Lock That Sh*t Down!
summary
Practical rules and concrete tools: prefer OAuth 2.1 + PKCE and OpenID Connect with MFA over implicit or password grants, avoid rolling your own JWT schemes (numerous RFC warnings), and favor session cookies or short-lived tokens for scalability. Use API gateways (NGINX, Kong, Spring Cloud Gateway), scan container images and Kubernetes YAML, and store secrets in HashiCorp Vault or sealed-secrets rather than plain K8s secrets. Expect ~50 new vulnerabilities daily; brute force rates (~355 MB/s MD5) make weak passwords crackable in ~40 seconds without bcrypt.
AI-written summary · about
chapters (39)
- 0:00Welcome and introduction
- 1:02What is authentication and authorization
- 3:30Brief history of auth
- 6:00Personas and secrets management
- 7:03App security patterns overview
- 8:48Basic authentication explained
- 9:50Form-based authentication
- 11:34SAML and its drawbacks
- 12:57JWT vulnerabilities and issues
- 15:46OAuth and OpenID Connect
- 17:55Multi-factor authentication
- 20:00Passwordless authentication
- 21:46Rating app security patterns
- 22:07Tired and wired app security
- 23:50API security patterns
- 24:34HTTP Basic for APIs
- 25:38Token-based API security
- 27:01OAuth grant types explained
- 29:49OAuth 2.1 and best practices
- 31:55API gateway for security
- 32:58API SDKs and best practices
- 34:03Secrets encryption and rotation
- 34:46RBAC and ACLs explained
- 35:50Rating API security patterns
- 38:41Infra auth security patterns
- 39:24Use Linux for security
- 40:28SSH with keys and automation
- 41:32Certificates and TLS management
- 43:13SSO for servers and PAM
- 44:16Docker image scanning
- 45:41Kubernetes security best practices
- 47:08Kubernetes secrets management
- 48:32Automation and vulnerability response
- 50:40Rating infra security patterns
- 51:44Actionable security advice
- 52:06Write less code securely
- 53:30Security tools and testing
- 54:33Vulnerability response and resources
- 55:14Secure by design and closing
related talks
01h 02mLock That Sh*t Down! Auth Security Patterns for Apps, APIs, and Infra
30mInsecurity protocols: an overview of modern authentication
01h 02mOpenID Connect & OAuth 2.0 – Security Best Practices
53mCommon API Security Pitfalls
59mInsecure Transit - Microservice Security
50mCommon API security pitfalls
29mAPI Security in 2017
56mSecuring an API Ecosystem with OAuth 2 0