Authentication/Authorization Starters Battle
summary
The talk compares concrete authentication and authorization technologies and their practical tradeoffs: Kerberos (SSO, central KDC DoS/key risk), SMS 2FA and biometrics (vulnerable to SS7 and spoofing), OAuth/OpenID/OIDC with JWT pitfalls, and Google Macaroons’ fine-grained caveats. It highlights newer engineering choices like Biscuits (Clever Cloud/GitHub), which combine macaroon-style caveats with compact JWT-like tokens and already has Java and Go validators.
AI-written summary · about
chapters (12)
- 0:00Authentication intro
- 1:26Auth vs authorization
- 3:10Modern auth methods
- 8:05Kerberos history
- 11:21SAML evolution
- 14:57OpenID overview
- 18:28OpenID Connect uses
- 20:36Macarons limits
- 22:41JWT intro
- 25:36Biscuits project
- 27:17Auth protocols future
- 29:01Conclusion
related talks
30mKnock, knock! Who's there?
30mInsecurity protocols: an overview of modern authentication
55mYou Shall Not Password: Modern Authentication for Web Apps
36mAuth and Distributed Systems: Don’t Throw the Baby Out with the Bathwater of Auth
19mAdvanced Authentication Framework
46mA Deep Dive into the Past, Present & Future of OAuth
56mLock That Sh*t Down!
44mThe Art of Authentication for Web Apps