"It Me": Under the Hood of Web Authentication
summary
Deep dive into Passport.js, Flask/JWT and real breaches shows what matters: a password check that compares plaintext or uses naive equality leaks secrets via timing-safe string comparison attacks (demo measures 91 ns vs 115 ns), Adobe’s 2013 leak exposes ~150M accounts with ~2M using the same weak password, Let's Encrypt had a timing bug, Node adds crypto.timingSafeEqual, SMS one-time codes suffer SIM‑swap/phishing, and U2F security keys (hardware or soft tokens, ~$20, growing browser/site support) materially stop phishing.
AI-written summary · about
chapters (13)
- 0:00Intro
- 2:332013: Adobe password database leak
- 3:17Encryption = Hashing
- 6:33User sessions in web applications
- 10:01Message Authentication Codes (MACs)
- 12:20Timing-safe string comparison
- 14:31Is the timing difference measurable over the network?
- 14:59How can an attacker abuse the timing difference?
- 19:42Multi-Factor Authentication
- 20:30SMS One-Time Password (OTP)
- 29:42U2F Authentication: Adoption
- 34:42Kill Your Password with Yahoo Account key
- 37:21Is email secure in transit?
related talks
24mThe Emperor’s New Password Manager
47mThe state of passwordless auth on the web
30mInsecurity protocols: an overview of modern authentication
41mNode JS Authentication and Data Security
41mWeb Security
55mYou Shall Not Password: Modern Authentication for Web Apps
47mPasswords are so 1990
29mSecurity by(e) Design?