Multifactor Authentication in the Cloud
summary
Introduces a working system called ZTrustee that stores encrypted “deposits” (passwords, keys, certs) and releases them only after N‑of‑M trustee voting, with trustees that can be humans, HSMs, or programs. Clients sign/encrypt requests with GPG; server checks signatures and returns GPG‑encrypted responses over SSL as GPG‑signed, SSL‑encrypted JSON blobs. Integrations include PAM integration for sudo/SSH, AWS/Google Auth, mobile push approvals, REST/CLI/Java/Python/C APIs, PostgreSQL+Apache backend, on‑prem or SaaS, and measured scalability to ~10k concurrent connections.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:19The act of confirming the identity of a person, or program, using something it... has passport, driver's license, token, phone, certificate
- 3:51Traditionally called "two-factor authentication" . Some combination of
- 14:20Much of the cloud involves virtual machine to machine communication between services
- 16:37A trustee is a legal term for a person or entity w has a position of responsibility or authority on beh of others
- 17:32The concept of a trustee as a "voter" was formula by Edmund Burke, British MP and philosopher, in 1774
- 20:07Brings the concept of trustees to software authentication and authorization systems • Enables Linux system administrators to delegate ti approval of the release of security objects, such as
- 33:51Programmatic REST APIs Shell Python, C, lava
- 42:53Put deposits that require a quorum of votes to authorize the release
- 57:28Rolling tokens are extremely simple in concept Working example in shell, 10-second TOTP
related talks
39mManaging Trust Between Multiple Clouds and Non-human Identities Without Passwords
20mTrust by verify - how to provide secure access to your team
01h 00mMulti-Factor Authentication on the Cutting Edge
23mEstablishing trust with verifiable creds and zero trust
40mDon’t Trust Opaque Clouds, Cryptographically Verify Instead!
49mZero Trust Security
26mHolistic Authentication
34mThrow Away Your Passwords: Trusting Workload Identity