Topic
35 posts tagged “Authentication”.
The Lycoris Team · · 5 min read Biometric authentication verifies identity using fingerprints, faces, or other traits — here's how enrollment, matching, and liveness checks work.
Chisato · · 4 min read A man-in-the-browser attack uses malware inside the browser itself to alter what a user sees and submits, bypassing HTTPS and session protections entirely.
The Lycoris Team · · 5 min read CSRF forges a request using a victim's login session; XSS runs the attacker's own code inside the victim's browser. Different mechanisms, different fixes.
Chisato · · 4 min read A magic link authenticates a user by emailing a single-use, expiring URL instead of checking a password. How the flow works and its real tradeoffs.
Chisato · · 4 min read Session hijacking steals a valid session token to impersonate a logged-in user without a password. How attackers do it and how to stop it.
Chisato · · 4 min read SCIM is a standard protocol for automatically creating, updating, and deactivating user accounts across apps as an identity provider's directory changes.
Chisato · · 5 min read TOTP generates a new six-digit code every 30 seconds from a shared secret and the current time. How authenticator apps use it, and where it falls short.
Chisato · · 4 min read A rainbow table is a precomputed lookup of hash chains that speeds up cracking unsalted password hashes. How it works and why salting defeats it.
Chisato · · 4 min read MFA requires two or more independent proofs of identity to log in. How the factor categories work, common methods, and why MFA stops most account takeovers.
Chisato · · 4 min read Privileged access management controls, monitors, and time-limits who can use admin credentials, reducing the blast radius of a breach.
Chisato · · 4 min read FIDO2 is the open authentication standard that makes passkeys and hardware security keys work, using public-key cryptography instead of shared secrets.
Chisato · · 4 min read SSH key pairs authenticate with cryptographic proof instead of a shared secret, resisting brute force and credential reuse in ways passwords structurally can't.
Chisato · · 5 min read Session fixation tricks a victim into using an attacker-known session ID, so logging in hands the attacker an authenticated session too.
Chisato · · 4 min read IDOR is an access control flaw where an app trusts a user-supplied ID to fetch a record without checking the requester actually owns it.
Chisato · · 4 min read A replay attack resends a captured, valid message to trick a system into repeating an action — and why timestamps, nonces, and signatures stop it.
Chisato · · 4 min read PKCE hardens the OAuth authorization code flow against interception, and is now recommended for every client type, not just mobile and single-page apps.
The Lycoris Team · · 4 min read API keys are static secrets tied to an app; OAuth tokens are short-lived, scoped, and tied to a specific user's consent. Here's when to use each.
Chisato · · 4 min read HttpOnly, Secure, and SameSite are cookie attributes that block script access, force HTTPS, and limit cross-site sending. Here's what each one actually stops.
Chisato · · 5 min read RBAC grants access based on a user's assigned role; ABAC evaluates attributes of the user, resource, and context at request time. How they compare.
The Lycoris Team · · 5 min read A digital signature uses a private key to prove a message's origin and integrity, and a public key lets anyone verify it — no shared secret required.
Chisato · · 4 min read Credential stuffing tests stolen username-password pairs against other sites, exploiting reused passwords. How it works and the defenses that actually stop it.
Chisato · · 4 min read A TPM is a dedicated chip that generates and stores cryptographic keys in hardware, isolated from the operating system. Here's what it actually does.
Chisato · · 5 min read SSO lets a user log in once with one identity provider and access multiple apps without re-entering credentials. How the trust relationship works.
Chisato · · 4 min read HMAC combines a secret key with a hash function to prove a message wasn't altered and came from someone who holds the key. Here's how it works.
Chisato · · 4 min read Password hashing turns a password into a one-way, salted digest so a stolen database doesn't hand over credentials. How bcrypt and Argon2 work.
Chisato · · 4 min read mTLS is TLS where both client and server present certificates, so each side cryptographically proves its identity before any data is exchanged.
Chisato · · 4 min read MFA requires two or more independent proofs of identity — something you know, have, or are — to stop stolen passwords from being enough to break in.
Chisato · · 4 min read CSRF tricks a logged-in user's browser into sending an unwanted authenticated request. Cookies, tokens, and SameSite settings are the defense.
Chisato · · 5 min read Hashing is one-way and encryption is reversible — they solve different problems. When to use each, why passwords are hashed, and common mistakes.
Chisato · · 6 min read Zero trust security treats every user, device, and request as untrusted until verified. Core principles, ZTNA vs VPN, and a practical adoption path.
Chisato · · 4 min read OAuth 2.0 handles authorization, OIDC adds authentication, and SAML powers enterprise SSO. How the three protocols differ and which one your app needs.
Chisato · · 5 min read OAuth 2.0 grant types are the flows apps use to get access tokens. Authorization code with PKCE, client credentials, device flow — and when to use each.
Chisato · · 6 min read OAuth 2.0 lets apps access your data without your password. How the authorization flow works, what PKCE adds, and how OAuth differs from authentication.
Chisato · · 4 min read A JWT is a compact, signed token that carries JSON claims — identity and authorization without a session lookup. How it works and what to watch out for.
Chisato · · 6 min read Passkeys are phishing-resistant, faster to use, and now supported almost everywhere. Here's how they work and why the password era is finally ending.
