IAM
229 items from kdeldycke/awesome-iam ★2,303
-
Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud web.archive.org
Google's original paper.
-
You (probably) don't need ReCAPTCHA web.archive.org
Starts with a rant on how the service is a privacy nightmare and is tedious UI-wise, then list alternatives.
-
An argument for passwordless web.archive.org
Passwords are not the be-all and end-all of user authentication. This article tries to tell you why.
-
Lifetimes of cryptographic hash functions valerieaurora.org
“If you are using compare-by-hash to generate addresses for data that can be supplied by malicious users, you should have a plan to migrate to a new hash every few years”.
-
A Comparison of Personal Name Matching: Techniques and Practical Issues users.cecs.anu.edu.au
Customer name matching has lots of application, from account deduplication to fraud monitoring.
-
The 2020 State of SaaS Product Onboarding userpilot.com
Covers all the important facets of user onboarding.
-
User Onboarding Teardowns useronboard.com
A huge list of deconstructed first-time user signups.
-
BeyondCorp: A New Approach to Enterprise Security usenix.org
Quick overview of Google's Zero-trust Network initiative.
-
Attacking Google Authenticator unix-ninja.com
Probably on the verge of paranoia, but might be a reason to rate limit 2FA validation attempts.
-
The Difference Between SAML 2.0 and OAuth 2.0 ubisecure.com
“Even though SAML was actually designed to be widely applicable, its contemporary usage is typically shifted towards enterprise SSO scenarios. On the other hand, OAuth was designed for use with applications on the Internet, especially for delegated authorisation.”
-
For anybody who thinks "I could build that in a weekend," this is how Slack decides to send a notification twitter.com
Notifications are hard. Really hard.
-
Why are the username and password on two different pages? twilio.com
To support both SSO and password-based login. Now if breaking the login funnel in 2 steps is too infuriating to users, solve this as Dropbox does: an AJAX request when you enter your username.
-
Beyond Passwords: 2FA, U2F and Google Advanced Protection troyhunt.com
An excellent walk-trough over all these technologies.
-
Banks, Arbitrary Password Restrictions and Why They Don't Matter troyhunt.com
“Arbitrary low limits on length and character composition are bad. They look bad, they lead to negative speculation about security posture and they break tools like password managers.”
-
Standards related to Threat Intelligence threat-intelligence.eu
Open standards, tools and methodologies to support threat intelligence analysis.
-
The Cleaners thoughtmaybe.com
A documentary on these teams of underpaid people removing posts and deleting accounts.
-
AT&T rep handed control of his cellphone account to a hacker theregister.com
-
Facebook Dangerous Individuals and Organizations List theintercept.com
Some groups and content are illegal in some juridictions. This is an example of a blocklist.
-
Password expiration is dead techcrunch.com
Recent scientific research calls into question the value of many long-standing password-security practices such as password expiration policies, and points instead to better alternatives such as enforcing banned-password lists and MFA.
-
SMS 2FA auth is deprecated by NIST techcrunch.com
NIST has said that 2FA via SMS is bad and awful since 2016.
-
Your Pa$$word doesn't matter techcommunity.microsoft.com
Same conclusion as above from Microsoft: “Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.”
-
GDPR – A Practical guide for Developers techblog.bozho.net
A one-page summary of the above.
-
RBAC like it was meant to be tailscale.com
How we got from DAC (unix permissions, secret URL), to MAC (DRM, MFA, 2FA, SELinux), to RBAC. Details how the latter allows for better modeling of policies, ACLs, users and groups.
-
2FA is missing a key feature syslog.ravelin.com
“When my 2FA code is entered incorrectly I'd like to know about it”.
-
Clearing up some misconceptions about Passkeys stavros.io
Or why passkeys are not worse than passwords.
-
Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google static.googleusercontent.com
“Our analysis confirms that secret questions generally offer a security level that is far lower than user-chosen passwords. (…) Surprisingly, we found that a significant cause of this insecurity is that users often don't answer truthfully. (…) On the usability side, we show…
-
Everybody be cool, this is a robbery! sstic.org
A case study of vulnerability and exploitability of a HSM (in French, sorry).
