IAM
229 items from kdeldycke/awesome-iam ★2,303
-
-
-
Hidden OAuth attack vectors portswigger.net
How to identify and exploit some of the key vulnerabilities found in OAuth 2.0 authentication mechanisms.
-
-
Unofficial Weekly Google Cloud Platform newsletter gcpweekly.com
Relevant keywords: IAM and Security.
-
An Overview of Cryptography garykessler.net
“This paper has two major purposes. The first is to define some of the terms and concepts behind basic cryptographic methods, and to offer a way to compare the myriad cryptographic schemes in use today. The second is to provide some real examples of cryptography in use today.”
-
-
OAuth 2.0 Security Best Current Practice datatracker.ietf.org
“Updates and extends the OAuth 2.0 Security Threat Model to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application”.
-
HTML attributes to improve your users' two factor authentication experience twilio.com
“In this post we will look at the humble <input> element and the HTML attributes that will help speed up our users' two factor authentication experience”.
-
Magic Links – Are they Actually Outdated? zitadel.com
What are magic links, their origin, pros and cons.
-
WebAuthn guide webauthn.guide
Introduce WebAuthn as a standard supported by all major browsers, and allowing “servers to register and authenticate users using public key cryptography instead of a password”.
-
Real World Crypto Symposium web.archive.org
Aims to bring together cryptography researchers with developers, focusing on uses in real-world environments such as the Internet, the cloud, and embedded devices.
-
HSM: What they are and why it's likely that you've (indirectly) used one today web.archive.org
Really basic overview of HSM usages.
-
Getting started with security keys web.archive.org
A practical guide to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys.
-
163 AWS services explained in one line each web.archive.org
Help makes sense of their huge service catalog. In the same spirit: AWS In Plain English.
-
GCP's IAM syntax is better than AWS's web.archive.org
The minutiae of permission design in GCP improves the developer's experience.
-
What is BeyondCorp? What is Identity-Aware Proxy? web.archive.org
More companies add extra layers of VPNs, firewalls, restrictions and constraints, resulting in a terrible experience and a slight security gain. There's a better way.
-
Mitigating Cloud Vulnerabilities web.archive.org
“This document divides cloud vulnerabilities into four classes (misconfiguration, poor access control, shared tenancy vulnerabilities, and supply chain vulnerabilities)”.
-
Google's Macaroons in Five Minutes or Less web.archive.org
If I'm given a Macaroon that authorizes me to perform some action(s) under certain restrictions, I can non-interactively build a second Macaroon with stricter restrictions that I can then give to you.
-
In Search For a Perfect Access Control System web.archive.org
The historical origins of authorization schemes. Hints at the future of sharing, trust and delegation between different teams and organizations.
-
After Car2Go eased its background checks, 75 of its vehicles were stolen in one day. web.archive.org
Why background check are sometimes necessary.
-
SAML vs. OAuth web.archive.org
“OAuth is a protocol for authorization: it ensures Bob goes to the right parking lot. In contrast, SAML is a protocol for authentication, or allowing Bob to get past the guardhouse.”
-
JWT, JWS and JWE for Not So Dummies! web.archive.org
A signed JWT is known as a JWS (JSON Web Signature). In fact a JWT does not exist itself — either it has to be a JWS or a JWE (JSON Web Encryption). Its like an abstract class — the JWS and JWE are the concrete implementations.
-
The False Allure of Hashing for Anonymization web.archive.org
Hashing is not sufficient for anonymization no. But still it is good enough for pseudonymization (which is allowed by the GDPR).
-
Hardcoded secrets, unverified tokens, and other common JWT mistakes web.archive.org
A good recap of all JWT pitfalls.
-
How Radix trees made blocking IPs 5000 times faster web.archive.org
Radix trees might come handy to speed-up IP blocklists.
-
IAM is hard. It's really hard. web.archive.org
“Overly permissive AWS IAM policies that allowed s3:GetObject to * (all) resources”, led to $80 million fine for Capital One. The only reason why you can't overlook IAM as a business owner.
-
A Child's Garden of Inter-Service Authentication Schemes web.archive.org
In the same spirit as above, but this time at the service level.
-
Conversion Optimization web.archive.org
A collection of tactics to increase the chance of users finishing the account creation funnel.
-
Zanzibar: Google's Consistent, Global Authorization System web.archive.org
Scales to trillions of access control lists and millions of authorization requests per second to support services used by billions of people. It has maintained 95th-percentile latency of less than 10 milliseconds and availability of greater than 99.999% over 3 years of…
- next page of items loading…
