Authenticusis in the Construction Tech Industry

Authenticus

authenticus

I really like 's AARRR to defining your company objectives. tability.io funnel-based approach What is the AARRR funnel? The the AARRR funnel (aka “Pirate Metrics”) is, in internet time at least, an framework that divides your users' journey — into 5 steps: age-old 🪰 how do people discover you? Acquisition: 🕷️ how many of those people actually try your product? Activation: 🕸️ how many of those users come back? Retention: 🐜 how many of those users tell their networks about you? Referral: 🦟 how many of those users convert into paying customers? Revenue: Once you've answered these questions and have these insights at hand, you should start to get a sense of which areas of your funnel could use some extra TLC next quarter, so to speak. 🤧 There appears to be some around whether AARRR should be replaced with the Retention-led “RARRA”. Personally, I prefer the Pirate-Hacker alignment of energies in “AARRR”, so for the purposes of this post, we’ll be going with the original acronym. debate How to Set Company Objectives to Satisfy Every Stage of Your Funnel Your funnel priorities can be mapped against the stages of your product lifecycle, as follows: Before we list specific goals and OKRs most relevant to each funnel priority, here's a brief refresher on the stages of the Product Lifecycle. Your Quick Guide to the Stages of the Product Lifecycle 💡 Introduction 🌱 Growth 🧓🏻 Maturity 💀 Decline 1. 💡 Introduction Sometimes people build before they validate; sometimes people validate before they build. Either way: Your Product is in the Introduction Phase of its Lifecycle if: you haven't yet nailed the product-market fit you might not have launched yet you definitely aren't profitable Questions You Might Still Need to Answer in the Introduction Phase Include: Which problem/s do we solve, how, and for who — exactly? Where do our potentially biggest fans live (online)? What's the existing narrative in our space, and who is influential? How are we disrupting and improving on the status quo? "Infusing our output with critical thinking, new visions, and expansive transgressions opens up many more possibilities than it closes down. Scan for places where potency lies, get together, and start looking beyond the present." — Jess Henderson, ‘ Offline Matters: The Less Digital Guide to Creative Work’ 2. 🌱 Growth You'll Know You've Hit the Growth Phase When: you're seeing an unprecedented increase in sales you're talking a lot about how best to promote new product features to existing users your competitors know who you are "How are you positioning your product? If your current product is more advanced than competitors, you may be best positioned to earn a dominant market share—which means pushing more resources into current campaigns (at the expense of near-term profits)." — Derek Gleason for cxl.com Questions You're Probably Asking Yourself in the Growth Phase Include: Who do we need to hire right now? What are our departmental budgets and targets? Which potential partnerships are worth pursuing? How fast can the product team push this update? 3. 🧓🏻 Maturity Signs Your Product Has Reached Maturity May Include: you enjoy near-universal brand recognition you have thousands of competitors you're consistently profitable Questions You Should be Asking Yourself at Maturity Phase: What are the factors that may lead us into Decline? Are we effectively differentiating ourselves in a saturated market? Who and where are the new audiences we should be aiming to reach? 4. 💀 Decline "No matter how good your product is, it obeys the rules of the product life cycle." — Kateryna Mayka for eleken.co You'll Get that sick Decline Stage in Your Stomach Feeling When... users are not willing to pay for your product or service (aka it's no longer needed) your competitors are launching better features faster than you emerging tech starts making your product look obsolete there's a massive financial crash or change in legislation that negatively impacts your business Questions to ask when you're in Decline: How can we reduce spend and run on brand mileage? What's our rebrand, pivot, or exit strategy? What's no longer adding any value, and how can we milk what’s left? How to use the AARRR funnel to set OKRs for your product at every stage of its lifecycle Here are those Pirate Metrics one more time: 🪰 (how people find you) Acquisition 🕷️ (how many of those people actually try your product) Activation 🕸️ (how many of those people come back again, and again) Retention 🐜 (how many of those people tell their people about you) Referral 🦟 (how many of those users convert into paying customers) Revenue Now let’s get into how to set OKRs based on where your product’s at and which funnel metric you need to prioritize over the next few quarters. 