IAM
229 items from kdeldycke/awesome-iam ★2,303
-
MISP taxonomies and classification misp-project.org
Tags to organize information on “threat intelligence including cyber security indicators, financial fraud or counter-terrorism information.”
-
A Comparative Long-Term Study of Fallback Authentication maximiliangolla.com
Key take-away: “schemes based on email and SMS are more usable. Mechanisms based on designated trustees and personal knowledge questions, on the other hand, fall short, both in terms of convenience and efficiency.”
-
Compromising online accounts by cracking voicemail systems martinvigo.com
Or why you should not rely on automated phone calls as a method to reach the user and reset passwords, 2FA or for any kind of verification. Not unlike SMS-based 2FA, it is currently insecure and can be compromised by the way of its weakest link: voicemail systems.
-
Identity Beyond Usernames lord.io
On the concept of usernames as identifiers, and the complexities introduced when unicode characters meets uniqueness requirements.
-
PKCE Explained loginradius.com
“PKCE is used to provide one more security layer to the authorization code flow in OAuth and OpenID Connect.”
-
What the Heck is Trust and Safety? linkedin.com
A couple of real use-case to demonstrate the role of a TnS team.
-
11 Tips for Better Signup / Login UX learnui.design
Some basic tips on the login form.
-
Hostnames and usernames to reserve ldpreload.com
List of all the names that should be restricted from registration in automated systems.
-
Cryptographic Right Answers latacora.micro.blog
An up to date set of recommendations for developers who are not cryptography engineers. There's even a shorter summary available.
-
Introduction to JSON Web Tokens jwt.io
Get up to speed on JWT with this article.
-
SAML is insecure by design joonas.fi
Not only weird, SAML is also insecure by design, as it relies on signatures based on XML canonicalization, not XML byte stream. Which means you can exploit XML parser/encoder differences.
-
Is SMS 2FA Secure? No. issms2fasecure.com
Definitive research project demonstrating successful attempts at SIM swapping.
-
Things end users care about but programmers don't instadeq.com
In the same spirit as above, but broader: all the little things we overlook as developers but users really care about. In the top of that list lies account-centric features, diverse integration and import/export tools. I.e. all the enterprise customers needs to cover.
-
AWS IAM Roles, a tale of unnecessary complexity infosec.rodeo
The history of fast-growing AWS explains how the current scheme came to be, and how it compares to GCP's resource hierarchy.
-
Enterprise Information Security infosec.mozilla.org
Mozilla's security and access guidelines.
-
Open-Sourcing BuzzFeed's SSO Experience increment.com
OAuth2-friendly adaptation of the Central Authentication Service (CAS) protocol. You'll find there good OAuth user flow diagrams.
-
Webauthn and security keys imperialviolet.org
Describe how authentication works with security keys, details the protocols, and how they articulates with WebAuthn. Key takeaway: “There is no way to create a U2F key with webauthn however. (…) So complete the transition to webauthn of your login process first, then transition…
-
The Laws of Identity identityblog.com
Is this paper aims at identity metasystem, its laws still provides great insights at smaller scale, especially the first law: to always allow user control and ask for consent to earn trust.
-
reCaptcha google.com
💸 Still an effective, economical and quick solution when your company can't afford to have a dedicated team to fight bots and spammers at internet scale.
-
Discover UI Design Decisions Of Leading Companies goodui.org
From Leaked Screenshots & A/B Tests.
-
Paper we love: Privacy github.com
A collection of scientific studies of schemes providing privacy by design.
-
Papers we love: Cryptography github.com
Foundational papers of cryptography.
-
Confusable Homoglyphs git.sr.ht
🆓 Homoglyphs is a common phishing trick.
-
General List of Reserved Words gist.github.com
This is a general list of words you may want to consider reserving, in a system where users can pick any name.
-
xkeyscorerules100.txt gist.github.com
NSA's XKeyscore matching rules for TOR and other anonymity preserving tools.
-
PKI for busy people gist.github.com
Quick overview of the important stuff.
