You Shall Not Password: Modern Authentication for Web Apps
summary
Covers concrete methods: username+salted hash storage (and brute‑force limits), one‑time codes and magic links, and hardware authenticators (U2F/USB keys and platform authenticators) using public‑key signatures that stop phishing. Explains SSO via SAML (XML canonicalization mess makes it fragile) versus OIDC (JWTs and token introspection), and details passkeys (Google/Microsoft/Apple daisy‑chaining device verification to cloud‑stored keypairs). Conclusion: hardware keys and passkeys markedly reduce phishing but SAML is hard to implement correctly and central providers create a single‑point risk.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:32User authentication importance
- 5:25Username/password auth
- 11:26Multi-factor authentication benefits
- 13:11Hardware tokens deep dive
- 18:47One-time passwords & magic links
- 23:19Single sign-on & identity providers
- 26:07SAML challenges
- 31:16OpenID Connect & token verification
- 36:57Passkeys security model
- 45:21Good auth system traits
- 49:55Q&A
related talks
51mYou Shall Not Password: Modern Authentication for Web Apps
32mPasswords are so 1990
21mPasswords are so 1990
30mInsecurity protocols: an overview of modern authentication
30mGoing Beyond Passwords: The Future of User Authentication
38mJourney to passwordless
30mThe State of Passwordless Auth on the Web
42mPasswords are so 1990!