Passwords, keys, and coins: security protocols for the real world

Improving security requires both empirically-grounded insights into existing systems and threats, as well as theoretically-grounded solutions that anticipate how future users and attackers will adapt. I will present examples of both. I’ll begin by introducing empirical methods that I created to bring quantitative rigor to the question of how users choose authentication secrets (PINs, passwords, and security questions), a topic that has long been misunderstood due to a lack of data. I'll then present two theoretically-grounded approaches that apply cryptography to providing transparency that trusted authorities are behaving correctly. The first addresses servers for distributing public keys for secure communication, ensuring that the authority cannot lie without being detected.  The second ensures that banks that store bitcoins are solvent: that they actually are holding as many bitcoins as they have promised to their clients.