Hello friends, I am S.R. Doolange working as an associate professor in the department of mechanical engineering at Vanchana Institute of Technology, Sholapur. In this video, we will discuss on cost of quality or we can say cost of poor quality. Learning outcome At the end of this session, student will be able to apply and analyze the cost associated with quality while manufacturing. Contents Introduction Components of cost of quality Two kinds of cost References Introduction Definition of cost of quality Methodology that allows an organization to determine its resources Which are used for activities that prevent poor quality That appraise the quality of the organization's product or service And that result from internal and external failures Now in this definition, there are four keywords One is prevention Second is appraisal Third is internal and external failure So having such information allows an organization to determine the potential savings to be gained by implementing process improvements So these are the components of cost of quality So these are divided into four One is prevention cost Second is internal failure cost Third is appraisal cost Fourth is external failure cost Now what is prevention cost? So it is a cost to prevent or avoid quality problems So there are certain costs which comes under prevention For example, quality planning So quality planning is the planning of the production before it has to be manufactured So under that, market research, product development, inspection plan Which is related with the quality planning Documenting Manuals and procedures in order to achieve the quality Process control To control the process by making use of statistical tools And to control the variability in the process Quality assurance Assurance of quality in work, in process Investigation of the quality during the raw material to the product stage And training the manpower in order to get a good quality Second is appraisal cost So this is the cost of measuring and monitoring activities related to quality So in this, quality audit System, whether it is performing correctly or incorrectly It has to be audited The supplier is supplying the material So the supplier rating is to be done through the assessment and the approval Inspection and the test That is, inspecting equipment should be maintained at high level of calibration Maintenance and calibration of the machines is also important Third is internal failure cost Encouraged to immediate defects discovered before the product is delivered So this is on the production floor So the defects which are coming out of the production is to be avoided on the shop floor during the process So first is waste Waste is a result of poor planning Unnecessarily movement or the work Errors which are caused in the process Failure analysis that is the cause of internal product failure Scrap is which cannot be repaired Then rework where the more work is necessary in order to get a product External failure cost Encouraged to immediate defects discovered after the product is delivered Means the product is now with the customer So here repairs and servicing Warranty claims, complaints and returns So this is related with the customer Now the customer is paying the money And if the product is not suitable Then reputation of the firm will deteriorate Now for a moment think which cost is positive cost And which cost is dangerous cost In my opinion the positive cost is Prevention cost Because it prevents the cost required in order to get the good quality And which cost is dangerous cost Now the reputation of the firm is dependent on the external failure cost So if the product is written by the customer Then that is very dangerous So this cost is called as dangerous cost Now these are the components of cost of quality If suppose the appraisal cost increases What will happen? It produces lot of defects External failure cost increases what will happen? Producing lots of defect Internal failure cost increases it producing lot of defect Now to consider the cost of quality We must have to concentrate on these three costs One is appraisal cost Second is external failure cost And third is internal failure cost So this should be kept minimum In order to come to a product Wherein the products are within the specifications Now there are two kinds of cost One is visible and another is hidden Now certain costs are visible As we have seen in the prevention cost In the internal failure cost In the appraisal cost The certain costs are visible And certain costs are hidden costs Actually the hidden costs are more As compared to the visible cost So in order to get a high quality product We must have to concentrate on this hidden cost So what are these hidden costs? Engineering changes in order So if suppose you change the design frequently Then that results in a high cost If the cycle time is high or long Then it results in high cost Time value of money So production should be done with a minimum time Or the optimum time Long setups If the setups are more Then the cost associated with that will be more Working capital required will be high If suppose we keep more inventory If we lose the customer loyalty In that case it will Be having an impact on the organization reputation Excessive material handling Or the planning or the order Also leads to the high cost Access inventory which is kept in the store Or just in time Is the technology which is used In order to overcome this excess inventory Late delivery If the product is delivered lately to the customer So it is a loss of reputation for the firm Loss sales These sales which are lost due to these hidden costs Are more There are certain visible costs One is the rejection Second is the warranty Third is the inspection Fourth is the scrap And fifth is the rework Rejection leads to the high cost of the product Because the manufacturing cost increases So warranty claim by the customer Is the bad reputation for the company Inspection cost must be optimum So to get the optimum inspection cost Generally acceptance sampling is used Instead of 100% inspection The scrap must be avoided Because the scrap is negative for every organization Rework should be minimum Because sometimes it may happen that Rework is essential It has to be kept minimum So it is necessary to have A minimization of the visible As well as the hidden cost So this is about the cost of quality And these are the references


All right, 2017 is the year of Linux on the desktop. Let's give Mr. Levison a big hand. Yeah, anyone want to know why it took so long for them to switch from VGA to HDMI? Now you know the answer. All right, folks, my name is Ladar Levison. For those who don't already know who I am, I'm the owner and operator of LavaBit, an encrypted email service that suspended operations in 2013 after being forced to become complicit in a man in the middle attack. Yeah, I'm that guy. Last couple of years, I've been working on darkmail, but that is a talk for another day. What I'm here to talk about today is really to give you guys a crash course in compelled decryption law. Or in technical terms, just how the Department of Justice is using the courts to force people to decrypt their data at gunpoint. Over the past three years, I've become an expert on compelled decryption law. I had to learn this information the hard way. Hopefully by sharing it with you guys here today, I'll help some of you avoid some of this pain in the future. Now, before I get started, I'd like you to take note that I've compressed this presentation into approximately 3,000 seconds. Huffman encoding rules do apply. This means it may feel like you're drinking from a well-endowed fire hose, which looks something like that. But if you're at this conference and you're attending my talk, or you're taking the time to watch this at home, you're probably smart enough to drink in this information without the help of a sippy cup. The problem is easy to express.  