VirtualTam's bookmarks

1. The Copenhagen Book - General guidelines on implementing authentication and authorization in web applications 2024-04-05

   tags: cryptography/hash, memory/cache, network/http, network/http/cookie, programming/go, security/authentication, security/authorization, security/oauth, security/password

   [ permalink ]

   • pilcrowOnPaper/copenhagen
2. SOC - System and Organization Controls 2024-02-17

   tags: code-review, infrastructure/automation, observability, security, security/audit, security/authentication, security/authorization, single-sign-on, source-code-management/git, source-code-management/github

   [ permalink ]

   • The SOC2 Starting Seven
   • SOC2: The Screenshots Will Continue Until Security Improves
3. passkeys - Hello passkeys! Goodbye passwords. 2023-06-11

   tags: cryptography/public-key-infrastructure, internet/browser/chrome, internet/browser/firefox, mobile/android, mobile/ios, security/authentication

   [ permalink ]

   Passkeys are a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices. Unlike passwords, passkeys are always strong and phishing-resistant.

   • https://fidoalliance.org/passkeys/
   • Apple Developer - Passkeys Overview
   • Apple Support - About the security of passkeys
   • Google Identity - Passwordless login with passkeys
   • Google Blog - The beginning of the end of the password
   • Google Security Blog - So long passwords, thanks for all the phish
   • Chromium BLog - Introducing passkeys in Chrome
   • Tailscale doesn't want your password
   • Tailscale - Custom OIDC Providers
   • YubiKeys, passkeys and the future of modern authentication
   • A Yubico FAQ about passkeys
   • Why Passkeys Will Be Simpler and More Secure Than Passwords
   • Passkeys: A shattered dream
4. WebAuthn - An API for accessing Public Key Credentials 2023-06-11

   tags: cryptography/public-key-infrastructure, internet/browser, security/authentication

   [ permalink ]

   The Web Authentication API (also known as WebAuthn) is a specification written by the W3C and FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. The API allows servers to register and authenticate users using public key cryptography instead of a password.

   • Guide to Web Authentication
   • Asynchronous Remote Key Generation: An Analysis of Yubico’s Proposal for W3C WebAuthn [PDF]
   • Issue 664630: Web Authentication API for Chrome
   • Bugzilla - [meta] Update WebAuthn JS API to the L1-REC spec
   • keepassxc#1870 - Feature Request: Integration with the Web Authentication API
5. authentication - What should be the valid characters in usernames? 2023-02-27

   tags: security/authentication, user

   [ permalink ]
6. LWN - Identity management for WireGuard 2022-12-14

   tags: network/vpn/wireguard, security, security/authentication, security/authorization, security/oauth, security/openid

   [ permalink ]
7. Cloudflare Research | OPAQUE: An Asymmetric PAKE Protocol Secure Against Pre-Computation Attacks 2022-07-12

   tags: cryptography/encryption, security/authentication, security/password

   [ permalink ]

   • https://blog.cloudflare.com/opaque-oblivious-passwords/
   • OPAQUE: An Asymmetric PAKE Protocol Secure Against Pre-Computation Attacks
   • https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-opaque
   • https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pake/
8. authentik - an open-source Identity Provider focused on flexibility and versatility 2022-07-12

   tags: configuration-management/terraform, identity, programming/go, programming/python, security/authentication, security/authorization

   [ permalink ]

   • https://github.com/goauthentik/authentik
   • https://github.com/goauthentik/terraform-provider-authentik
9. lldap: Light LDAP implementation 2022-07-12

   tags: network/ldap, programming/rust, security/authentication, security/authorization

   [ permalink ]
10. How can I run ssh-add automatically, without a password prompt? 2022-06-28

    tags: command-line, network/ssh, security/authentication

    [ permalink ]

    • https://www.openssh.com/txt/release-7.2
    • https://unix.stackexchange.com/questions/269121/openssh-have-ssh-add-keys-to-agent-as-needed

