You Shall Not Password: Modern Authentication for Web Apps
summary
Explains why passwords alone fail and gives concrete alternatives: salted+hashed passwords only work if users use unique random strings; hardware tokens like YubiKey/FIDO2 keep private keys on-device and block phishing; SMS OTPs risk SIM‑swap; magic links trade offline access for convenience. Shows SAML’s practical failure mode is SAML XML canonicalization ambiguity that has led to real exploits, and advocates OIDC + JWT introspection as the modern, implementable SSO pattern while weighing security, usability and maintenance costs.
AI-written summary · about
chapters (16)
- 0:00Modern web authentication intro
- 3:21Password authentication explained
- 6:29Multi-factor authentication benefits and risks
- 8:13Hardware tokens and public key crypto
- 12:04One-time passwords and magic links
- 15:32Single sign-on advantages
- 18:42SAML challenges
- 23:36OpenID Connect for SSO
- 29:13Good auth system traits
- 34:05Summary
- 34:49Q&A FIDO2 and WebAuthn
- 37:00Q&A OAuth and OIDC data sharing
- 39:10Q&A platform hardware tokens
- 42:23Q&A hardware token compatibility
- 44:09Q&A identity providers
- 46:15Q&A SSO logout policies
related talks
55mYou Shall Not Password: Modern Authentication for Web Apps
17mGoing Beyond Passwords: The Future of User Authentication
30mGoing Beyond Passwords: The Future of User Authentication
32mPasswords are so 1990
07mImagine: A world without passwords, it is easy if you try
51mThe state of passwordless auth on the web
30mInsecurity protocols: an overview of modern authentication
21mGoing Passwordless