More specifically, what I'm saying is that the DOJ has been taken over by a group of individuals who derive sexual gratification from manipulating the law to achieve a specific end. Whether those ends are a benefit or a detriment to society is in the eye of the beholder. I shall leave that for you to decide. What I'm here to talk about today are the legal doctrines, or shall I say the doctrinal perversions being used to attack encryption technologies. The issue stems from the belief which is slowly proliferating throughout the ranks of government and law enforcement that they are entitled to all of our data. And when I say our data, I don't mean the ciphertext. I mean the plaintext. You should also know the DOJ blames the InfoSec community and our efforts to improve the security and privacy of information as being the problem in and of itself. The bigger the barrier, the greater their demands for assistance. The DOJ believes it can use the courts to compel decryption and or conscript others to assist them in defeating it. If you ascribe to their belief, then the DOJ is entitled to any information which might assist them in their investigation. The DOJ has argued they can use existing statutes to seek assistance, which in cases where Congress has not explicitly prohibited a specific action. They like to view the All Ritz Act and some of the other generic language in the statutes as effectively being a blank check. The only thing standing in their way to date is the court's willingness to exercise its authority. This might be a good opportunity to tell you that about 60% of the sitting judges were former prosecutors. My goal here today is somewhat modest. You should know, going into this, that in order to exercise your rights, you may have to go to jail. My hope is that by sharing some of this information with you here today, I will increase the possibility or the probability that you will be released should you find yourself on the wrong end of a gavel. My second goal is to arm you with enough knowledge to have an intelligent conversation with your lawyer. If they tell you your choices are to comply or go to jail, you should probably look for a different attorney. And that's because knowing is half the battle. Now I'm gonna cover two major areas of law. And I figure it's good to start out by defining the terms, since first party and third party aren't typically terms you hear while standing next to the company water cooler. First party refers to situations where the government seeks to compel decryption from a suspect. In other words, to force them to decrypt their own data. Third party refers to situation where the government seeks to conscript a company like Lava Bit, My Own, or Apple, or any of the other secure communications companies or secure data storage companies out there to assist them in accessing encrypted information without the user's assistance. It's cutting off my notes. What's a presentation without at least a few problems. If you're wondering who the second party is, it's the government. It's worth noting that a common strategy is to convert first parties into third parties by granting them immunity. The key phrase to remember here is derivative use immunity. If you believe the government is honest, then typically derivative use immunity is what you need to protect you. Your lawyer can explain the rest. On the other hand, if you believe law enforcement is dishonest and will use the information they obtain against you regardless of where they got queued on to a particular line of investigation, then no amount of immunity can truly protect you. You may find it surprising to know there is no law on the books that specifically grants law enforcement the right to compel decryption. You might find it equally surprising to know we have no right to privacy here in the United States. What we have is the Fourth Amendment which protects our homes from search and seizure without probable cause. Now the government has been very careful to distinguish that from a right to privacy. I'm only gonna give you half the presentation. There also aren't any Supreme Court cases yet which deal directly with compelled decryption. What we're going to be talking about are the handful of district and circuit court decisions which attempt to draw from older Supreme Court decisions which involve corollaries in the physical world to make extrapolations about how they should handle encryption in the modern day. What's important to understand about the law is that only decisions by the Supreme Court are binding upon the entire country. Decisions by an appellate court in a specific circuit would be binding upon all of the courthouses in that particular circuit. Feel free to pick out your own state and see which circuit you happen to fall in. This isn't to say that decisions in other circuits aren't relevant, quite the contrary. Judges will often consult the opinions from other circuits before making their own decisions. Now, before I jump into the cases involving encryption, I thought it would be worth starting with two older Supreme Court cases which have been heavily cited in all of the modern day cases. The first is Fisher v. United States and it comes from 1976. It gives us the closest thing we have to a Fifth Amendment right against self-incrimination by being forced to decrypt our data. In this particular case, a individual was being forced to surrender documents. And what the court said is that the Fifth Amendment would not be violated by the fact alone that the papers on their face might incriminate someone. For the privilege protects a person only against being incriminated by his own compelled testimonial communications. Because the documents were created voluntarily, the court held they could not be considered compelled testimonial evidence. In other words, all of the information on your hard drive already was created voluntarily. And therefore, as far as the courts are concerned, is subject to subpoena or search. The only thing standing in its way is the ability to access it. Now in Dove v. United States in 1988, we get the origin of the current testimonial doctrine. In this Supreme Court decision, the court held that a statement is testimonial when the government compels the individual to use the contents of his own mind to explicitly or implicitly communicate some statement of fact. Now I don't know about you, but I keep my passwords in my brain. Some people even call that my mind. Other people say it's my girlfriend. She's the one that makes all the decisions. This particular decision is rather important because what it says is it draws a distinction between information that exists only in your head versus information that might be somewhere else in the physical world. Now what we get from a much more modern case that actually derived from the Clinton's Little Whitewater scandal, everybody remember that from the 1990s, is that knowing the location of a particular document is in and of itself testimonial. How this gets applied to encryption is that the information on the drive is not protected. What's protected is whether or not you have access to it. If you can decrypt it, and the government can prove that, then effectively your Fifth Amendment protections begin to fall away. Keep that in mind when you find yourself being questioned by law enforcement. If the government can claim that the production of the information is a foregone conclusion, then it holds no testimonial value, and thus they can force you to decrypt the information. The first case we have to talk about, which directly involves encryption, involve Sebastian Boucher and his father as they attempted to cross the Canadian border into the United States. In this particular instance, one of the officers found a laptop in the back seat and without needing to enter a password, he was able to access approximately 40,000 files on the laptop, some of which appeared to contain pornographic images. An ICE special agent then investigated further, finding thousands of images of pornography, including one labeled in a way to suggest it was child