    Host blah
    AddKeysToAgent yes
    ForwardAgent   yes
    

11. NanoID: A tiny (130 bytes), secure, URL-friendly, unique string ID generator for JavaScript 2022-04-03

    tags: database, programming/api, programming/go, programming/javascript, security/authentication

    [ permalink ]

    • https://zelark.github.io/nano-id-cc/
    • https://github.com/matoous/go-nanoid
    • https://planetscale.com/blog/why-we-chose-nanoids-for-planetscales-api
12. PASETO - Platform-Agnostic SEcurity TOkens 2022-02-21

    tags: cryptography, network/http, security, security/authentication

    [ permalink ]

    • https://github.com/paragonie/paseto
    • https://github.com/paseto-standard/paseto-rfc
    • https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-bad-standard-that-everyone-should-avoid
13. Casdoor - An Identity and Access Management / Single-Sign-On platform with web UI supporting OAuth 2.0 / OIDC and SAML authentication 2022-01-31

    tags: security/authentication, security/oauth, single-sign-on

    [ permalink ]

    • https://github.com/casdoor/casdoor
14. glauth - a lightweight LDAP server for development, home use, or CI 2021-10-19

    tags: network/ldap, programming/go, security/authentication, security/authorization

    [ permalink ]

    • https://github.com/sonicnkt/glauth-ui
15. Dropbear SSH - a relatively small SSH server and client 2021-08-08

    tags: network/ssh, programming/c, security/authentication

    [ permalink ]

    • https://github.com/mkj/dropbear
    • https://www.cyberciti.biz/security/how-to-unlock-luks-using-dropbear-ssh-keys-remotely-in-linux/
    • Dropbear SSH closing connection when attempting to connect as non root user
16. 389ds in containers 2021-01-20

    tags: linux/container/docker, network/ldap, security/authentication, security/authorization

    [ permalink ]

    • https://fy.blackhats.net.au/blog/html/pages/ldap_guide_part_1_foundations.html
    • https://fy.blackhats.net.au/blog/html/pages/ldap_guide_part_2_searching.html
    • https://fy.blackhats.net.au/blog/html/pages/ldap_guide_part_3_filters.html
    • https://fy.blackhats.net.au/blog/html/pages/ldap_guide_part_4_schema_and_objects.html
    • https://github.com/389ds/389-ds-base/blob/master/docker/389-ds-fedora/Dockerfile
17. FusionDirectory — a solution to daily management of data stored in an LDAP directory 2021-01-20

    tags: linux/container/docker, network/ldap, security/authentication, security/authorization

    [ permalink ]

    • https://github.com/tiredofit/docker-fusiondirectory
    • https://hub.docker.com/r/tiredofit/fusiondirectory
18. Kubernetes basic authentication with Traefik - Stack Overflow 2020-12-21

    tags: linux/container/kubernetes, network, network/http, network/reverse-proxy, security/authentication

    [ permalink ]
19. Open Distro for Elasticsearch | Open Distro 2020-12-20

    tags: cloud, cloud/aws, machine-learning, observability/elastic/elasticsearch, observability/logging, observability/tracing, programming/java, security/authentication, security/authorization

    [ permalink ]

    • https://github.com/opendistro-for-elasticsearch
    • https://aws.amazon.com/blogs/aws/new-open-distro-for-elasticsearch/
    • https://opendistro.github.io/for-elasticsearch/blog/releases/2020/12/announcing-trace-analytics/
    • https://logz.io/blog/open-distro-for-elasticsearch/
20. GitHub - About token scanning 2019-12-31

    tags: secret, security, security/authentication, security/credentials, security/token, source-code-management/git, source-code-management/github

    [ permalink ]

    • https://developer.github.com/partnerships/token-scanning/
    • https://github.blog/2018-10-17-behind-the-scenes-of-github-token-scanning/
    • https://github.blog/2019-08-19-github-token-scanning-one-billion-tokens-identified-and-five-new-partners/