PasswordsCon

This stream opens with a talk on authorization phishing, which goes beyond attacker-in-the-middle proxies that steal sessions after a password and MFA are entered. The speaker covers consent phishing, device code phishing and a consent-based technique that captures OAuth codes. Live demos show a device code kit gaining API access to a Microsoft account even when a passkey is set up. Conditional access tests show that compliant-device requirements and token protection block some variants but not all of them, so defenders need to validate their own policies.

Anthony Hendricks then argues that previously breached credentials, reused and lightly modified passwords, drive many incidents and rising breach lawsuits. He recommends risk-based training, addressing fear of forgetting passwords, and written password policies, and he suggests that adoption of new tools depends on how they are explained to staff. Dwayne McDaniel follows with a look at worm-style package compromises that harvest secrets from developer machines. His checklist includes pinning versions instead of using latest tags, adding a waiting period before updates, disabling install scripts, and moving toward short-lived workload identities.

Kenton Mcdana closes with certificate transparency logs, showing how internal hostnames issued by public certificate authorities can be found without scanning. He walks through the kinds of exposure this reveals and suggests that organizations review what their logs show and ask certificate authorities for private options.