authentication

Dan Callahan presents Mozilla Persona, a decentralized, cross-browser authentication system that removes site passwords, at PyCon 2013. He explains how the protocol works and how to add it to a Python site.

Tom Scott performs a fictional story at GeekyConf about the day Google accidentally stops checking passwords, letting anyone into any account. It works as a parable about how a single point of failure in login can unravel everything built on it.

Okta developer advocate Nate Barbettini explains OAuth 2.0 and OpenID Connect in a roughly hour-long talk. It starts from the problems the protocols solve and walks through the flows. The description notes the implicit flow material is now out of date.

Scott Arciszewski's DEF CON 26 Crypto and Privacy Village talk critiquing the JOSE standards (JWT, JWS, JWE) and showing how to design cryptographic tokens more safely.

DHH's opening keynote at Rails World 2024 in Toronto, where Rails 8 beta shipped. It covers built-in authentication, Propshaft, Solid Cache, Solid Queue, Solid Cable, Kamal 2 and Thruster, pitching the One Person Framework that needs no PaaS.

Tom Caputi presents the design of native encryption for ZFS at the OpenZFS Developer Summit, including design decisions and how authentication uses checksum fields.

Tobias Engel's 31C3 talk shows how weaknesses in the SS7 telephone signaling network let companies and attackers locate, track and manipulate phones from anywhere in the world, with precision down to about 50 meters.