-
The SSO Wall of Shame sso.tax
A documented rant on the excessive pricing practiced by SaaS providers to activate SSO on their product. The author's point is, as a core security feature, SSO should be reasonably priced and not part of an exclusive tier.
-
The challenges of file formats speakerdeck.com
At one point you will let users upload files in your system. Here is a corpus of suspicious media files that can be leveraged by scammers =to bypass security or fool users.
-
Everything you should know about certificates and PKI but are too afraid to ask smallstep.com
PKI lets you define a system cryptographically. It's universal and vendor neutral.
-
How to Implement a Secure Central Authentication Service in Six Steps shopify.engineering
Got multiple legacy systems to merge with their own login methods and accounts? Here is how to merge all that mess by the way of OIDC.
-
The Difficulties of SAML Single Logout shibboleth.atlassian.net
On the technical and UX issues of single logout implementations.
-
How effective is basic account hygiene at preventing hijacking security.googleblog.com
Google security team's data shows 2FA blocks 100% of automated bot hacks.
-
RFC #4122: UUID - Security Considerations rfc-editor.org
“Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access)”. UUIDs are designed to be unique, not to be random or unpredictable: do not use UUIDs as a secret.
-
The despair and darkness of people will get to you restofworld.org
Moderation of huge social networks is performed by an army of outsourced subcontractors. These people are exposed to the worst and generally ends up with PTSD.
-
An AWS IAM Security Tooling Reference ramimac.me
A comprehensive list of (maintained) tools for AWS IAM.
-
The new NIST password guidance pciguru.wordpress.com
A summary of NIST Special Publication 800-63B covering new password complexity guidelines.
-
Remove password masking passwordmasking.com
Summarizes the results from an academic study investigating the impact removing password masking has on consumer trust.
-
JOSE is a Bad Standard That Everyone Should Avoid paragonie.com
The standards are either completely broken or complex minefields hard to navigate.
-
Why Authorization is Hard osohq.com
Because it needs multiple tradeoffs on Enforcement which is required in so many places, on Decision architecture to split business logic from authorization logic, and on Modeling to balance power and complexity.
-
Authorization Academy osohq.com
An in-depth, vendor-agnostic treatment of authorization that emphasizes mental models. This guide shows the reader how to think about their authorization needs in order to make good decisions about their authorization architecture and model.
-
Investigation into the Unusual Signups openstreetmap.lu
A really detailed analysis of suspicious contributor signups on OpenStreetMap. This beautiful and high-level report demonstrating an orchestrated and directed campaign might serve as a template for fraud reports.
-
What's the Difference Between OAuth, OpenID Connect, and SAML? okta.com
Identity is hard. Another take on the different protocol is always welcome to help makes sense of it all.
-
Separate the account, user and login/auth details news.ycombinator.com
Sound advice to lay down the foundation of a future-proof IAM API.
-
How to change the hashing scheme of already hashed user's passwords news.ycombinator.com
Good news: you're not stuck with a legacy password saving scheme. Here is a trick to transparently upgrade to stronger hashing algorithm.
-
Tidbits on AWS Cloud HSM hardware news.ycombinator.com
AWS CloudHSM Classic is backed by SafeNet's Luna HSM, current CloudHSM rely on Cavium's Nitrox, which allows for partitionable "virtual HSMs".
-
Google paper's author compares Macaroons and JWTs news.ycombinator.com
As a consumer/verifier of macaroons, they allow you (through third-party caveats) to defer some authorization decisions to someone else. JWTs don't.
-
You either die an MVP or live long enough to build content moderation mux.com
“You can think about the solution space for this problem by considering three dimensions: cost, accuracy and speed. And two approaches: human review and machine review. Humans are great in one of these dimensions: accuracy. The downside is that humans are expensive and slow…
-
As a user, I want… mobile.twitter.com
A meta-critic of account management, in which features expected by the business clash with real user needs, in the form of user stories written by a fictional project manager.
-
OAuth in one picture mobile.twitter.com
A nice summary card.
- next page of items loading…
