The "To Keep Up" Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
~~NOCACHE~~ <fc #a0a0a0><fs small>//This page last changed ~~LASTMOD~~ visits: {{counter|today| time| times}} today, {{counter|yesterday| time| times}} yesterday, and {{counter|total| time total so far| total times}}//</fs></fc> 

====Meeting Summary for Lex Computer Group's Nov 13, 2024 meeting====

Quick recap

The meeting focused on password security, discussing best practices for password creation and the use of password managers. The discussion also covered the concept of Public Key Infrastructure (PKI), the use of asymmetric cryptography, and the role of Certificate Authorities (CAs) in verifying the authenticity of certificates. The meeting also explored the potential of eliminating passwords through the use of FIDO, the security of passkeys and password managers, and the use of pass keys for logging into Google accounts.

Next steps
  * All attendees to consider using password managers and generating strong, unique passwords for each account.
  * All attendees to enable multi-factor authentication on their important accounts where available.
  * All attendees to explore using passkeys instead of passwords when given the option by websites and services.
  * All attendees to review their current password practices and consider updating them based on the information presented in the meeting.
  * All attendees to be cautious when using public or shared computers for logging into sensitive accounts.
  * All attendees to consider backing up their passkeys or recovery codes in a secure location.

Summary
Password Security and Yealink Challenges

The presenter discussed the challenges of using new Yealink equipment in a room and the need to combine two of the three cameras into one video image. The main topic of the meeting was about password security, with a focus on best practices for using passwords. The presenter highlighted that the old rules for password creation, such as a formula and expiration, were making security worse. The new rules suggest that password length is strength, and passwords should last indefinitely unless there's a specific reason to change them. The presenter also mentioned the use of password managers to generate random strings of passwords for different websites. The conversation ended with a discussion about the use of password managers, with about 60% of the participants admitting to using one.


Exploring Public Key Infrastructure

In the meeting, a recording discussed the topic of Public Key Infrastructure (PKI). They explained the concept of asymmetric cryptography, where two keys are used for encryption and decryption, with one being public and the other private. They also discussed the use of symmetric key cryptography for faster exchanges, but highlighted the problem of key distribution. Jeff explained how PKI solves this problem by using asymmetric cryptography to transmit the symmetric key securely. They also discussed the role of Certificate Authorities (CAs) in verifying the authenticity of certificates and the use of digital signatures for this purpose. The conversation ended with a summary of the key points covered.


Verifying Identity With Trusted Third Party

The presenter discussed the problem of verifying identity on the internet and how it can be solved using a trusted third party, such as a certificate authority. They explained the concept of public and private keys, which are generated using large prime numbers and an algorithm like Euler's. These keys are used for encryption and decryption, with the private key being used for encryption and the public key for decryption. The presenter also mentioned the concept of asymmetric encryption, where a message is encrypted with one key and decrypted with another. They concluded by explaining how a certificate is used to verify the identity of the public key holder.


Secure Communication With Amazon Discussed

In the meeting, the presenter explained the process of establishing secure communication with Amazon, emphasizing the importance of a trusted certificate authority. They discussed how Amazon's public key is verified through a certificate authority, ensuring that the communication is secure. The presenter also touched on the concept of multi-factor authentication, explaining that it strengthens password authentication by adding an extra layer of security. The conversation ended with a discussion about a historical event involving the President of the United States and the importance of having backup systems in place.


Multi-Factor Authentication and Security

The recording discussed the three factors of authentication: something you know (passwords), something you are (biometrics), and something you have (physical objects). She emphasized the importance of multi-factor authentication for security, using examples such as withdrawing cash from an ATM and the US nuclear codes. It also highlighted the limitations of these methods, including the vulnerability of passwords and the potential for biometric data to be compromised. She recommended using authenticator apps and physical tokens for enhanced security. The presenter agreed with the recording's points and found a video to further illustrate the secure exchange process.


HTTPS Security and TLS Handshake

In the meeting, a recording and the presenter discussed the importance of HTTPS for secure communication between a web browser and a server. They explained that without HTTPS, data sent over the internet can be intercepted and read by anyone, posing a security risk. They also detailed the process of the TLS handshake, which involves several steps including the establishment of a TCP connection, the exchange of client and server hello messages, and the agreement on the TLS version and cipher suite to use. The presenter also mentioned that the latest version of TLS is TLS 1.3, which optimizes the handshake to reduce network round trips. The discussion concluded with a mention of the redundancy in the process and the importance of sharing this information.


Exploring FIDO for Passwordless Authentication

The recording discussed the potential of eliminating passwords through the use of FIDO, a protocol that allows for passwordless authentication. She explained how FIDO works, using public and private keys to securely authenticate users without the need for passwords. Vani also highlighted the benefits of FIDO, such as resistance to phishing and replay attacks, and the ability to improve security and usability. She mentioned that FIDO has been around since 2013 and is supported by over 250 organizations. The presenter also discussed the integration of hardware-based authentication, such as Yubikeys, into the FIDO system. The recording addressed common questions about FIDO, including what happens if a device is lost or if multiple devices are used for authentication.


Passkey Security and Password Managers

A recording discussed the security of passkeys and password managers. She emphasized that passkeys are more secure as they stay on the user's device, reducing the attack surface. She also highlighted that password managers, while useful, can be vulnerable to phishing attacks and password database breaches. The recording recommended using passkeys for better security. Drew was set to present a demo of t-pass, but due to technical issues, he was unable to do so. The team also discussed the importance of using strong, unique passwords and the use of password generators.


Keypass Integration and Pass Key Demo

In the meeting, Drew and the presenter demonstrated the use of a password manager called Keypass and its integration with Google accounts. They showed how to set up and use pass keys for logging into Google accounts, with the presenter explaining the process in detail. The presenter also demonstrated how to use pass keys on a Mac, using Apple's password plugin. The conversation ended with the presenter showing how to use a QR code for pass key authentication. However, the initial demo by Drew was not successful, leading to some confusion and issues with the pass key authentication.