IAM
229 items from kdeldycke/awesome-iam ★2,303
-
reCaptcha google.com
💸 Still an effective, economical and quick solution when your company can't afford to have a dedicated team to fight bots and spammers at internet scale.
-
Discover UI Design Decisions Of Leading Companies goodui.org
From Leaked Screenshots & A/B Tests.
-
Paper we love: Privacy github.com
A collection of scientific studies of schemes providing privacy by design.
-
Papers we love: Cryptography github.com
Foundational papers of cryptography.
-
Confusable Homoglyphs git.sr.ht
🆓 Homoglyphs is a common phishing trick.
-
General List of Reserved Words gist.github.com
This is a general list of words you may want to consider reserving, in a system where users can pick any name.
-
xkeyscorerules100.txt gist.github.com
NSA's XKeyscore matching rules for TOR and other anonymity preserving tools.
-
PKI for busy people gist.github.com
Quick overview of the important stuff.
-
common-domain-prefix-suffix-list.tsv gist.github.com
Top-5000 most common domain prefix/suffix list.
-
#1 gist.github.com
, #2, #3.
-
Temporary Email Address Domains gist.github.com
A list of domains for disposable and temporary email addresses. Useful for filtering your email list to increase open rates (sending email to these domains likely will not be opened).
-
Four cents to deanonymize: Companies reverse hashed email addresses freedom-to-tinker.com
“Hashed email addresses can be easily reversed and linked to an individual”.
-
IAM Is The Real Cloud Lock-In forrestbrazeal.com
A little click-baity, but author admit that “It depends on how much you trust them to 1. Stay in business; 2. Not jack up your prices; 3. Not deprecate services out from under you; 4. Provide more value to you in business acceleration than they take away in flexibility.”
-
API Tokens: A Tedious Survey fly.io
An overview and comparison of all token-based authentication schemes for end-user APIs.
-
Automated security testing for Software Developers fahrplan.events.ccc.de
Most privacy breaches were allowed by known vulnerabilities in third-party dependencies. Here is how to detect them by the way of CI/CD.
-
The EnterpriseReady SaaS Feature Guides enterpriseready.io
The majority of the features making B2B users happy will be implemented by the IAM perimeter.
-
Bloom Filter en.wikipedia.org
Perfect for this use-case, as bloom filters are designed to quickly check if an element is not in a (large) set. Variations of bloom filters exist for specific data types.
-
The Beer Drinker's Guide to SAML duo.com
SAML is arcane at times. A another analogy might helps get more sense out of it.
-
DigitalOcean Accounts changelog docs.digitalocean.com
All the latest accounts updates on DO.
-
An Illustrated Guide to OAuth and OpenID Connect developer.okta.com
Explain how these standards work using simplified illustrations.
-
Why differential privacy is awesome desfontain.es
Explain the intuition behind differential privacy, a theoretical framework which allow sharing of aggregated data without compromising confidentiality. See follow-up articles with more details and practical aspects.
-
Descope descope.com
Drag and drop your auth. Add authentication, user management, and authorization to your app with a few lines of code.
-
Semantic-based Automated Reasoning for AWS Access Policies using SMT d1.awsstatic.com
Zelkova is how AWS does it. This system perform symbolic analysis of IAM policies, and solve the reachability of resources according user's rights and access constraints. Also see the higher-level introduction given at re:inforce 2019.
-
Trust and safety 101 csoonline.com
A great introduction on the domain and its responsibilities.
-
Stop using JWT for sessions cryto.net
And why your "solution" doesn't work, because stateless JWT tokens cannot be invalidated or updated. They will introduce either size issues or security issues depending on where you store them. Stateful JWT tokens are functionally the same as session cookies, but without the…
-
cryptoanarchy.wiki cryptoanarchy.wiki
Cypherpunks overlaps with security. This wiki compiles information about the movement, its history and the people/events of note.
-
GCP IAM release notes cloud.google.com
Also of note: Identity Platform, Resource Manager, Key Management Service/HSM, Access Context Manager, Identity-Aware Proxy, Data Loss Prevention and Security Scanner.
-
Biscuit clever-cloud.com
Merges concepts from cookies, JWTs, macaroons and Open Policy Agent. “It provide a logic language based on Datalog to write authorization policies. It can store data, like JWT, or small conditions like Macaroons, but it is also able to represent more complex rules like…
-
Password Storage Cheat Sheet cheatsheetseries.owasp.org
The only way to slow down offline attacks is by carefully choosing hash algorithms that are as resource intensive as possible.
-
The Case for Granular Permissions cerbos.dev
Discuss the limitations of RBAC and how ABAC (Attribute-Based Access Control) addresses them.
-
SMS Multifactor Authentication in Antarctica brr.fyi
Doesn't work because there are no cellphone towers at stations in Antarctica.
-
Don't get clever with login forms bradfrost.com
Create login forms that are simple, linkable, predictable, and play nicely with password managers.
-
SAML: A Fractal of Bad Design blog.trailofbits.com
“SAML is being crushed under the weight of its own complexity.” The author lists five flaws that compound: “1. Built on XML; 2. Canonicalization; 3. Enveloped signatures; 4. 'Kitchen-sink' design; 5. Ossification.” So instead of one more mitigation, identity providers get a…
-
Getting 2FA Right in 2019 blog.trailofbits.com
On the UX aspects of 2FA.
-
AWS Security, Identity & Compliance announcements aws.amazon.com
The source of all new features added to the IAM perimeter.
-
Security Recommendations for Any Device that Depends on Randomly-Generated Numbers av8n.com
“The phrase 'random number generator' should be parsed as follows: It is a random generator of numbers. It is not a generator of random numbers.”
-
Using JSON Web Tokens as API Keys auth0.com
Compared to API keys, JWTs offers granular security, homogeneous auth architecture, decentralized issuance, OAuth2 compliance, debuggability, expiration control, device management.
-
Adding JSON Web Token API Keys to a DenyList auth0.com
On token invalidation.
-
Dark Patterns after the GDPR arxiv.org
This paper demonstrates that, because of the lack of GDPR law enforcements, dark patterns and implied consent are ubiquitous.
-
Browser Fingerprinting: A survey arxiv.org
Fingerprints can be used as a source of signals to identify bots and fraudsters.
-
How Uber Got Lost archive.ph
“To limit "friction" Uber allowed riders to sign up without requiring them to provide identity beyond an email — easily faked — or a phone number. (…) Vehicles were stolen and burned; drivers were assaulted, robbed and occasionally murdered. The company stuck with the…
-
-
Anti-captcha anti-captcha.com
💸 Captchas solving service.
-
Practical Recommendations for Stronger, More Usable Passwords andrew.cmu.edu
This study recommend the association of: blocklist checks against commonly leaked passwords, password policies without character-class requirements, minimum-strength policies.
-
AMF site blocklist amf-france.org
Official French denylist of money-related fraud sites.
-
SMS: The most popular and least secure 2FA method allthingsauth.com
-
The never-ending product requirements of user authorization alexolivier.me
How a simple authorization model based on roles is not enough and gets complicated fast due to product packaging, data locality, enterprise organizations and compliance.
-
Awesome Identifiers adileo.github.io
A benchmark of all identifier formats.
-
OAuth 2 Simplified aaronparecki.com
A reference article describing the protocol in simplified format to help developers and service providers implement it.