🪰 1. Acquisition Prioritise Acquisition when your product is in the following phases: Introduction Growth Decline What's the Definition of Acquisition in the Product Lifecycle? Acquisition in growth or product marketing refers to efforts made to acquire new audience members, users, and/or eventually paying customers. Activities and tactics that fall under the Acquisition funnel priority include pretty much all the most expensive ones: SEO Paid Search and Social Advertising Content Marketing PR TV, Print and Billboard Advertising Going on Shark Tank, etc. How to set Product Acquisition OKRs Here are a few examples of how you might go about writing your OKRs if you wanted to focus on acquisition for the next six months: Q1 Acquisition Objective: Grow brand presence in the right markets. grow collective social media media communities to 100,000,000 key result 1: achieve 2,000 podcast downloads per episode key result 2: Q2 Acquisition Objective: Use new features/product lines to get press and attract users from new market segments. generate 10 meaningful press mentions around new/differentiating features key result 1: activate 1,000 new users on the pro/team plan key result 2: Q2 Acquisition Objective: Establish an engaged and authentic community. grow Discord community to identify 1,000 highly engaged brand ambassadors key result 1: optimize funnel to achieve 1,000 new subscriptions/month based on all site traffic key result 2: reshare and comment on ALL tagged posts on social media (15+ / week) key result 3: 2. 🕷️ Activation Prioritise Activation when your product is in the following phases: Introduction Growth What's the definition of Product Activation? Unlike the (sometimes) prone to vanity metrics related to acquisition, product activation indicates to engage with your product in a way that's beneficial to both themselves, and your business. how many of those interested people vaguely take an action actually "Activation happens when a registered user becomes a qualified lead. At this point, you need to evaluate if the specific circumstances that are necessary for that person are present and, if they are ready to become a customer." — for Theodore Moulos growthrocks.com Examples of activation campaigns and strategies will be unique to the product or service in question, but I really like : Dan McGaw's way of looking at it "The activation event has to be meaningful in terms of the value delivered to the customer. It’s strictly a one-time event. It signifies your business’ effectiveness in " getting customers to realize value from your product or service. How to set Product OKRs Activation As aforementioned, OKRs related to product activation will defer depending on your marketing strategy but for the sake of scalability — let's assume a product-led, freemium offering; designed to draw in a large pool of non-paying but active users before converting a percentage of these into paying customers, using automated (content-led) methods. ( ) sales-led, marketing-led, product-led..? Q1 Activation Objective: Get the right message(s) to the right people — in the right place — at the right time. attract 10,000 new active users key result 1: nurture 10% of new users over to pro/team plan key result 2: Q2 Activation Objective: Build an onboarding experience users love. attract 10,000 new active users key result 1: nurture 10% of new users over to pro/team plan key result 2: 3. 🕸️ Retention Prioritise Retention when your product is in the following phases: Growth Maturity What's the Definition of Retention? Retention might just be marketing's most lasting buzzword but, TBH, I fully agree. What better indicator of the success of your product than proof that people can't stop using it? If retention is lifecycle marketing's golden child, churn is her evil step-sister. You can measure your churn rate as follows: (Lost Customers ÷ Total Customers at the Start of Time Period) x 100. So, for example, if your app had 1,000 active users at the beginning of the month, and 450 of them have unsubscribed or become inactive, your churn rate for this month was 45% (and you might want to take another look at the assumptions you made around your product market fit). Your priority in Retention is to make the churn rate lower than your customer acquisition rate. Otherwise, growth can’t be achieved. The last few years, a big emphasis is put into the Retention channel by many growth marketers, and for a good reason. First, it’s a lot cheaper to retain an existing customer than acquiring a new one. At the beginning of the funnel, you were trying to build awareness through channels such as Facebook ads, Google ads, influencers, content marketing, etc. And, as you know, none of these channels comes for free. By Retention stage, you should have established communication channels in your own properties." — for Theodore Moulos growthrocks.com A few examples of user retention channels and tactics in AARRR or lifecycle marketing are: Newsletters Trigger-based email automation Push notifications In-app messengers and chatbots Gamification Rewards / loyalty programs Customer surveys Product personalization User feedback loops Sending glitter through the physical mail, etc. How to Set Product Retention OKRs Q1 Retention Objective: Retain and reward our most engaged users. overhaul email strategy to decrease unsubscribe rates by 5% key result 1: improve our monthly churn rate by 10% key result 2: Q2 Retention Objective: Build personalized feedback loops for our users. fix all the bugs marked "users are fleeing ‼️ " in the backlog key result 1: send monthly to promote new features key result 2: "have you tried this" emails What I like most about the phrasing of these objectives is that once they’re achieved, they can all be turned into impressive-sounding “have/do/be” statements (that you can back up with hard numbers in your next stakeholder newsletter), like: Phrasing OKRs is a subject that’s seen a lot of attention, but I think how you phrase your objectives is 100% up to you. As long as the phrasing of your Key Results check the boxes of a SMART goal, it’s all gravy IMHO. “We retain and reward our most engaged users, and we’ve built personalized feedback loops we’re using to make the product better for them.” 4. 