Knock, knock! Who's there?
summary
Covers concrete authentication choices and tradeoffs: password hashing with argon2 and scrypt (and why salts and cost/memory matter), RFC basic/digest and token/bearer schemes for APIs, OAuth access tokens versus personal access tokens with prefixes (GitHub/PyPI), pointed critique of JWTs and a practical alternative using Django core signing, mutual auth via SSH/MTLS for service-to-service, and hardware-backed keys like FIDO2 (YubiKey) that move private keys off the client.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:10The Beginning
- 13:34Basic & Digest Authentication
- 17:35Bearer Authentication
- 19:43JWT
- 21:54Mutual Authentication
- 23:26FIDO2 / WebAuthn
related talks
31mAuthentication/Authorization Starters Battle
55mYou Shall Not Password: Modern Authentication for Web Apps
30mInsecurity protocols: an overview of modern authentication
56mLock That Sh*t Down!
51mYou Shall Not Password: Modern Authentication for Web Apps
32mREST security essentials
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
38mAuthentication as a Microservice: Portable Customer Identity Management