AppSec California 2017

Imagine an attacker who can update records on your website’s user password database. Is it possible for the attacker to get into a user’s account without cracking the user’s password? As a security professional at a large internet company with mutli-tiered architecture, do you worry about the possibility of passwords being improperly handled by one or more systems before it is stored securely? Attend THIS talk if you want to learn more about attacks on password and password history tables and techniques to mitigate password handling risk. You will leave with recipes for handling and storing passwords that are different from techniques used to resist password cracking.