🐜 Referral Prioritise Referral when your product is in the following phases: Growth What's the Definition of Product Referral? Think about how you came to know all the best products you use. More often than not, you tried it because a real human you know (either personally or on TikTok) told you it was good shit. Us humans are just wired like that, and that's why referrals are the best growth tactic in the game. "To really drive referrals you need to have a systematic process in place that incentivizes and generates them on a consistent basis." — Melanie Balke Marketing activities and tactics that fall under the Referral funnel priority include: One-click social sharing Incentivized referral campaigns (often in email newsletters) Google and app store reviews Online user reviews and testimonial prompts Net Promoter Score (NPS) Podcast reviews Youtube comments Product write-ups and reviews Buying celebrity video endorsements via Cameo and then promoting them on Tiktok, etc. How to Set Product Referral OKRs Q1 Referral Objective: Establish an internal referral culture. spend 20% of marketing budget on rewarding employees for online referrals, reviews, and testimonials key result 1: team to collectively publish 30+ interviews with real users key result 2: Q2 Referral Objective: Build out and automate our official referral program. spend 20% of marketing budget rewarding users for online referrals, reviews, and testimonials key result 1: ncrease our total referral traffic by 25% key result 2: i 5. 🦟  Revenue Prioritise Revenue when your product is in the following phases: Introduction Maturity Marketing activities and tactics that fall under the Referral funnel priority include: Pricing model testing and experimentation (for example “ ”) pay as you grow Automated upselling/cross-selling campaigns Payment automation Abandoned cart emails Content, site, or product monetization strategies What's it Going to Take for Your Startup to Turn Profitable? This the freemium-first world of SaaS, this can be one of the most controversial choices you make. You could limit access to features that were previously free in order to force the upsell... but you risk pissing off a lot of people. You could pump your freemium level product full of ads to educate users about the benefits of paying up... but, ditto. Personally, I really love the circular idea of ideating until you figure out a way of off your product, . helping your users make money somehow someway How to set Product Revenue OKRs Q1 Revenue Objective: Build a flawlessly automated onboarding flow for brands. optimize our funnel to process our first 1,000 automated payments key result 1: respond to first 1,000 messages from customers via our new chatbot key result 2: Q2 Revenue Objective: Implement incentivized cross-/up-selling campaigns. deploy 3 user-requested features to premium tier to encourage levelling up key result 1: signup 1,000 freemium users for a no credit-required free trial month key result 2: 💭 I’d love to hear your feedback on this approach to setting product OKRs. Product Managers, Marketing Directors, CEOs; Why not ? 😉 get your commentary published on HackerNoon See you around , Planet Internet Natasha ✌️💗 ✨ Article Resources OKRs for Startups by tability.io by Emily Bonnie for AARRR vs. RARRA: Which is Better? clevertap.com by Jess Henderson Offline Matters: The Less Digital Guide to Creative Work by Product Lifecycle Marketing: What Matters Most at Every Stage Derek Gleason for cxl.com by Decline Stage of the Product Life Cycle – How to Handle It Kateryna Mayka for eleken.co by for AARRR Framework: 10 Steps to Building a Growth Funnel Theodore Moulos growthrocks.com This “OKRs from a development team’s perspective” thread on HackerNews by Melanie Balke AARRR Framework- Metrics That Let Your StartUp Sound Like A Pirate Ship SaaS Marketing: 30 Examples of What Works by Aaron Brooks for ventureharbour.com

11 OKR Examples for Product Managers Chasing Pirate Metrics

Verifiable credentials, which provide a system for provable electronic facts and documentation through cryptography and public keys, can seem like an abstract concept. We’re so used to seeing our credentials printed out – the driver’s license, the passport, the insurance card – that sticking codified IDs on a thumb drive or online seems odd and unnecessary. And as anyone who has used a cryptocurrency wallet can attest, the early forms of such decentralized IDs are hardly user friendly. Just as cloud computing and big data seemed initially vague, then ubiquitous, so verifiable credentials promise to appear in our daily lives in the not-too-distant future. (My guess is they’ll pop up in your Apple Wallet one day, and then become normal). In fact, several industries are already digging in. Here are some of the most visible and promising use cases. Education As the economy continues to digitize, workers must adopt new skillsets -- and not necessarily as part of a four-year college degree. As coding bootcamps prove, students can attain employable skills within a matter of months. Yet there is no standardized way to validate candidates' skills, outside of a paper degree or certificate. 