their giant leaps and inspiring others to do the same.  I've gotten to experience so many cool things through here. Grow as a person, kind of figure out who I am while I can represent Purdue at the highest level. It's been unforgettable and a really once-in-a-lifetime experience. I mean, there's nothing else like this out there. There's other big drums, but they don't do anything there where we do. They don't go out there on game days, performing tricks, sprinting down the field at full gallop. I mean, that's unique to us, and it's such a cool thing and such an honor to be a part of. If you've ever been to a Purdue University home football game, it's hard to imagine that experience without the Purdue All-American Marching Band. Established in 1886, the Purdue All-American Marching Band has become an icon of the university. This world-renowned band performs at each home football game and travels to concerts and festivals around the country and internationally. And of course, if you're an IndyCar fan, you've probably seen the band perform at the Indianapolis 500 as the official band of the Indy 500 since 1919. With more than 380 members, our band is the largest in the Big Ten and one of the largest in the entire nation. And an integral part of the band is Purdue's Big Bass Drum, also known as the world's largest drum. The drum recently celebrated its 100th birthday, and we caught up with Pam Nave. Pam's the associate professor of bands and orchestras and percussion instructor. She told us about what this iconic Purdue symbol means to her and the All-American Marching Band members. I think that because it's been around for 100 years, and it truly is the original shell, which as a percussionist who's got several degrees in this, I find that completely amazing. And if I ever look at the inside of this, it's super thin, but it is strong. And so the drum itself is just iconic in itself. But the fact that the crew does what they do, we've developed this over my 22 years being here. Before they would, when I got here was just running up and down the field. Now we've added the physical training to it, all these things that go in corporate to it, because to us it speaks for the university, not just our band department. Everywhere we go, we represent Purdue. And so we want these kids to be absolutely stellar at what they do. Talking, meeting fans, meeting unruly fans, anything like that. We want them to be amazing and can take care of themselves and take care of the drum. I had to teach them everything, which is totally fine, because that's my job, but it's a big deal. It really, really is. And after 100 years, 100 years celebrating this year. Wow. To me as a percussionist, finding a drum that's 100 years old, that is still in fantastic shape. That's actually really cool. As I said, we've recorded these interviews during Bandcamp. So you may hear some of the band in the background of our audio during this episode. But I'm hoping it'll give you that authentic feeling as if you're right there on site with us. After seeing Bandcamp firsthand on a 90-degree day, no less, I quickly realized how much time, effort, work, and dedication goes into being a member of the All-American Marching Band at Purdue. Right now we're in the midst of Bandcamp. I'm sure people can hear it. Yep, it's loud. This is a lot of rehearsal time. I mean, this is like a full-time job for these kids. So tell us about what all goes into not only Bandcamp, but the rehearsals all throughout the fall. At Bandcamp right now what's happening is all these students are auditioning all week. The freshman came in on Sunday, this past Sunday. The upper classman came in on Tuesday. Basically it's just training them what the Purdue way is. This is the Purdue way of the way we march. This is the Purdue way of our technique. This is the Purdue way we play music. And so this whole week is that process. You got to be able to play music in March at the same time. We're looking for attitude, making sure that they got a great attitude. We're looking for representation. We're looking for a willingness to work hard. And in this weather right now today, it's very humid today. And they're on a black top right now and they're sweating and it's hot, but they're there. At Bandcamp we're spending probably nine to ten hours out here a day. Every day. Every day. And then during the school year it's two hours a day, through 30 to 520.  For sure. And so 10 times eight is 18, so that's a part-time job. And plus they have to practice their music. They have to learn the drill. They have to be able to march the drill, play the music, watch the conductor. It's massive multitasking for every student out here. And not to mention the academics. Correct. I know that we have a slightly above average GPA on campus. I will tell you that these students are using their artistic side of their brains, as well as their academic side and the math and all those things. It makes for a great combination. So when they leave here, we hope that they can converse with people, have a conversation, talk about music. We want them to be on school boards. We want them to go all over wherever they go, play in a community band, be on school boards, promote music, all these things. That's what we want. We know they're going to be music majors. We want them to be projecting the arts into their