Interview Speaker
summary
Argues that developers should stop storing passwords and instead use an IDP like Azure AD, with SDKs handling OAuth2/OIDC so passwordless and MFA work with no single line of crypto code. Recommends switch on MFA for immediate risk reduction, avoid putting sensitive data in JWTs, and treat id tokens versus access tokens differently. Notes JWTs scale (tens of billions of validations daily), service principals/apps represent applications, and middleware plus proper patterns is what actually makes authentication secure.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 2:24Security identity for developers
- 5:13Making security easier for devs
- 6:15Passwordless and MFA importance
- 8:30Future of authentication
- 10:15Best practices and middleware
- 11:17JWT use cases beyond auth
- 12:23Physical access with identity
- 13:09Service principals explained
- 14:34Lighthearted Q&A
related talks
37mCustomer Identity for Modern Apps and APIs
19mAdvanced Authentication Framework
08mModern Identity Management and Learning from Developers Around the World
51mYou Shall Not Password: Modern Authentication for Web Apps
01h 02mModern Authentication
32mModern And Secure IAM For Modern Applications
31mAuthentication/Authorization Starters Battle
38mAuthentication as a Microservice: Portable Customer Identity Management