pornography. The laptop was powered down, and when the investigators tried to power it back up, they realized they could no longer access it because it was encrypted. In this particular case, they already knew what was on the drive. The only question for the courts to consider was whether or not Boucher's knowledge of the password was in fact testimonial. In other words, we create this doctrine of reasonable particularity. If the government can prove that you know how to access the information and it knows what information it's seeking ahead of time, then it can force you to decrypt your hard drive. In this particular case, the government's initial request was thrown out. It was later narrowed by the prosecutor such that he only required an unencrypted version of the drive, and he sought approval from the magistrate judge based on the foregone conclusion doctrine we discussed earlier. The district court reversed this decision, saying that you don't need to know the specific contents of the files, you just need to be able to demonstrate that the files exist. In other words, the investigator saw the file names and was able to use that to overcome the particularity and specificity requirements. What that means is that you may wanna start encrypting the names of your files in addition to the files themselves. This particular example was taken from one of my favorite ransomware applications. Nice to see they're doing some good. The next case we have to talk about goes all the way to 2013. In this particular case, agents raided a suspect's home and seized a hard drive containing files which indicated they might contain child pornography. Initially, the demand to decrypt the data was rejected by the court, but upon further review, the judge reversed himself after the prosecutor demonstrated ownership and access to the encrypted data. By showing the drive contained personal financial information belonging to the suspect, he was able to prove ownership. You should keep this in mind and share this with your fellow DEF CON attendees who like decorating their computers with identifying marks. For example, if you're Bob Hoskins and this is your notebook computer, you might have a hard time denying that it's yours. Or Daniel Radcliffe would need some pretty potent magic to deny this was his computer.  In this situation, oh. Moving on to another case which takes us back to a circuit court decision and this is one of the few decisions we have at the circuit level. Remember, which means that it's binding upon the entire 11th circuit. Involved the situation where the government obtained a warrant to search a hotel room for any electronic devices found in possession of John Doe. They suspected Mr. Doe of sharing Kitty Point, porn. Certain portions of the drive couldn't be examined by the FBI because they were encrypted. A grand jury subpoena was issued which required Doe to produce the unencrypted contents of the hard drive. Doe claimed his Fifth Amendment right against self-incrimination. In other words, he tried to exercise the Fifth Amendment in order to protect him from being forced to testify. That testimonial exception that we talked about earlier. The government unilaterally gave him active production immunity to circumvent the claim and thus forced him to decrypt the information. Later on, the appellate court went back and reversed the decision, saying that the government had not reached the standard of reasonable particularity that is required. In other words, it must prove it knows the existence and location of encrypted files and offer reasonable evidence to suggest the encrypted files will contain the incriminating evidence. Unfortunately, part of the slide is cut off. Windows. I like to blame Microsoft for everything. Precisely what qualifies as reasonable particularity remains an open question. For example, if the government knew a spreadsheet found in a file called Corporate Financials, would that qualify as reasonably particular in a tax evasion case? We have one of our best tests of this particular doctrine of law currently taking place in Philadelphia. In this particular case, this suspect, a Philadelphia police sergeant who we shall call Galileo, was relieved of his duties and has refused to unlock two hard drives that were seized from his home more than seven months ago. He has since been found in contempt of court for refusing to decrypt the drives and currently sits in jail awaiting a decision by the appellate court. In this particular case, the evidence against him consists of a sister who claims that she saw images and videos on the drive that were of underage individuals posing in a pornographic nature. A subsequent forensic exam of his Mac found a single image of a young approximately 12-year-old boy in a bathing suit. Now, what's interesting about this particular case is that they managed to decrypt the Mac by accessing his iPhone 5S, whoops, which he gave them the pin code to voluntarily after which investigators searched the phone and found an app on there, what they call it, secret apps that was supposed to have protected his information. In other words, don't believe everything you hear about the protection of your information. They managed to circumvent the security of this particular app and they found a screenshot of the recovery key for his Mac Pro. They were able to use that to access the Mac. Like I said earlier, the only incriminating evidence they found on the Mac was that singular image that may or may not have been of an underage boy who was not naked but close to it. They also found evidence in log files that he had visited various groups called toddler CP, lollycam, hussy, child models, and a few others that I can't even pronounce. Collectively, they used that as the evidence against him to compel decryption of the two external drives. As I said, the case is currently pending. What this particular case introduces is something that I wanna make you guys aware of here today. When you print out or save off a recovery key, it is subject to subpoena and or search by the government if they can prove its existence and know its approximate location. Now for those who don't know, a recovery key, and in this case, I'm using BitLocker from Microsoft, is basically an alternative to your password. In the case of BitLocker, it's a 48-digit number, which by my math is approximately a 160-bit key. Now, what's important to know is that initially, when BitLocker first came out, the FBI was quite concerned about it. But when they realized that every user who was going to use it was going to be creating a paper copy that would circumvent it, and the FBI could thus search a person's home and find the recovery key, it became far less of a concern. As we move into this next area of law, it's important to understand that the Supreme Court has held that certain physical acts involving the surrender of a physical object is not considered testimonial, and thus not subject to protection by the Fifth Amendment. Giving a blood sample or providing a voice sample have not been considered testimonial as they do not require the suspect to disclose any knowledge he might have about his or her guilt. What this means is that anybody who likes the iPhone Touch ID isn't very safe, which is probably about two-thirds of you. What you need to do is combine it with a piece of information that is locked away inside your gray matter, something like a pin code. But unfortunately, what we're learning is that even a pin code isn't necessarily safe because the vendor can be compelled to modify the product and make it susceptible to a brute force attack. We'll talk about that more in a little minute, in a couple of minutes. What this all means is that what you really need to do is pair your biometric token with a strong password, at which point you should probably start to ask, what's the point of using the fingerprint in the first place? I'll just briefly say that if an external person or organization can access the information necessary to decrypt