NOPASSWD: Building a Passwordless Cloud Infrastructure
summary
Claims a fully passwordless cloud stack is practical today using Azure AD as IdP, AWS IAM roles with SAML/OIDC trust, an AWS VPN client tied to the IdP, RDS using RDS IAM auth short‑lived tokens, and CI/CD using GitHub Actions OIDC so builds assume precisely scoped IAM roles. Demonstrates replacing long‑lived keys and secrets, cites Codecov-style supply‑chain risk (29,000 clients affected) and shows the design deployed in production with reduced credential leakage and no persistent passwords.
AI-written summary · about
chapters (9)
- 0:00Introduction and context
- 2:34The problem with passwords
- 7:05The cost of password breaches
- 10:12Passwordless alternatives
- 13:50Passkeys and adoption
- 17:55Traditional cloud security
- 23:46Building a passwordless system
- 32:34Vendor selection and tips
- 36:38Limitations and conclusion
related talks
40mNOPASSWD: Building a Passwordless Cloud Infrastructure
50mNOPASSWD: Building a Passwordless Cloud Infrastructure
34mThrow Away Your Passwords: Trusting Workload Identity
46mThe Nightmare for Attackers: An Infrastructure without Secrets
45mAttackers' Nightmare: An Infrastructure Without Secrets
50mDestroying Long-Lived Cloud Credentials with Workload Identity Federation
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
44mSecrets at Scale: Managing Cloud Credentials with PowerShell Automation