96% of employers use at least one kind of , according to a Global HR Research survey. At $20-$200 per candidate, the costs quickly add up. It is also an outdated process. The entire point of background checks is to attain trustable, verifiable information about a candidate, something that a verifiable credential could do for cents on the dollar. background screening Verifiable credentials could also host the gamut of employable skills, from cash register experience to cybersecurity coding. Such credentials currently exist only on the resume or LinkedIn profile, and are unverifiable unless an employer calls a reference that the candidate listed. Graduate or transfer schools face the same problem when requesting transcripts. Verifiable credentials would, for the first time, provide a foolproof way to tell if skills or classes taken are real. Just-in-time verifiable credentials take the concept a step further by enabling recipients to monitor credentials over time. A company that hires a college intern, for example, might require a 3.0 GPA over the course of a year-long internship. The school records office could automatically send over the student's GPA every semester for the year. Or a lab could automatically send drug-test results for an employee whose role requires monthly testing. Such verifiable credentials are in the very early stage, and privacy concerns must be addressed. But they are yet another promising use case for the education sphere. 2. Customs and Border Patrol The US has received worth of goods at its borders so far this year. Of that, over $1.3 billion was seized, whether due to counterfeiting, safety violations or other concerns. $2.42 trillion It takes the same amount of time to review all goods, whether safe or dangerous, counterfeit or authentic. US Customs and Border Protection (CBP) is better off applying manpower to shipments that are higher-risk, while letting in low-risk items with minimal effort. This is especially important for agriculture. It can take days to figure out if a shipment of perishable fruit, for example, contains a pathogen, and by then, entire loads could be lost. Verifiable credentials promise to solve such border-related problems by providing a trusted digital catalogue of information for each part of a shipped good. They can be used by supply chains in a stacked way, similar to Russian nesting dolls. Take a metal car door as an example. The first step might be a smelter in Poland. The person in charge of the smelting project obtains a verifiable credential when the load is completed for shipment to Great Britain, where the car doors are stamped. Once complete, the British manufacturer attains a verifiable credential that follows the one in Poland, and the doors are then sent to a BMW plant in Germany for assembly. Once assembled, the German plant adds third verifiable credentials, and then the load is shipped to the US, where the shipping containers get their own credential. CBP can then unstack all the virtual nesting dolls, and determine everything they need to know about parts, tariffs, safety, counterfeits and so on. 3. Transportation-as-a-Service Cars already come with a pile of credentials and certifications: insurance, registration, service history, VIN, title, emissions records and the driver's license. Parking tickets, speeding tickets, fast-lane transponders add another layer of identification. For now, middleman services such as repair shops, car reports and the DMV certify each vehicle's information. Verifiable credentials could put all of a car's information in one place, with the driver sharing selectively, depending on the type of request. Newer types of connected cars could even contain verifiable credentials within the vehicle itself. This becomes especially poignant given that Millennials, the largest generation in the US, and Gen-Z behind them are (specifically, they are buying cars later and driving them longer). Meanwhile, the car sharing market is 24% between 2020-2026. buying fewer cars expected to grow Verifiable credentials promise to play a starring role, not only in providing a record of who's at the wheel and when, but in terms of law and policy. For one, verifiable credentials prove the safety and roadworthiness of a car, by keeping its records accessible in one digital place. If a car is in a traffic violation, verifiable credentials prove who was there at the time. Vehicle ownership is also a big tax revenue item for states. If fewer people own cars, taxes disappear, and roads and infrastructure lose funding. Verifiable credentials, by tracking miles driven, greenhouse gas emissions, and so on, could create new revenue models. 4. Ad monetization Many websites rely on ad networks to monetize. That model is increasingly showing its limits. Revenue-oriented algorithms feed societal divisions by selecting for what the algo thinks will generate the most money. An increasing number of people find targeted data collection invasive, and employ ad blockers and other privacy tools as a result. The model is even expensive for advertisers. Half every ad dollar is taken during a transaction. Social media companies such as Facebook collect click, like, and other psychographic and demographic data to build a profile of likely spending habits. That data is then sold to companies wishing to target you. Despite advances in data collection and targeting technology, results are hit or miss. There is a tendency to see an item advertised that you already purchased, or items that you would never dream of buying. Third-party data is behind this – the educated guess that Facebook et. al. employ when selling data about your online interactions. First-party data, which you provide yourself, directly to advertisers, would fix this problem. Verifiable credentials, by anonymizing and proving your identity, would enable you to sell your data, for a price, directly to advertisers. You’d get a paycheck and advertisers would have first-party targeting data (they would sell you stuff you would actually buy). The middleman would be cut out, and both sides would profit. 