your information, in all likelihood they will be forced to surrender it. Turning over user data or data created as a derivative of user actions is what I call ordinary assistance and has been common for quite some time. Some of the most simple language that describes this is Kalea, which we don't have time to cover. Instead, what we're gonna talk about is Smith v. Maryland very briefly. It's a case from the 1970s which involved a pen register order that was placed on a suspect's device without first receiving a warrant. And the Supreme Court later came back and said that it was legal because A, the information being collected was normally collected by the phone company and B, there was thus no expectation of privacy. That expectation of privacy phrase is key. As a result of that particular ruling, Congress decided to pass the pen register trap and trace statutes. Now, it's important to understand that these particular statutes were passed when this is what a pen register device looked like. There is no way they could have conceived of encryption at that time, let alone that the language they had written which required providers to provide assistance with the installation of this device as including the necessary and requisite authority to demand an encryption key, unless you're in the Department of Justice. Now, that expectation of privacy is a key phrase because it's the phrase that the government has been using to steadily and slowly chip away at all of our collective rights. This particular court opinion ruled that email communications work private because somebody assumes the risk that they will leak once they share them. Now, I don't know about you, but I consider my email pretty private. The fact that it isn't is probably something that should be shared starting with Hillary Clinton. Now, before I show this next slide, I'd like to do a little poll. Can everyone please raise their hand that thinks the information on their personal computer is private? Go ahead, raise it.  Now, for all those folks with their hands up, how many of you also connect your computer to the internet? Looks pretty unanimous to me. Well, according to this particular judge in the Eastern District of Virginia, the fact that you connect your personal computer to the internet means you have no expectation of privacy. I'm wondering if you can quote him when you get brought up on charges for breaking into his computer and sharing all his information. It's kind of how we work in this world. Interestingly enough, my own case happened to occur in the Eastern District of Virginia, so I'm sure my attorney who's sitting out there amongst you will be happy to explain this to this judge when he gets back home. Now, I'd like to briefly talk about my own case. I don't have enough time to go through all of it, but back in 2013, the FBI sought to access encrypted emails that were stored on the LavaBit servers but which were encrypted using a scheme that made them impossible to access without knowing a user's password. Because the messages were encrypted with the user's private key and the private key was secured with the user's password, the FBI sought to intercept that password by compelling the disclosure of my TLS key and then conducting a man in the middle attack. Once they had the password, they could, in combination with the encrypted user data and the source code, reverse the encryption process.  To justify this action, the FBI relied on three different authorities, the power to subpoena, which they later withdrew, the technical assistance of the Penn Register, Trap and Trace statutes. Mind you, that particular language was written when the device I showed previously was state-of-the-art and by relying on the Stored Communications Act by claiming that the encryption key belonging to the business was somehow associated with the particular user and that I couldn't be the one to collect the metadata because not only did they not trust me but that I couldn't provide it to them in real time. Instead, they sought to access the information themselves. Now it doesn't take a rocket scientist to realize that they probably wanted to do more than they were actually authorized to do because as Mr. Hayden points out, once you have access to a network, you implicitly have the ability to modify the information that goes across it. We have a second case to discuss which made a number of headlines earlier this year and it involved the mobile phone. While an initial reading of the headlines may have made the case seem innocuous, a careful reading showed the true colors of the litigation. Specifically, that the FBI was relying on a law from 1789 to claim that they had the authority to compel Apple to modify their products so that their security could be bypassed. Now while I can't prove it, it certainly wouldn't surprise me to learn that the DOJ attorneys who devised this particular strategy were assisted by a powerful hallucinogenic. After all, any attorney can make a good argument. Only an honest one will tell you what the odds are of you actually winning that argument. With the DOJ, they have an approximate annual budget of around $27 billion and over 110,000 people on the payroll. They can afford to take some leaps of faith. The rest of us, on the other hand, have to pay for our indulgences. Like the LavaBit case, the DOJ sought to use Apple's source code and encryption keys to circumvent encryption and then blamed the resulting litigation on Apple making their products more secure. Now, I originally entitled this particular section how far will they go? But in June, the target of my particular case was unsealed so I decided to change it to how far did they go in the pursuit of Mr. Snowden in my particular case. Now Snowden has stated on several occasions that he would be willing to return to the United States and face a jury of his peers and receive punishment for his crimes but he doesn't believe he would receive a fair trial. I can attest to that fact because I appeared before the very same judge and I crossed from the very same prosecutor that he would face. Now, I'd like to start my exhibit by showing you this particular order to show cause for failing to allow the installation of the pen register device but as this email shows here and this one and this one I was willing to let them install the device I just was not willing to let them have my encryption key. After all, that is the whole point of encryption is to protect against eavesdropping. Now, when I indicated that I was going to retain a lawyer and object to it in court, what did the Department of Justice do? Well, first of all, they claimed that they weren't able to speak to me even though I have that email record proving that I was in constant contact with them on an average of about every other day. Then, they went to another judge in the same district and sought an order to install the tap upstream with my service provider before I showed up in court. I had to sue in order to get this particular document. And as these particular records show, installed it two days later, well before I even flew to Washington DC. Yet, when I arrived, they did not inform the court or myself that they had already installed the particular device. They continued with the proceeding and insisted that I was not in compliance. Now, I have more evidence here, but unfortunately, I have run out of time to go over it. So, I shall have to skip over all of these slides and go to this one. I shall endeavor to close with a bit of prose. Perhaps more blokes would still be with their folks if history was considered dope. Live, love, learn what floats your boat so long as you remember to vote. Question those with power. I can't read. Because we the geeks all know the speech with great size comes great pleasure. Now, help me teach the freaks that bigger keys will deliver cryptid bits, which is sure to give Snoopy the fits. It's a promissory note for feeling more pleasing than a motorboat. Now, go forth and feel free to quote. That is all.