communities and protecting them and making sure that it still happens. And speaking of the balance between academics and extracurriculars, one of the students within the All-American Marching Band balancing it all is Purdue senior Brandon Bledso, drum crew captain of the Big Base drum crew. So my title is drum crew captain or the one, which means I'm responsible for the drum crew and the world's largest drum. The reason why it's one is because the rest of the marching band, they have ranks and there's 10 people in a rank. So normally the people who are the student leaders are on the ends. So the one is the person on the left end and the 10 is on the right. The one and the 10 are the captain and co-capt. So I'm the one. And who's the 10? Meet Hannah Pike, a junior aeronautical and astronautical engineering major who is also the only female on the Big Base drum crew. It's nice to represent the female community within the drum line because there's more of us, but we're definitely lesser in numbers. So it's really nice to get to do that in such a public space. All the guys on the crew are like my brothers. We're all best friends. We're born big family. Even on the drum line, we're one big family. These are the people I go to when I need homework help or somebody to talk to. And these are my best friends that I'll probably stick with, probably for a really, really long time after college, specifically being a girl on the drum line and the drum crew. I really like having the opportunity to inspire other women to do things like this male dominant things. I'm also an engineering student. So I have that going for me as well. I have always found myself in male dominated things. And I find it as a really nice opportunity to inspire other women to do things like that. As I watched the hopeful students march across the hot black top that day, I could tell they all really wanted to make the cut. And all of this rehearsing was no walk in the park. Getting the opportunity to be a member of the prestigious All-American marching band is one thing, but the tryouts for the Big Base drum crew, that's a whole different level. And you were telling me earlier about this process. It's super physical. It's super rigorous. This is not a joke. Like it takes some serious physical endurance to handle this drum. Tell us about the process of being in the drum line and this drum overall. We take it very seriously. I mean, this drum is an icon for Purdue. It's been around for a hundred years and it's kind of an unofficial mascot. A lot of people think we're the actual mascot, but we're not. So as a representative of Purdue, we go through a very rigorous process. There's a PR test. There's a history test. There's a physical audition, which is the same as the air horses.  So that's actually working with the drum, learning the positions, how well can you move it, how well can you control it. And if you flunk any portion of it, you're out. You cannot flunk anything. No pressure. Hannah tells us about her audition process and claps back at anyone who may even hint that she can't keep up with the guys. Yes, it has happened. I've had people come up to me at football games and just like randomly on the sidewalk, like they'll sometimes say things like, oh, you're the only girl. How'd you get this spot? Must have been interesting. But honestly, I deserve to be here as much as anybody else because we do the same physical test. I completed them. I passed. I actually was a record setter for the females in our setup test. The record, I think, was about 88 and I beat it at 94. Nice. My freshman year. So I love to slide that in there whenever I can. I'm pretty proud of it. Got to say. And as Brandon explains, band practice doesn't always just mean rehearsing your instrument for shows. It's a lot of physical work that's put in in the gym and appearances and gigs outside of football games as well. So we have rehearsal every day, Monday through Friday from 3.30 to 5.30. And during that time, we do a lot of physical training. So we're doing a lot of running, a lot of push-ups, a lot of sit-ups. We work out in the gym, make sure we're lifting heavy weights, able to deal with the drum, spend time learning tricks. And on top of that, we also have game days on Saturdays which take about 12 hours anytime there's a game. That takes a good amount of time. But on top of all the other march band commitments with that, we also have outside gigs.  We're mascots. With a rich history of band first, innovation is key for our band. Purdue was the first marching band in the nation to break military ranks on the football field to form a letter, the Block P, back in 1907. Our band was also the first marching band to play the opposing school's fight song where their hats backwards after a conference victory, perform at Radio City Music Hall, receive an official performance invitation from China, and lead the Macy's Thanksgiving Day Parade from the Big Ten, among other firsts. Pam discusses one of her favorite moments with the All-American Marching Band, which highlights the very first trick with the world's largest drum. The first time I put someone on top of the drum with the American flag, it was an idea I had a long time ago. I tested it out with a lot of departments on campus. I actually had someone come in and test if it can handle weight. I don't know exactly