35 articles tagged Authentication.
For years, identity protocols have used phrases such as Holder of Key, Proof of Possession, Key Binding, and Bearer almost interchangeably.
Read article: Holder of Key vs. Proof of Possession: Two Sides of Cryptographic IdentityIf you’ve ever read a specification like WebAuthn, DID Core, SD-JWT VC, BBS Signatures, OID4VCI, or OID4VP, you’ve probably encountered references to P-256, secp256k1, Ed25519, or BLS12–381.
Read article: Elliptic Curve Groups: The Mathematical Engine Behind Modern Digital IdentityWebAuthn is actually the tip of a much larger iceberg. Like the SD-JWT VC spec, it is built upon several W3C, FIDO Alliance, and IETF specifications. Together, these define a complete passwordless authentication ecosystem.
Read article: WebAuthN: Passwordless LoginsAuthentication is one of the most fundamental concepts in application security. Most developers spend considerable time designing how authenticated users are represented, authorized, and managed. Surprisingly, much less attention is given to the opposite state of users who have not authenticated at…
Read article: Understanding Unauthenticated Traffic: How Applications and APIs Represent The Unauthenticated UserMulti-Factor Authentication (MFA) is the security control that can make, or break, your business. If there’s one cybersecurity control that consistently separates organizations that get breached from those that don’t, it’s Multi-Factor Authentication (or, to be precise, MFA, done correctly).
Read article: Multi-Factor Authentication (MFA): Don’t Let Your CyberSecurity Insurance Claim Get Denied On…In certain US industries, usually legacy businesses with low margins and heavily regulated, it is still quite common to use source IP address as an authentication mechanism on the public internet. Now, never mind that in the age of cloud computing and SaaS applications, it is rare for cloud…
Read article: Don’t Use Source IP Addresses As The Primary Authentication MechanismBut, let’s face it, you’re probably going to do it anyway.
Read article: No, You Shouldn’t Use Production Data For TestingPrivacy (and Digital Privacy) is one of those terms that I’ve thrown around a lot in the last few years. However, I never took the time to define it.
Read article: What Is Digital Privacy?Authentication is described in this post.
Read article: Static Credentials Must Not Be Used In The Browser
