The evolution of user logins
summary
History of logins moves from plain username/password to a multi-layered stack with TLS, HSTS, WAFs, load balancers, kernel patching, OAuth/OIDC/SAML tokens, WebAuthn/FIDO and global distribution. Shows a concrete failure: MFA bypass via email change where CSRs let attackers swap account email and regain access, losing ~300,000 points. Covers tooling like rate limiting, credential stuffing defenses, API gateways and biometrics on-device only, and argues teams not individuals must own authentication.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:29Overview
- 0:56Login page
- 1:13Login and password
- 2:00Back in 2000s
- 2:26Today
- 5:40Infrastructure
- 6:33Application
- 7:42API gateways
- 8:24Browsers
- 9:10Bad passwords
- 10:24Worldwide problem
- 11:24How it went
- 13:25What now
- 14:17Outro
related talks
16mInnovation in Authentication and More
42mChallenges in User Authentication: Balancing Security & User Experience
37mCustomer Identity for Modern Apps and APIs
30mGoing Beyond Passwords: The Future of User Authentication
30mInsecurity protocols: an overview of modern authentication
31mLog In Through the Front Door: Automating Defense Against...
55mYou Shall Not Password: Modern Authentication for Web Apps
47mPasswords are so 1990