-
common-domain-prefix-suffix-list.tsv gist.github.com
Top-5000 most common domain prefix/suffix list.
-
#1 gist.github.com
, #2, #3.
-
Temporary Email Address Domains gist.github.com
A list of domains for disposable and temporary email addresses. Useful for filtering your email list to increase open rates (sending email to these domains likely will not be opened).
-
Four cents to deanonymize: Companies reverse hashed email addresses freedom-to-tinker.com
“Hashed email addresses can be easily reversed and linked to an individual”.
-
IAM Is The Real Cloud Lock-In forrestbrazeal.com
A little click-baity, but author admit that “It depends on how much you trust them to 1. Stay in business; 2. Not jack up your prices; 3. Not deprecate services out from under you; 4. Provide more value to you in business acceleration than they take away in flexibility.”
-
API Tokens: A Tedious Survey fly.io
An overview and comparison of all token-based authentication schemes for end-user APIs.
-
Automated security testing for Software Developers fahrplan.events.ccc.de
Most privacy breaches were allowed by known vulnerabilities in third-party dependencies. Here is how to detect them by the way of CI/CD.
-
The EnterpriseReady SaaS Feature Guides enterpriseready.io
The majority of the features making B2B users happy will be implemented by the IAM perimeter.
-
Bloom Filter en.wikipedia.org
Perfect for this use-case, as bloom filters are designed to quickly check if an element is not in a (large) set. Variations of bloom filters exist for specific data types.
-
The Beer Drinker's Guide to SAML duo.com
SAML is arcane at times. A another analogy might helps get more sense out of it.
-
DigitalOcean Accounts changelog docs.digitalocean.com
All the latest accounts updates on DO.
-
An Illustrated Guide to OAuth and OpenID Connect developer.okta.com
Explain how these standards work using simplified illustrations.
-
Why differential privacy is awesome desfontain.es
Explain the intuition behind differential privacy, a theoretical framework which allow sharing of aggregated data without compromising confidentiality. See follow-up articles with more details and practical aspects.
-
Descope descope.com
Drag and drop your auth. Add authentication, user management, and authorization to your app with a few lines of code.
-
Semantic-based Automated Reasoning for AWS Access Policies using SMT d1.awsstatic.com
Zelkova is how AWS does it. This system perform symbolic analysis of IAM policies, and solve the reachability of resources according user's rights and access constraints. Also see the higher-level introduction given at re:inforce 2019.
-
Trust and safety 101 csoonline.com
A great introduction on the domain and its responsibilities.
-
Stop using JWT for sessions cryto.net
And why your "solution" doesn't work, because stateless JWT tokens cannot be invalidated or updated. They will introduce either size issues or security issues depending on where you store them. Stateful JWT tokens are functionally the same as session cookies, but without the…
-
cryptoanarchy.wiki cryptoanarchy.wiki
Cypherpunks overlaps with security. This wiki compiles information about the movement, its history and the people/events of note.
-
GCP IAM release notes cloud.google.com
Also of note: Identity Platform, Resource Manager, Key Management Service/HSM, Access Context Manager, Identity-Aware Proxy, Data Loss Prevention and Security Scanner.
-
Biscuit clever-cloud.com
Merges concepts from cookies, JWTs, macaroons and Open Policy Agent. “It provide a logic language based on Datalog to write authorization policies. It can store data, like JWT, or small conditions like Macaroons, but it is also able to represent more complex rules like…
-
Password Storage Cheat Sheet cheatsheetseries.owasp.org
The only way to slow down offline attacks is by carefully choosing hash algorithms that are as resource intensive as possible.
-
The Case for Granular Permissions cerbos.dev
Discuss the limitations of RBAC and how ABAC (Attribute-Based Access Control) addresses them.
-
SMS Multifactor Authentication in Antarctica brr.fyi
Doesn't work because there are no cellphone towers at stations in Antarctica.
-
Don't get clever with login forms bradfrost.com
Create login forms that are simple, linkable, predictable, and play nicely with password managers.
- next page of items loading…