what that test is, but I had him check it. I put my smallest member up there. I was like, cool. Then we added a rope so they felt more stable, kind of like they're riding a horse or something. And then I thought, and that's what we did is we put an American flag with them. And I had him before pregame started our show, I had him start at the south end zone and just walk real slow across the field. And you could hear people finally seeing it happen. And it was the ripples, slow ripple of roar. Like, wow, you know, they'd never seen that before. It was amazing. The crowd was on their feet. They were cheering. And all we did was walk across the field, but it was proud, strong. That was touching when we did that after 9-11. That was the first show after 9-11. We really did that full-blown flag everywhere. Then we did that again. That was surreal. That was even more touching that we could give something like that back just a little bit. And there's no shortage of tricks with the big base drum. We're on. We're on. We're on. We're flipping out down. Three. Yeah, there's a lot more that we do. I mean, we consider ourselves showmen. So we tried to put on a good show. And I mean, the drum weighs 565 pounds. So it's a lot of mass that we're throwing around. But you can do a lot of cool tricks with it. One of the cool tricks we do are called aerials. We're going to put people on the front bar.  There are times we run over other people with a drum line with the drum where it looks like we actually just hit them with the wheel, but they're perfectly fine. We'll do pull-ups off the side of the drum. There's a whole list of laundry list of tricks that we do. A whole laundry list? Hmm, this gave me an idea. Q Roadkill. This trick consists of a crew of four people running over a person with the 565 pound drum at full speed. And this time, that person was me. I seriously don't think my heart rate returned to normal for about an hour after that trick. Be sure to check out our Big Bass Drum videos on Purdue's YouTube page for more of all of these tricks. I've always wondered, how was Purdue's Big Bass Drum officially dubbed with the title of the world's largest drum? Well, luckily Brandon had to pass that PR history test we discussed previously, so he knows everything about it. Back in 1961, Cap Cap Asai, which is the marching man fraternity, they held a convention. They do it every year. During this year, we decided to hold a competition between us and the other drum that people thought was the world's largest drum, which was Big Bertha, down at the University of Texas. And both drums agreed to go to this competition. So we drove out all the way to Wichita, Kansas for it. We got there and they never showed. So because of that, we got the title of world's largest drum and have proudly awarded it since. And as Pam mentioned, this drum is an incredible condition for being 100 years old. Brandon tells us more about this historic drum. It's officially 100 years old. It's birthday was celebrated this past August 14th. So in 1921, August 14th, that officially was debuted out in Indianapolis. So we made this trip back over here to Purdue, where it's rightfully been for the past 100 years. It's a solid wooden shell. There's no internal supports, which is amazing for a drum size. The shell is completely original all the way from 100 years ago. The heads we changed a couple of times a year. So four heads a year. The rims will change occasionally. There has been damage done to the drum before when it's been traveling internationally. So we've had to replace some of the lugs on the outside. But other than that, we have six lugs that are original. The carriage that it is driven around on is completely original as well. It uses Ford Model A racing tires. As you can see from the spokes there, steel frame. It's as authentic as it gets. Just the wonderful co-captains of the big base drum crew that they are. The more I spoke with Hannah and Brandon, the more I learned about this drum. The head of the drum is actually painted by a local Lafayette man named Dave. And he does everything right at home in his garage. Brandon explains Dave's painting process. But it's really interesting the way he does it. He has one of those old time projectors that sat back in preschool and he just puts a little tensile up on there and just puts it up on his garage wall and just goes with the outline. And that's why I face the heads. Another interesting thing I learned during this interview was that several notable Purdue alumni were in the All-American marching band. Orville Redenbacher. You may know his name from Orville Redenbacher's Gourmet Popcorn. And R. Slater, the inventor of fiberglass. The Slater Center of Performing Arts, the site of the band's thrill on the hill football pep rallies is actually a gift from Slater and his wife. And another prominent Purdue alum who is also part of the All-American marching band, Neil Armstrong. Pam details Neil's involvement and passion for the band. He marched baritone. He was also in Kappa Kappa Psi, which is one of our music fraternities. He took his actual membership pin to the moon when he went. We still have it. He gave it to us. When he was around he would come to our rehearsals. He would just sneak in. And it was Neil Armstrong. And it was so funny because, you know, we watched people on the