Scaling backend authentication at Facebook
How-to in a nutshell: 1. Small root of trust; 2. TLS isn't enough; 3. Certificate-based tokens; 4. Crypto Auth Tokens (CATs). See the slides for more details.
- from
- IAM
- added
- 2026-10-10
- likes
- 0
similar
-
-
How to Implement a Secure Central Authentication Service in Six Steps shopify.engineering
Got multiple legacy systems to merge with their own login methods and accounts? Here is how to merge all that mess by the way of OIDC.
-
OAuth 2 Simplified aaronparecki.com
A reference article describing the protocol in simplified format to help developers and service providers implement it.
-
Beyond Passwords: 2FA, U2F and Google Advanced Protection troyhunt.com
An excellent walk-trough over all these technologies.
-
RBAC like it was meant to be tailscale.com
How we got from DAC (unix permissions, secret URL), to MAC (DRM, MFA, 2FA, SELinux), to RBAC. Details how the latter allows for better modeling of policies, ACLs, users and groups.
-
Financial-grade API Security Profile 1.0 - Part 2: Advanced openid.net
Advanced security profile of OAuth that is suitable to be used for protecting APIs with high inherent risk in the context of Financial-grade APIs.
IAM › Authentication: “How-to in a nutshell: 1. Small root of trust; 2. TLS isn't enough; 3. Certificate-based tokens; 4. Crypto Auth Tokens (CATs). See the slides for more details.”