OK, well, we can start it. So yeah, my name is Smithy Jacobs. I'm a software developer at StellarWP, where I lead development of the ITU security plugin. Alongside of that, I'm also a WordPress core committer. So that means that I work and help work with the WordPress core project. And you can take me there on the rest API. So if you want to shout out any of those things in general, you can find me in the sponsor booth. We should have time for questions. I don't know exactly how long this is going to run. We'll see. But I hope we'll have time for questions if we run out of time. You can find me anywhere. If I may, that's an after party you find me over the sponsor section. But yeah, so we're going to, oops, I skipped like five slides. This is a mirror. So this is like a spoiler, spoiler, spoiler, spoiler, spoiler. Oh, no. OK, here we go. Forget what you saw. OK. So yeah, the China one talk is, let's kill the password. PASCII is the future of authentication from the web. So studies have shown that over 80% of all hacking related breaches are attributed to password compromises. These are passwords that have been lost. Type has said, hey, how do we get any passwords that we want and use them to further dive into someone's system? And 80% of hacking related breaches are attributed to passwords getting into the wrong hands.  They're like, horrible. No one likes using passwords. They're difficult. If you're doing it right, you have long, complex ones. But most people don't. They use weak passwords. They have reused passwords that they have on tons of different sites. And that's a huge, huge problem. Passwords get stolen. So if you're a password and you say, hey, I have this one password that I use all the time in every single service that I use. And one of those services gets hacked. When your password gets hacked, the taggers say, OK, let's try this password at Chase and Bank of America, Facebook, and every other possible site that they could to say, OK, what else can we do with these passwords that we've got in?  So phishing takes multiple different forms. But a lot of it is like, how can I get your password from you without you knowing ahead and putting this into the attacker's hands? And so we have these kind of different tools. I don't know how exactly you can see while the screenshot of this. Passwords now have a horse battery state, but you may have seen this xkcd. So I picked four random words for a password, coming up with 25 random characters and memorizing it as impossible. But I checked my one password account the other day, and I have 970 entries in there. I can't memorize four different words for 970 different accounts. So I don't exactly know how good this advice is.  So what can we do instead of passwords? How can we make this experience stronger? And for years now, we've had two factors. And it's the strongest protection that we have available, basically, up until the last couple of months. It's been two factors. But so if we look at adoption, we look at adoption, this is according to Microsoft's 2020 cyber signals report from last year. And they looked at all of their Azure directory accounts. And this is like enterprise accounts, where things actually matter. Only 22% of active directory installations for Microsoft had strong authentication, whether calling two-factor, passwordless technologies, things like that. 22% in the Enterprise X.  It's not just your Twitter account or something like that, where, OK, we really, really care. According to a UK study across UK businesses from last year, only 37% of the businesses they surveyed had a policy in place for, hey, do we have accounts that mandate two-factor being set up? And I think there's probably, oh my god. I think there's probably a lot of different reasons why passwords have and why two-factor has taken a while to get off the ground, as you can say, and not really take off the enterprise. But I think one of them, it's probably that's a very confusing user experience. You kind of get this code, you have to type this code. We try to make it a little bit better with an email, but it's not great. Oh my god. And so I think probably one of these reasons is that, well, if we look at places where people voluntarily could use two-factor on their own, and there's very few businesses that actually publish what their numbers are. But Twitter is one of the ones that does, and only 2.6% of Twitter accounts have two-factor set up. So I think when we, as individuals, are just going by our day and our day to day lives, we think, hey, two-factor is really complicated, it's annoying, I don't want to use it. And some businesses are evaluating that, well, can we really effectively roll this out to everyone if they don't know how to use two-factor as complicated? It's not an easy process. I selected a couple of tweets that I found here that are funny. The average American weighs 66 years of their life on two-factor authentication. Obviously, a bit over the top, it certainly feels that way. Despite its two-factor authentication feel like 17-factor authentication, you're checking in all these different sources. And this last one, two-factor has been one thing that I hate, everything was better and easier when we used only pure passwords. And I don't think that's good. I don't think that's unreasonable to feel that way, that, hey, this is a process that really sucks. I guess I intellectually understand this. It makes my account more secure. I found this illustrated in a cool Bob article, a satirical take, but point-counterpoint two-factor authentication is the only thing between me and hackers trying to ruin my life versus, well, it's annoying to do. We've tried to say, oh, well, you have to use two-factor. You should use two-factor. If you're not using two-factor, you're at risk. And these kinds of argument, while this is a humorous take on it, I think is kind of the general attitude that we've had as a security industry to say, hey, you just shouldn't be using two-factor. If you're not, you're doing it wrong. And yeah, it's annoying that's so much sucked with it, deal with it. The other problem here is that even when you have two-factor, you can still be susceptible to phishing. And I've mentioned phishing a couple of different times. And what do I mean by phishing? What I mean is tricking users into giving up their passwords. So you giving your password over to an attacker to someone you don't mean to. This takes a lot of different forms. This is a clever one that I saw the other day, which is a pop-up. And so we all know like pop-ups are bad or whatever. But this is a pop-up where you kind of see it in the usual technique of, hey, I want to sign in with Microsoft account. And a pop-up comes up that looks like the Microsoft account page, but that's not the Microsoft account page. It's not a real pop-up. It's a pop-up that is popped up in the browser window you're on. It says, hey, we know this is a window user. We know what browser they're using. So we're going to copy all of their styles. And it looks really, really good. You can actually play around with this. And if you don't pay extra close attention, it looks like you're actually interacting with login.Microsoft or login.Google.com or whatever. It looks like the actual Google page because they can steal all of that. It can get more scary, though. This is my favorite demo. So what we usually say is, well, if we're going to be phished, look for key clues and indicators that this site isn't who you think it is. Maybe they spelled something wrong. Or if I have two factoring on my site's protected. This is what looks like a real Microsoft account, the real Microsoft login process, everything. And it actually is. When this user is entering in their information, they're entering it into what is the pixel-perfect copy of Microsoft's login system. The only thing that's changed is the domain name. Essentially, the attacker is using this cool tool called Evil Engine X that sits between the attacker control site and Microsoft. And they say, OK, you input your two factor. You go to your email and password. We'll send it over to Microsoft. And Microsoft says, hey, give me your two factor code. And the attacker says, OK, we want your two factor code. And they send you back the exact page that Microsoft sent in. But the only difference was that they got to see everything that happened in between. So even if you're super vigilant and looking like, OK, is this actually behaving correctly? I have two factor set up. I have all the extra tools available. If you're not 100% vigilant, then the attacker is going to win. And they only have to succeed once. Once you type in your password into an attacker controlled account, that's kind of game. They have your password. Now you have