Tag

Authentication

4 posts

October 2026

The Username That Ate the Password: Argon2id, NIST SP 800-63B-4, and Storing Passwords in 2026 Between July and October 2024, an Okta login path accepted any password for some users, because bcrypt reads only the first 72 bytes of its input and a long username … Research 24 min read

September 2026

The Logout That Didn't: Session Revocation, Shared Signals, and the Half-Life of a Stolen Token Every system can issue a session. Almost none can reliably end one. A password reset revokes a refresh token, but the fifteen-minute JWT in the attacker's terminal keeps … Research 28 min read

July 2026

The 202 That Tells You Nothing: Anti-Enumeration Engineering in Auth Systems Every difference between your system's answer for a user that exists and a user that does not is a database query an attacker runs for free. This post treats … Research 18 min read

June 2026

Passkeys in Production: The Sharp Edges Nobody Puts in the Demo The WebAuthn demo takes an afternoon. Production takes a year, and the hard parts are nowhere near the ceremony code: an rp_id decision you cannot revise after launch, a … Research 20 min read

All posts