IAM
229 items from kdeldycke/awesome-iam ★2,303
-
SAML: A Fractal of Bad Design blog.trailofbits.com
“SAML is being crushed under the weight of its own complexity.” The author lists five flaws that compound: “1. Built on XML; 2. Canonicalization; 3. Enveloped signatures; 4. 'Kitchen-sink' design; 5. Ossification.” So instead of one more mitigation, identity providers get a…
-
Getting 2FA Right in 2019 blog.trailofbits.com
On the UX aspects of 2FA.
-
AWS Security, Identity & Compliance announcements aws.amazon.com
The source of all new features added to the IAM perimeter.
-
Security Recommendations for Any Device that Depends on Randomly-Generated Numbers av8n.com
“The phrase 'random number generator' should be parsed as follows: It is a random generator of numbers. It is not a generator of random numbers.”
-
Using JSON Web Tokens as API Keys auth0.com
Compared to API keys, JWTs offers granular security, homogeneous auth architecture, decentralized issuance, OAuth2 compliance, debuggability, expiration control, device management.
-
Adding JSON Web Token API Keys to a DenyList auth0.com
On token invalidation.
-
Dark Patterns after the GDPR arxiv.org
This paper demonstrates that, because of the lack of GDPR law enforcements, dark patterns and implied consent are ubiquitous.
-
Browser Fingerprinting: A survey arxiv.org
Fingerprints can be used as a source of signals to identify bots and fraudsters.
-
How Uber Got Lost archive.ph
“To limit "friction" Uber allowed riders to sign up without requiring them to provide identity beyond an email — easily faked — or a phone number. (…) Vehicles were stolen and burned; drivers were assaulted, robbed and occasionally murdered. The company stuck with the…
-
-
Anti-captcha anti-captcha.com
💸 Captchas solving service.
-
Practical Recommendations for Stronger, More Usable Passwords andrew.cmu.edu
This study recommend the association of: blocklist checks against commonly leaked passwords, password policies without character-class requirements, minimum-strength policies.
-
AMF site blocklist amf-france.org
Official French denylist of money-related fraud sites.
-
SMS: The most popular and least secure 2FA method allthingsauth.com
-
The never-ending product requirements of user authorization alexolivier.me
How a simple authorization model based on roles is not enough and gets complicated fast due to product packaging, data locality, enterprise organizations and compliance.
-
Awesome Identifiers adileo.github.io
A benchmark of all identifier formats.
-
OAuth 2 Simplified aaronparecki.com
A reference article describing the protocol in simplified format to help developers and service providers implement it.