to change it, figure out are there any other things that they got into. Particularly if there's something like your email where they get into your email account, they can pivot that access to having tons and tons of other sites. So we have to be vigilant every single time. But attackers only need to succeed once. So we kind of came up with, and this might be for a lot of y'all that use Slack and business environments, it's kind of been one of the first times you've seen it, this kind of passwordless login experience. And this lets us skip passwords. It lets us skip two factor. We have a simpler user experience. We get an email. We have a code. We type in the code. And that's kind of all we need to know. The problem is email is still kind of slow. I don't know how many times I've waited five minutes for a magic link that's telling me, oh, sign into your account instantly while I'm checking my email and checking my email and checking my email. I'm trying to log in instantly to interact with someone's product. And that's not a great user experience. Another problem is that while these are kind of phishing resistant, they're not perfect. So this is a screenshot. This is one of the slides that I added as I was up on the train. And I was from New York City over to Buffalo. And when I was logging into LinkedIn for some unknown reason, you can see the approximate location that's all the way down at the bottom that's trying to tell me, hey, was this really you who logged in? That says, the approximate location of that person was Philadelphia. I knew I wasn't in Philadelphia when I got that email. I was somewhere in upstate New York. But this location safety thing that's trying to say, hey, be super careful. We even this is an attacker. I'm sure if that said Russia, I may feel like, OK, this is a sign that I shouldn't click on this link. But so often, we can't pay attention to these warnings if you have been sawed in the first place. The tiniest point of the text is like 15 paragraphs down from the sign into LinkedIn. And that's what's meaning to protect me to say, hey, make sure you don't click this link accidentally. So income pass keys. And so this is the five second demo video of me logging into now Google with a pass key. And that was the entire log experience. I clicked the button and I logged in. Let's see if we can replay that because it is very simple. And it's kind of hard to almost take in that this is the most secure possible login. I didn't have to type in a password. I didn't have to type in a two factor code. I didn't have to do anything. All I need to click a button was saying, hey, do you want to log in? Log in. So what are pass keys? Pass keys are another way to authenticate with a site that you want to connect with. You don't have to use passwords. You don't have to do two factor authentication. It's really a one click login. In this example, I'm clicking log in and putting my face on my phone. It's authenticating with me and I'm into my site. And it's phishing proof. Phishing proof is the phrase that Apple used when they were discussing this. But it makes me a little more comfortable to say this is phishing proof. But it's actually phishing proof and we'll kind of get into why in a second. So pass keys are, you may have heard of this in another game which is called Web Authent. So if you've heard of this developing over the past few years, it's been in progress for six years as part of Fido, which is this standards organization that comes up with all these different ways that we can improve the weather. And the important thing is that it's backed by Apple, Google, and Microsoft. This isn't just, hey, here's a little thing that is just from some little company over to the site that's saying, hey, use us. This is something that has been backed by the major players. And at this point it's now supported by all major browsers. If you're on the latest MacOS, the latest Safari, the latest iOS, latest Windows, all that stuff, latest Android, you now have access to pass them. And a big thing here is, yeah, those methods are showing you the different pages. So the big thing is how they work is using something called public key cryptography. This is something that you don't really have to understand and we're not gonna get into like, here's the 10,000 pages on how public key cryptography works. But this is something that you're already using every day. It's in the technology for SSL, HTTPS, that kind of stuff, keeping your site safe if you're accepting online payments. Or really, if you just have a blog, you should be using HTTPS. It's for software updates. So any time you download a new version of your operating system in your phone, your phone's checking to make sure that that is built by the people that the phone thinks it was built by and it's keeping you safe. And so we don't really think about how those technologies work. And it's the same thing here for pass keys. All of this is happening in the background. You don't need to know what public key cryptography is. But we're gonna add a little bit more into it for a second. So this is kind of the flow for registering and creating new pass keys. And the way this works is I say to my site that I wanna visit, hey, I wanna create a new account. And the website replies back, send me a public key. So my phone for me, I don't need to do anything. I just say, okay, I wanna log in, I wanna create my account. Here it's gonna create this pass key for me in the background. And it's gonna send this public key up into the cloud and into the website that I'm connecting with. And in process, in practice, this is what that process looks like. So this is me creating a pass key for Google. So I've already logged into my account. I say, hey, I wanna create a pass key. I create my pass key and I'm done. That's it, that's my entire process. I now have a pass key that I've created. It means the next time that I wanna log into Google, I can do it with one click. And so how does that login process work? So again, it's a kind of similar flow. I ask this website, hey, it's me, I wanna sign in. But it needs a little bit more proof. So it asks me to sign this random bit of information with that key that we generated earlier. It says, okay, is this signature that you signed? Does it look good? If it does, they let you in. And so what this means is that there's no private or sensitive information that is being passed along here. The only thing that is happening is happening on your device is completely private. And again, in process, this is what that looks like. I say, hey, I wanna log in. I hit the login button and I say I'm good. And I'm logging using a pass key. So to kind of summarize that process, your pass key, what that actually is, is a public private key pair. And your device, your phone, your computer, your tablet, your watch, that's what keeps your private key safe. You don't need to memorize that, remember it like a password. There's nothing for you to do. Your device is taking care of everything for you. Your device oftentimes will guard that. So if you're using a kind of more modern device that has a touch ID or a face ID sensor, it uses those biometrics to protect that private key. But those biometrics are never sent to that website. That's all just happening in your device to say, hey, we have this private key. I wanna make sure as your iPhone or as your Mac or as your Google phone that okay, that's really you. And so it checks your biometrics. So as I kind of concerned that people have, I said, am I sending my face to Google when I log in like this? Absolutely not. The website then receives your public key. And whenever you need to log in, the site asks you to sign a challenge with your private key. The private key that is being kept safe by your phone. You don't have to do anything. It all happens in the background. So the big win here with pass keys is that no personal information leaves your device. This means that account takeovers and phishing are way less possible. There's nothing for an attacker to steal. If we saw what we actually sent if we look back at public slides, all we sent to the site we're trying to sign in with is our public key. There's no sense of information about us. There's nothing private. There's nothing that even if they stole those public keys that you can do anything with because they're public keys. So the fact that an attacker was able to steal that information doesn't even matter even if you have a board to hack. The big thing here is that you can't be tricked into giving up your password. So if you look at these screen tests here if you're paying super close attention to some of those videos, you may have seen in these sign-on prompts that we have this like text to this. It says, hey, are