sidelines just to make sure everybody was okay. He was just by himself just watching. And we noticed who it was. And of course, I want to go meet Neil Armstrong. So I got to meet Neil Armstrong. That was for me, that was like super cool. You know, he was a member of our band and he still came back after years. Which shows how close this family is. It goes back over 100 years. It's always a link. You know, you meet people in the world and you say I'm from Purdue and then somehow they'll say, well, I was in band. Well, I was in band. What year were you in band? And then it forms a relationship where they were different generations. And so when we have alumni band, we put them inside with a, could be a current member alumni member, current member. So the alumni can meet the new kids and the kids can meet the alumni and form those relationships to us. It's also about networking. There who are, by the way, alumni, if you ever need kids for jobs, let's know. But, you know, the alumni out there are doing some great things and they come back to us. Hey, you got anybody in chemistry? I know someone who's really talented. It's not just about music. In fact, music is just the byproduct of what we do. It's important to us. Don't get me wrong. We want to be very good marching, playing everything. But it's also the relationships that we form as a faculty and a student as a staff and using this as a vehicle to bring us all together. It was clear to me that the All-American Marching Band is truly a family for all those involved. It's an amazing family. Every professor here is just so awesome. They've been with me through the best of times and the worst of times. And I've truly been one of these professors for me. They've been family. I've really enjoyed every minute I've been with this band and I've had so many great opportunities through it. I've gone through so many cool things. I've met so many celebrities and just so many cool events. It's just been such a great time. I really appreciate being part of this family. It really means to me that I get to represent the university that I'm so proud to be at. I take great pride in being on the drum line and specifically on the world's largest drum group. I worked really hard to be here, especially to be a co-captain. And I just really like representing my university and sort of showing what Purdue is all about through the marching band, honestly. I love marching band, so this is a great opportunity to get to do that.  When I look at back on my career, I trained to teach at a school of music and this was my first position right out of college. I fell in love with the students. I fell in love with the fact that they did this because they volunteered. They can get a credit for it, but it doesn't last for very long as they're volunteering. They want to be here. They want to learn. They want to get better. And I fell in love with that. And so I stayed. What taught me over the first several years was I'm trying to adapt to this. I'm trying to adapt to all these really smart kids.  And eventually what it turned into is when Professor Jake Ephart took over it started to become closer. The students were understanding that this is a family in the sense of we are going to take care of you. We are going to make sure that you're safe. We are going to make sure you're doing well in classes. We are going to make sure you're successful in life. So I tell people I use music as a vehicle to teach life skills, life things. This goes beyond music. This is our laboratory. So if kids fail here it's okay. But if they fail out there in the real world they could lose a job. Family member, who knows. So what we do is we try to teach these students what life is about with music. What would you say the most rewarding thing about leading this drum line and the big bass drum is for you? The students. No hesitation. That's the best reward. You meet new students every year. You form relationships with them. 18 hours together in a week you do get to know them. And by the end of their time here they want my recommendation letter. And I always ask you know hey do you know me as well as you know your chem prof or you know physics prof. They're like you know I know them pretty well but I really connect with you because of music. And so to me it's the student. That's why I stayed at Purdue. They're my focus. They're the reason I teach music. They're the reason I'm here in the hot 53 years old sweating. You know dressed like a kid because I feel like I'm in gym class. This is why I'm still here because of the students and our faculty is spot on. I mean our faculty and staff in our department just fantastic people we rely on each other outside of our work. We're all very close. And I actually think the students see that. They see that we're close. They see that we work together well. And we're hoping that they do that too but the best thing about what I do is the student. And what is it about the All-American marching band that seems to just exude the Boilermaker spirit and that sense of community. I ask Hannah who is involved in many different clubs and organizations why this Purdue community is so incredibly special to her. It's so special to me that you're so well balanced. You're majoring in engineering you're minoring in engineering you're the only girl as part of the big bass drum. How does this