5. Homebuying Real estate is rife with potential for verifiable credentials. Realtors, for one, try to target potential buyers and sellers on specific criteria. Selling data directly to them, via the process mentioned above, would enable better targeting, as well as cash in your pocket. Mortgage companies, meanwhile, conduct due diligence on employment and pay records. It is not an employer’s business to know whether an employee is applying for a home loan. Verifiable credentials could prevent employers from knowing. A pay stub could be transformed into a verifiable credential, enabling lenders to validate claims of employment without bothering the boss. Verifiable credentials could also be used during the inspection and appraisal processes, validating who was there and when. They could be used as digital titles. In such a money and trust-intensive transaction, there is an opportunity to transform the entire industry.

5 Promising Use Cases for Verifiable Credentials

Enterprises delivering IoT solutions have unlocked new potentials and are enjoying success with the trend of increasing IoT adoption worldwide. However, while IoT developers and vendors emphasize delivering unparalleled convenience and efficiency, security is often overlooked. And that’s what requires immediate attention. Whether we talk about smart wearables, home assistants, or industrial automation systems, the IoT landscape has broadened the horizons for cybercriminals, making security a top priority for vendors. For the security of this interconnected ecosystem, robust role-based authentication frameworks have become an absolute necessity. Let’s understand how role-based user authentication frameworks reinforce IoT security and why businesses must put their best foot forward to adopt it. What is Authentication and Authorization in IoT? Authentication and authorization are the most crucial components of IoT security. Developers and vendors must prioritize them to ensure sensitive information is always shielded. While authentication verifies the identity of devices, users, and applications attempting to access IoT systems, authorization determines what resources or actions a verified device, application, or user can access within the IoT network. Once the identity is verified, access to network resources is offered based on the user’s role or privileges, preventing unauthorized access to sensitive data. In a nutshell, authentication and authorization lay the foundation for a robust security framework to prevent privacy and data breaches. Though most IoT vendors and developers have incorporated robust mechanisms to safeguard sensitive data, many still rely on conventional legacy systems that aren’t potent enough to shield against modern threat vectors. Here’s where enterprises offering IoT services need to rethink their security strategy by keeping customers at the center of their business strategy. Why is Robust Authentication and Authorization in IoT a Pressing Need? In this digital world, where we’re constantly surrounded by the aura of multiple devices, applications, and networks, secure authentication and authorization have become critical. Talking about the IoT landscape, weak authentication and authorization could lead to severe consequences that compromise users’ privacy and the security of service providers. Here’s the list of consequences that may occur in the presence of inadequate security measures in the IoT ecosystem: Privacy Breach: Weak authentication could lead to unauthorized access to individuals that may breach individual privacy. Most users may face issues about unauthorized surveillance, data breaches, or device hijacking. Data Breach: Businesses may end up losing millions of dollars just because they didn’t incorporate a robust authentication security mechanism into their IoT services. Data loss, including sensitive business details and customer information, could be compromised which may entitle businesses to hefty fines. IoT Botnet Formation: Sometimes weak authentication leads to IoT botnet creation that further leads to coordinated attacks. The botnets are controlled by cybercriminals and can be used for DDoS attacks, which impact the overall system within an organization. Understanding Role-Based User Authentication and its Models Just like a user authenticates himself by proving his/her identity online on a platform to make a purchase or to access his/her account, authentication in IoT works similarly for devices and applications. The entire authentication process involves the identification of devices/apps and authorizing them with permission to access resources or information based on their specific roles. This ensures that devices/apps have access and permissions to do what they need and the non-authorized devices and apps can’t access sensitive information. Depending on the location, device type, and role, organizations can have multiple ways to authenticate and authorize IoT devices and applications for data access Though IoT administrators register each device or application while deploying it on the system, certain devices and applications can be further added, and their roles can be later defined by the user. Let’s have a look at user authentication models to deploy role-based authentication in the IoT ecosystem. 