you sure you want to sign in to secure that test as an admin? Or into Google as team.exe.btj.com is my email. If you want to sign in, and if you look at that you might say, oh, is this the only thing that's keeping me safe? Is the fact that I have to look at this text and make sure I'm not signing into somewhere malicious? The answer though is no. All of these different prompts, they say, hey, just so you're aware, this is where you are going to log into, but it's not possible for them to log into an account that you don't know about. They can't say, hey, we're trying to be Gmail. And you just have to be super visual and say, oh my God, am I sure I'm logging into Gmail? I think it's Gmail, but the domain name was like a million characters long, I don't know. Your device won't let you give it up unless you're actually authenticating with a site that you authenticated with before. So there's no way for someone to send you a link that says, this is really me, gmail.com, and you get tripped and now your Gmail password's gone. Your device is doing all of the hard work, and that's the way it looks like with Microsoft. So there are two kinds of pass keys, and there's kind of like the geeky option and the option that everyone else is gonna use. We've had this geeky option which are roaming authenticators. These are separate hardware devices they connect to Bluetooth or USB or NFC's, things like that. So those are these like Yuba keys and Titan keys.  And that's what kind of web off-hand had been like for years and years and years. But the new advancement are these Pachmore authenticators. And these are things that are built into your computer, they're built into your smart phone. They're often protected by biometrics and they're just available for you that everyone can use and they're available now. This is the browser support. Basically, if you're using a modern browser or a modern operating system, you have support for this. If you're a Linux user, and I gotta go with a more geeky route, but for the Pachmore authenticators, they're supported everywhere basically. So you have this technology now. How pass keys work are kind of different in different environments. So I'm gonna take a kind of 10,000, excuse me, 10,000 foot overview at these different platforms. For Apple, pass keys are stored in your iCloud account. So this means they automatically get synced across all your devices. If you sign into an account and create an account on your iPhone, you'll be able to log in on your iPad, on your MacBook without doing any work whatsoever. They all just get synced into your iCloud account. In this experience, they work best with Safari right now. Safari's kind of like, you know, the main browser that Apple's like, yeah, who's this with? So it's where pass keys are best integrated for if you're in the macOS experience, but there are other options. You can also share pass keys with AirDrop. So if you're thinking, hey, sometimes I give someone else my password, how can I share with you right now? So if you do have a scenario and you need to give someone else access to your account, this is built in. You can just share your pass with AirDrop, and they'll be able to log in on that site and they don't need to learn a password or anything like that either. In Google, pass keys are stored in Google Password Manager and they're synced across all your devices. So again, if you log in on your Android phone and then you want to use the desktop Google Chrome on your Mac or on your PC, you can do that without any trouble. This is kind of what that flow looks like. And again, for Google, the works best in Chrome is kind of two different ecosystems there, basically. In Windows, Windows is sort of a little bit different. It's managed by Windows Hello. So Windows has kind of their own Windows Hello security system that's been built in for a long time. Your pass key right now in Windows is stored on your device itself. So if you create a pass key on your Windows tablet, you won't be able to, well, I think I'm gonna say Windows phone. If you still have a Windows phone, congratulations. If you have a computer, a third Windows computer, you wouldn't be able to use that right now. Cross-device sync is something that Microsoft has said is gonna be coming soon to Windows natively. But for now, I'm gonna say use Google Chrome for the best support, and you can sync it with Google Chrome's Password Manager, which you might already be using. So what about multi-platform families? So I all am more in the Apple ecosystem, but some people have an Android phone and a Mac device or an Apple phone and a Windows computer. How does that work? So browsers support using a pass key from a nearby device. So what this means is this is kind of the login flow where I'm logging into, let's say, my desktop computer and I'm logging in using Google Chrome, and then with my iPhone, I'm signing in. So what's happening here is I'm saying, okay, I wanna log in. I don't have my pass key built into this computer. So I said, Google Chrome's gonna say, okay, how do we know it's you?  My phone has the pass key. And so when I scan that QR code, my phone talks to the computer over Bluetooth actually, and they say, okay, we agree that this is the right person, send the information up into the server, and you get logged in. So this means that you can use whatever ecosystem you want to. The other thing though is that user accounts can have multiple pass keys. So if we saw back earlier, I had a iCloud pass key that was sort of my Google account, but you could also create a pass key for your Android phone, for your Chrome device, you know, as many of them as you want. So if you're not in a scenario where, hey, my Apple pass keys sync perfectly with my Windows computer, you can create a pass key for both of them, and the first time you do that, you can kind of use this flow. So here's another example of what this looks like in the Microsoft Windows ecosystem. So this is a Windows computer, and I cut out the audio from this, but they're talking about how they're putting up a prompt to say, okay, I want to make sure they want to log in.  Just speed this video up. And we're signing in at summer, then you can check the continue button, there we go. And we've now logged into that site. And so this experience is implemented with all of the different implementations, basically. So this is the same experience, but doing this with a Google phone and a Google Chrome device. They all have these options built in that say, hey, we know that you're not always gonna have a pass key with you, let's say you're traveling, you wanna use a work computer, or you wanna use the computer in the hotel room, things like that is actually kind of has a better experience. Previously, if you're saying, okay, well, I've got a 24 character random password that I have in one password, maybe I'm gonna open it up in my phone and type out all 24 characters, and that's the thing that I can do now is just point my phone at it with a pre-picture. So where can you use pass keys? This was the cool news that I woke up to a couple of days ago for World Password Day, is that Google has announced support for, Google accounts themselves to actually support pass keys. So right now, if you use a Google account, you can go to your Google account center and say, hey, I wanna set up a pass key, you can try it out today right now. There are also a bunch of other services that are using it. Some popular ones are Microsoft, PayPal, and eBay also have support for it, and WordPress has support for it as well. Over on the bottom there, there's a link in, I'll post the slides for these online called passkeys.directory, and this is basically a directory of all the sites that they know about, it's actually sponsored by one password that are keeping track of here are the places where you can use pass keys.  Are they supporting it yet? You can go on to the site and check it out. So if you do wanna use this in WordPress, you've got a couple of different options. I think SecurityPro, which is the plugin that I work on, we've supported pass keys now for, I think we were the first ones to do it, we launched support for it in September. There's also a couple of other plugins, WP Web Offend should let you do this, as well as password list WP. So if you're thinking, why should I adopt this now? Could you just move back to that screen? Yeah, we'll get back to it in a second. So if you're thinking why do I wanna adopt pass keys now, they're way faster to use than passwords and two-factor.  You don't need to type in your long password, you don't need to type in a separate two-factor code. If you've got clients, you can help keep your clients secure. As kind of more technical folks, oftentimes we're the ones with the best security on the WordPress site that we're logging into. But then maybe you're client, you're with meeting them when they see them typing their password and it sticks here.  