Managing a State of Distrust
summary
Every authentication strategy reduces to three concrete parts: sessions, tokens, exchanges. The speaker shows working examples: email+password with a session store, two opaque tokens (use ≥16 bytes secure randomness), an access token ~5 minutes and a long-lived refresh token used at a refresh endpoint; and OpenID Connect where a client_id/secret and redirect URIs exchange an auth code for an ID token (JWT) plus access token, verifying signatures, issuer, and audience. Decision guidance: use a provider for speed and security expertise, roll your own for cost and control.
AI-written summary · about
chapters (9)
- 0:00Introduction and speaker background
- 1:38Authentication focus and framework overview
- 4:08First principles of authentication
- 6:56Three pillars of authentication strategy
- 10:08Email and password authentication flow
- 13:44OpenID Connect explained
- 20:46Designing authentication strategies
- 23:19Using identity providers vs rolling your own
- 25:26Final advice and resources
related talks
30mInsecurity protocols: an overview of modern authentication
32mREST security essentials
13mService Authentication - Tokens or Certificates?
28mGetting to know your users
47mModern Authentication 101
44mThe Art of Authentication for Web Apps
38mAuthentication as a Microservice: Portable Customer Identity Management
36mTo Identity and Beyond