1. One-Way Distributed Authentication One-way distributed authentication represents a connection between two devices. This can be either a smart device, a wearable, or a sensor that tries to connect with the gateway. In this communication, only one device authenticates the other via password hash. In some cases, the authentication is established through a digital certificate. Once a device initiates the authentication request, the other devices authenticate it by comparing the certificate or password with stored information. Once the information matches, the second device authorizes the connection. 2. Two-Way Distributed Authentication In two-way distributed authentication, both devices authenticate each other before sharing any sensitive information or even communicating. This kind of authentication is commonly known as mutual authentication and this protocol is preferred when each of the communicating devices has a unique digital identity that is stored in the system for other devices. The connection in this authentication mode is established only when one of the devices trusts the other device’s identity through a digital certificate and vice versa. This kind of authentication is widely preferred for highly sensitive information transfer, including banking, e-commerce, or other financial transactions. 3. Three-Way Centralized Authentication The three-way centralized authentication approach emphasizes on registering the devices to a central server or authority. This central authority initiates a secure connection between the devices that need to communicate to ensure no unauthorized individual has access to sensitive information. The entire process is managed seamlessly through a dedicated certificate management system. Apart from this, the security certificates aren’t stored on the devices and can’t be compromised. This centralized authentication is best suited for devices that require frequent connection or are always connected. To Conclude With the increasing sophistication of IoT attacks and cybercriminals finding new ways to exploit sensitive business data, relying on conventional security mechanisms isn’t a great option. IoT vendors and developers need to rethink their security posture to ensure they’re on the right track to securing sensitive customer data and their confidential business information. On the other hand, leveraging the true potential of a role-based user authentication framework could be the best way to reinforce authentication security. Enterprises can eventually choose their preferred authentication model based on their business needs and ensure the highest level of protection. Enterprises delivering IoT solutions have unlocked new potentials and are enjoying success with the trend of increasing IoT adoption worldwide. However, while IoT developers and vendors emphasize delivering unparalleled convenience and efficiency, security is often overlooked. And that’s what requires immediate attention. Whether we talk about smart wearables, home assistants, or industrial automation systems, the IoT landscape has broadened the horizons for cybercriminals, making security a top priority for vendors. For the security of this interconnected ecosystem, robust role-based authentication frameworks have become an absolute necessity. Let’s understand how role-based user authentication frameworks reinforce IoT security and why businesses must put their best foot forward to adopt it. What is Authentication and Authorization in IoT? Authentication and authorization are the most crucial components of IoT security. Developers and vendors must prioritize them to ensure sensitive information is always shielded. While authentication verifies the identity of devices, users, and applications attempting to access IoT systems, authorization determines what resources or actions a verified device, application, or user can access within the IoT network. Once the identity is verified, access to network resources is offered based on the user’s role or privileges, preventing unauthorized access to sensitive data. In a nutshell, authentication and authorization lay the foundation for a robust security framework to prevent privacy and data breaches. Though most IoT vendors and developers have incorporated robust mechanisms to safeguard sensitive data, many still rely on conventional legacy systems that aren’t potent enough to shield against modern threat vectors. Here’s where enterprises offering IoT services need to rethink their security strategy by keeping customers at the center of their business strategy. Why is Robust Authentication and Authorization in IoT a Pressing Need? In this digital world, where we’re constantly surrounded by the aura of multiple devices, applications, and networks, secure authentication and authorization have become critical. Talking about the IoT landscape, weak authentication and authorization could lead to severe consequences that compromise users’ privacy and the security of service providers. Here’s the list of consequences that may occur in the presence of inadequate security measures in the IoT ecosystem: Privacy Breach: Weak authentication could lead to unauthorized access to individuals that may breach individual privacy. Most users may face issues about unauthorized surveillance, data breaches, or device hijacking. Data Breach: Businesses may end up losing millions of dollars just because they didn’t incorporate a robust authentication security mechanism into their IoT services. Data loss, including sensitive business details and customer information, could be compromised which may entitle businesses to hefty fines. IoT Botnet Formation: Sometimes weak authentication