IAM
229 items from kdeldycke/awesome-iam ★2,303
-
Password expiration is dead techcrunch.com
Recent scientific research calls into question the value of many long-standing password-security practices such as password expiration policies, and points instead to better alternatives such as enforcing banned-password lists and MFA.
-
SMS 2FA auth is deprecated by NIST techcrunch.com
NIST has said that 2FA via SMS is bad and awful since 2016.
-
Your Pa$$word doesn't matter techcommunity.microsoft.com
Same conclusion as above from Microsoft: “Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.”
-
GDPR – A Practical guide for Developers techblog.bozho.net
A one-page summary of the above.
-
RBAC like it was meant to be tailscale.com
How we got from DAC (unix permissions, secret URL), to MAC (DRM, MFA, 2FA, SELinux), to RBAC. Details how the latter allows for better modeling of policies, ACLs, users and groups.
-
2FA is missing a key feature syslog.ravelin.com
“When my 2FA code is entered incorrectly I'd like to know about it”.
-
Clearing up some misconceptions about Passkeys stavros.io
Or why passkeys are not worse than passwords.
-
Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google static.googleusercontent.com
“Our analysis confirms that secret questions generally offer a security level that is far lower than user-chosen passwords. (…) Surprisingly, we found that a significant cause of this insecurity is that users often don't answer truthfully. (…) On the usability side, we show…
-
Everybody be cool, this is a robbery! sstic.org
A case study of vulnerability and exploitability of a HSM (in French, sorry).
-
The SSO Wall of Shame sso.tax
A documented rant on the excessive pricing practiced by SaaS providers to activate SSO on their product. The author's point is, as a core security feature, SSO should be reasonably priced and not part of an exclusive tier.
-
The challenges of file formats speakerdeck.com
At one point you will let users upload files in your system. Here is a corpus of suspicious media files that can be leveraged by scammers =to bypass security or fool users.
-
Everything you should know about certificates and PKI but are too afraid to ask smallstep.com
PKI lets you define a system cryptographically. It's universal and vendor neutral.
-
How to Implement a Secure Central Authentication Service in Six Steps shopify.engineering
Got multiple legacy systems to merge with their own login methods and accounts? Here is how to merge all that mess by the way of OIDC.
-
The Difficulties of SAML Single Logout shibboleth.atlassian.net
On the technical and UX issues of single logout implementations.
-
How effective is basic account hygiene at preventing hijacking security.googleblog.com
Google security team's data shows 2FA blocks 100% of automated bot hacks.
-
RFC #4122: UUID - Security Considerations rfc-editor.org
“Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access)”. UUIDs are designed to be unique, not to be random or unpredictable: do not use UUIDs as a secret.
-
The despair and darkness of people will get to you restofworld.org
Moderation of huge social networks is performed by an army of outsourced subcontractors. These people are exposed to the worst and generally ends up with PTSD.
-
An AWS IAM Security Tooling Reference ramimac.me
A comprehensive list of (maintained) tools for AWS IAM.
-
The new NIST password guidance pciguru.wordpress.com
A summary of NIST Special Publication 800-63B covering new password complexity guidelines.
-
Remove password masking passwordmasking.com
Summarizes the results from an academic study investigating the impact removing password masking has on consumer trust.
-
JOSE is a Bad Standard That Everyone Should Avoid paragonie.com
The standards are either completely broken or complex minefields hard to navigate.
-
Why Authorization is Hard osohq.com
Because it needs multiple tradeoffs on Enforcement which is required in so many places, on Decision architecture to split business logic from authorization logic, and on Modeling to balance power and complexity.
-
Authorization Academy osohq.com
An in-depth, vendor-agnostic treatment of authorization that emphasizes mental models. This guide shows the reader how to think about their authorization needs in order to make good decisions about their authorization architecture and model.
-
Investigation into the Unusual Signups openstreetmap.lu
A really detailed analysis of suspicious contributor signups on OpenStreetMap. This beautiful and high-level report demonstrating an orchestrated and directed campaign might serve as a template for fraud reports.
-
What's the Difference Between OAuth, OpenID Connect, and SAML? okta.com
Identity is hard. Another take on the different protocol is always welcome to help makes sense of it all.
-
Separate the account, user and login/auth details news.ycombinator.com
Sound advice to lay down the foundation of a future-proof IAM API.