Your son's gonna get hacked. You can help keep your clients secure by teaching them how to adopt pass keys. You can also be on the forefront of new technology. This is kind of new tech.  I hear about all these WordPress sites getting hacked. You can tell them, hey, here's this new technology that I learned about that Google is adopting, and everyone is adopting.  So is the password then? Well, not yet, but we're getting there. We're close. Until then, keep using strong passwords, set up two-factor whenever it's available. If you aren't already using a password manager, you might be without knowing it. They're built into all of our devices now. Google Chrome has them, Apple has them. But if you aren't using passwords, and you're writing them down or kind of keep one in your head for every single site, start using a password manager. That's me. I'm Timothy Jacobs. I'm a lead developer at iThemes Security. Like I mentioned, I'm a WordPress core committer and organizer of the WordPress New York City Meetup Group. You can find more about me at timethedjacobs.com or find out about iThemes Security over at iThemes.com slash security. So open up to any questions. Or you can also give me a call. Yeah. I'm still wrapping my hammer. Yeah, it's a lot. Do you still have passwords for these, you know, the very complex ones, but now you don't have to punch them in? Exactly. So right now, that's kind of the, are we there yet? Not yet. So most of these accounts, Google, if you go there, they'll say, hey, you want to set up a passkey and you can. But you still have a password for your account. Microsoft, they're actually the pioneers in this. You've been able to remove your password from your Microsoft account like for like two years or so. So this is kind of the first step, which is let's get people using passkeys, but you still need to create a strong password for now. But in a couple of years, hopefully the idea is everyone uses passkeys, it's adopted everywhere. You don't have to use passwords anymore. And accounts can say, okay, you don't need to set up a password if you don't want to. So that's kind of the vaulting term of that. And one other thing. So one thing we do often as people take care of other people's sites is, can you create an account for me? And how do you get that information? Like you're still creating a user account for somebody more impressed.  Yeah, so this is kind of like the tricky flow. And it's one of the things that we do and the way we handle this with I think security is that we've had pass for this login support since before passkeys were saying. Passkeys were kind of the new feature that we added a couple of months ago. So the way that I see this kind of approaching is that the first time someone is setting up their account, they're going to get an email and say, okay, hey, we wanna make sure that your email address is real, et cetera. And that gets them in the same way that they could receive, let's say a password reset email. But once they log in for the first time, then we can prompt them to set up a passkey. So when you're setting up an account for someone, you're still gonna need them to enter an email address or something like that. But when they get an welcome email, it'll be, hey, welcome to my site.com, we see you've logged in, let's set up a passkey so you can get it next time. So I think that's kind of how the flow is gonna work is that as we get into this, there's gonna be kind of a partnership between passkeys and also an email-based login. But the first time that happens, hopefully it's not, hey, I need to be waiting for this email all the time so I just tried to sign in and all that kind of stuff. So that's kind of how I see that flow. Yeah. Well, how does it feel to lose your device? Great question. So what if I lose my device? So platforms sync passkeys across all of your devices. So the big thing is that if I lose my iPhone, my passkey is in my MacBook, it's in my iMac at home, it's in all of those different places. But also all of these different platforms, they have account recovery options. So if I go to Apple and I say, hey, I lost my iPhone and I lost my Mac and I lost my watch and everything I've gone, which I do, they usually have different account recovery options and some of those are, hey, they give you a code that you should store with your birth certificate type of things. So those are kind of your options there. Again, like they talk about, you can have multiple passkeys. So if you have different ecosystems, you can create multiple of them. If you are one of the people who is like really techy and wants to use it, you can use a UB key, for instance, and say, hey, I'm gonna put my passkey over there and save it. But basically you shouldn't really need to, but the different services that you're already thinking, hey, if I lose access to everything, how do I get access to those other passwords? It's a similar kind of system, use their account recovery procedure, stuff like that. But the big thing is that you wanna make sure that you're using a passkey ecosystem where it's not just on your phone, that it's synced to the web, it's synced across all of my devices. So that's kind of like the big takeaway. Until we get to the point where we're talking about, we're like, okay, everything's gone, you can still have passwords. So that's kind of your back and back and back and back. Does that make sense? Yeah, I have a couple of frequently asked questions Any others, yes? Yeah, so I'm trying to understand the linking between the identity and the password login. So obviously, so when you set up with either Google or Apple, for example, does that get, when you go then login, one of those is always gonna send, for example, Google, the Google, for the username part. So you're gonna send an email address of that, or like in the WordPress case, is it, once you get through that provisioning flow, has the WordPress thing sort of set up its own version with whatever username you use in WordPress? I guess, could you use a different, could you use the Google passkey and then have a different email login for? It's a great question. So the biggest analog that we have currently, I think is like social login, right? We're like, hey, I have a Gmail account, so any single time I wanna sign in, somewhere I'm gonna look for the sign in with Google account, passkeys are completely different. So the ecosystem that you live in doesn't really matter from the service perspective. When I create a new passkey, this is like, it's a simplified version, but it's literally the steps. So the only thing that I'm sending to WordPress, let's say, is this public key that my device generated. They don't know that I'm a Google user or an Apple user, that I have a Gmail account or any of that. You don't have to say, hey, I need to make sure that I'm doing this in my work Gmail or my personal Gmail or anything like that. You type in the email address that you'd wanna type in with and say, hey, I wanna register as this user, and then you say, okay, I'm gonna use my device to create a passkey. The actual ecosystem that you're a part of doesn't matter, and it's kind of what's the cool thing from a privacy perspective. If you were using like signing with Google, Google has all the sites that you're signing in with, but now, really, they don't know anything. Does that make sense? Yeah, yeah, so when you go to WordPress, there's still gonna be a prompt that's typing your username, but just no password box. Exactly, you don't have a password box, so you're still saying, this is who I am. Exactly. But then, and then all the other stuff you have to move back on. So there's also an even cooler option that you don't need to type in your username. You just say, hey, I wanna type in my, I wanna use a passkey. And your device knows, okay, these are all the passkeys that we have for this site. And it'll actually prompt you if you have, let's say, for my testing account, I have like 15 different WordPress users that I've created passkeys for, and I'll say, hey, which of these 15 users do you wanna sign into this WordPress site but then I get to pick one? If you only have one, it'll just do it for you. So you don't even need to enter your username, and in the future, you're gonna not have, you could have a completely username-less option, so if you don't wanna collect someone's email address, you wouldn't have to.


I quit because Blizzard Activision is a bad-gut company. Okay. Why? Dude. Blizzard Activision is not a bad company. It's a terrible company. Come on. Why are you saying bad?