Boilermaker community in this Boilermaker spirit how does that impact you day to day. Yeah Purdue you know the Boilermaker community at Purdue has been amazing. I'm not going to go on to a school in Michigan but honestly I just really like the Purdue atmosphere and everything here especially the marching band that was a big pull for me because I really wanted to get involved on campus and that sort of thing and I thought this would be probably one of the best opportunities to do so. But yeah I don't know Purdue is an amazing campus great community. It's really you know compared to schools in Michigan it's really quiet which I really like especially being an engineering student and gives me a lot of time to study great and they've given me so many opportunities regarding like I'm a part of the minority engineering department so they've given me that and I've done a lot of volunteering for them they gave me band I've done a lot of volunteering with the volunteer management teams and band I'm part of the clothing team so we do the uniforms and we give uniforms to the band I'm also part of the idea team which is a new one as of last year it's the inclusion diversity equity and awareness team so we focus on the diversity within the band department as well as scholarships and that sort of thing I've gotten a couple band scholarships a couple engineering scholarships so Purdue has given me so many opportunities to do such great things and they really care about the students which I also really like there's a lot of study opportunities help opportunities within all these different departments and I really like that have we mentioned how impressive Hannah is oh my gosh oh no thank you Pam explains why music is so universal and how the band is able to share their presence of thousands of people throughout the world every year Purdue to me means basically family even the youngest kid two or three year old we hand them a mallet and they come up and they can barely swing the mallet in fact we have a kid mallet made for a little kid so it's lighter so they hit it and it shakes and they're just like you know they're maize or I have drumsticks with me all the time and if I see a little kid passing out along the way I'm recruiting really for drummers but I'm passing sticks out and you know the parents are really appreciative we're hitting kids little we're hitting adults you name it we've got the range music is a universal language without a question and it hits every age level every age level you know everybody likes sports too but you know maybe you can't play basketball at 95 I don't know you're awesome if you can but actually you can still play music if you're at 95 if you're physically capable you can't do this I wouldn't I wouldn't suggest anything like this but to me I think that that makes it a collective hope for the whole university is that we have a gift to give athletics have it has a gift to give ROTC has a gift to give PMO has a gift to give I think we all incorporate that and we give students a place to be and makes the university seem a little smaller we know it's big but it also is a collective whole can bring joy to those who aren't involved in any of these things and they can like it appreciate it enjoy it dance with it yell at it scream for it cheer for it you name it I think that's what makes it like a family gathering or something you know there's so many dynamics going on with everybody there that's kind of what this is and it's with everybody on campus not just what we do I love hearing how much pride Pam Hannah and Brandon have for the All-American marching band and for Purdue oh yeah I mean a drum crew has become my family that's why I'm so happy to be a student leader and be able to get back to them because they've really taken me in ever since I was a freshman part of it it's such a wonderful experience I've gotten to experience so many cool things through here grows a person kind of figure out who I am while in represent Purdue at the highest level it's been unforgettable and a really once in a lifetime experience I mean there's nothing else like this out there there's other big drums but they don't do anything there what we do they don't go out there on game days performing tricks that's unique to us and it's such a cool thing and such an honor to be a part of the one thing I want to say is how proud we are to be a part of Purdue and how proud we are as a faculty and staff and students to be able to do this in this setting and at a great university I would never thought I would ever work at a place where like something like this I'm just really happy that I have the position I had to meet the people like UK just met you today how cool is that that I get to meet all these people and travel all around the world there's no complaints here I think it's awesome don't forget to head to our youtube channel youtube.com to see videos of the big bass drum crew in action and you don't want to miss seeing me scared out of my mind as I got run over by this massive drum plus we're featuring the big bass drum on tiktok you can find us on tiktok at life at Purdue thanks for listening to this is Purdue for more information on this episode visit our website at purdue.edu slash podcast there you can head over to your favorite podcast app to subscribe and leave us a review and as always Boiler Up