-
How to change the hashing scheme of already hashed user's passwords news.ycombinator.com
Good news: you're not stuck with a legacy password saving scheme. Here is a trick to transparently upgrade to stronger hashing algorithm.
-
Tidbits on AWS Cloud HSM hardware news.ycombinator.com
AWS CloudHSM Classic is backed by SafeNet's Luna HSM, current CloudHSM rely on Cavium's Nitrox, which allows for partitionable "virtual HSMs".
-
Google paper's author compares Macaroons and JWTs news.ycombinator.com
As a consumer/verifier of macaroons, they allow you (through third-party caveats) to defer some authorization decisions to someone else. JWTs don't.
-
You either die an MVP or live long enough to build content moderation mux.com
“You can think about the solution space for this problem by considering three dimensions: cost, accuracy and speed. And two approaches: human review and machine review. Humans are great in one of these dimensions: accuracy. The downside is that humans are expensive and slow…
-
As a user, I want… mobile.twitter.com
A meta-critic of account management, in which features expected by the business clash with real user needs, in the form of user stories written by a fictional project manager.
-
OAuth in one picture mobile.twitter.com
A nice summary card.
-
MISP taxonomies and classification misp-project.org
Tags to organize information on “threat intelligence including cyber security indicators, financial fraud or counter-terrorism information.”
-
A Comparative Long-Term Study of Fallback Authentication maximiliangolla.com
Key take-away: “schemes based on email and SMS are more usable. Mechanisms based on designated trustees and personal knowledge questions, on the other hand, fall short, both in terms of convenience and efficiency.”
-
Compromising online accounts by cracking voicemail systems martinvigo.com
Or why you should not rely on automated phone calls as a method to reach the user and reset passwords, 2FA or for any kind of verification. Not unlike SMS-based 2FA, it is currently insecure and can be compromised by the way of its weakest link: voicemail systems.
-
Identity Beyond Usernames lord.io
On the concept of usernames as identifiers, and the complexities introduced when unicode characters meets uniqueness requirements.
-
PKCE Explained loginradius.com
“PKCE is used to provide one more security layer to the authorization code flow in OAuth and OpenID Connect.”
-
What the Heck is Trust and Safety? linkedin.com
A couple of real use-case to demonstrate the role of a TnS team.
-
11 Tips for Better Signup / Login UX learnui.design
Some basic tips on the login form.
-
Hostnames and usernames to reserve ldpreload.com
List of all the names that should be restricted from registration in automated systems.
-
Cryptographic Right Answers latacora.micro.blog
An up to date set of recommendations for developers who are not cryptography engineers. There's even a shorter summary available.
-
Introduction to JSON Web Tokens jwt.io
Get up to speed on JWT with this article.
-
SAML is insecure by design joonas.fi
Not only weird, SAML is also insecure by design, as it relies on signatures based on XML canonicalization, not XML byte stream. Which means you can exploit XML parser/encoder differences.
-
Is SMS 2FA Secure? No. issms2fasecure.com
Definitive research project demonstrating successful attempts at SIM swapping.
-
Things end users care about but programmers don't instadeq.com
In the same spirit as above, but broader: all the little things we overlook as developers but users really care about. In the top of that list lies account-centric features, diverse integration and import/export tools. I.e. all the enterprise customers needs to cover.
-
AWS IAM Roles, a tale of unnecessary complexity infosec.rodeo
The history of fast-growing AWS explains how the current scheme came to be, and how it compares to GCP's resource hierarchy.
-
Enterprise Information Security infosec.mozilla.org
Mozilla's security and access guidelines.
-
Open-Sourcing BuzzFeed's SSO Experience increment.com
OAuth2-friendly adaptation of the Central Authentication Service (CAS) protocol. You'll find there good OAuth user flow diagrams.
-
Webauthn and security keys imperialviolet.org
Describe how authentication works with security keys, details the protocols, and how they articulates with WebAuthn. Key takeaway: “There is no way to create a U2F key with webauthn however. (…) So complete the transition to webauthn of your login process first, then transition…
-
The Laws of Identity identityblog.com
Is this paper aims at identity metasystem, its laws still provides great insights at smaller scale, especially the first law: to always allow user control and ask for consent to earn trust.
- next page of items loading…
