Prevent Catastrophe When Authentication Goes Wrong
summary
Claims that live sessions can be revoked and access adjusted in real time using a reliable async stream of JWT security events called CAPE and the Shared Signals framework. Events like session_revoked and token_claims_change travel from transmitters (IDPs, apps, device managers) to receivers to terminate or modify sessions; Microsoft uses a similar system to extend token lifetimes from one hour to 24 hours while still revoking compromised sessions. Implementations are underway at Apple, Okta, Google, IBM and others, adoption gaps remain, and a transition component (a cached revocation store) is needed for apps that don’t hold session state.
AI-written summary · about
chapters (10)
- 0:00Introduction to session
- 1:29Speaker background
- 2:32Authentication limitations today
- 6:10Zero standing privilege concept
- 7:12Leveraging systems of record
- 10:18Continuous access evaluation
- 13:28Real-world Cape implementations
- 15:56Adoption challenges and transition
- 16:38Future of identity security
- 17:20Q&A session
related talks
38mAuthentication as a Microservice: Portable Customer Identity Management
14mDetecting session hijacking using rotating refresh tokens in web applications
30mInsecurity protocols: an overview of modern authentication
27mManaging a State of Distrust
34mStateless Auth w/ JSON Web Tokens
14mAPI access control strategies beyond JWT bearer tokens
13mLightning Talk: Enhancing Security with Istio: Realtime JWT Access Revocation
15mJWTs And Why They Suck