leads to IoT botnet creation that further leads to coordinated attacks. The botnets are controlled by cybercriminals and can be used for DDoS attacks, which impact the overall system within an organization. Understanding Role-Based User Authentication and its Models Just like a user authenticates himself by proving his/her identity online on a platform to make a purchase or to access his/her account, authentication in IoT works similarly for devices and applications. The entire authentication process involves the identification of devices/apps and authorizing them with permission to access resources or information based on their specific roles. This ensures that devices/apps have access and permissions to do what they need and the non-authorized devices and apps can’t access sensitive information. Depending on the location, device type, and role, organizations can have multiple ways to authenticate and authorize IoT devices and applications for data access Though IoT administrators register each device or application while deploying it on the system, certain devices and applications can be further added, and their roles can be later defined by the user. Let’s have a look at user authentication models to deploy role-based authentication in the IoT ecosystem. 1. One-Way Distributed Authentication One-way distributed authentication represents a connection between two devices. This can be either a smart device, a wearable, or a sensor that tries to connect with the gateway. In this communication, only one device authenticates the other via password hash. In some cases, the authentication is established through a digital certificate. Once a device initiates the authentication request, the other devices authenticate it by comparing the certificate or password with stored information. Once the information matches, the second device authorizes the connection. 2. Two-Way Distributed Authentication In two-way distributed authentication, both devices authenticate each other before sharing any sensitive information or even communicating. This kind of authentication is commonly known as mutual authentication and this protocol is preferred when each of the communicating devices has a unique digital identity that is stored in the system for other devices. The connection in this authentication mode is established only when one of the devices trusts the other device’s identity through a digital certificate and vice versa. This kind of authentication is widely preferred for highly sensitive information transfer, including banking, e-commerce, or other financial transactions. 3. Three-Way Centralized Authentication The three-way centralized authentication approach emphasizes on registering the devices to a central server or authority. This central authority initiates a secure connection between the devices that need to communicate to ensure no unauthorized individual has access to sensitive information. The entire process is managed seamlessly through a dedicated certificate management system. Apart from this, the security certificates aren’t stored on the devices and can’t be compromised. This centralized authentication is best suited for devices that require frequent connection or are always connected. To Conclude With the increasing sophistication of IoT attacks and cybercriminals finding new ways to exploit sensitive business data, relying on conventional security mechanisms isn’t a great option. IoT vendors and developers need to rethink their security posture to ensure they’re on the right track to securing sensitive customer data and their confidential business information. On the other hand, leveraging the true potential of a role-based user authentication framework could be the best way to reinforce authentication security. Enterprises can eventually choose their preferred authentication model based on their business needs and ensure the highest level of protection.

Strengthening IoT Security through Role-Based User Authentication Frameworks

In this article, we are going to talk about a system for performing authentication and authorization securely. To start off with lets understand, what is the difference between Authentication and Authorization. is the process of proving, you are, who you say you are, when accessing an application. Authentication is the process of defining and enforcing access policies - that is, what you can do once you’re authenticated. Authorization In this article, we will see: Why Authentication and Authorization matter How Authentication works How Authorization works Authentication System Design Conclusion Why Authentication and Authorization matter? Lets say we are in a meeting, and you are the leading the conversation. To ask for updates/status for something to the right  person, you need to identify (ie ) the person. Even to share some sensitive data with a person, you need to  authenticate the person correctly. And that is where authentication  comes in. Authenticate Now say, in the same meeting, a few decisions needs to be made. So for that, people who have the right for taking those decisions should be  the one taking the call, we cant just allow everyone to do everything.  Obviously some people are not catered enough to make some decisions, and  some for sure will try to make the worst out of it. So that brings , that gives certain people the rights permissions for certain activities. Authorization How Authentication works? To authenticate a person, we can assign a unique phrase to each person, and given the person tells the phrase correctly and their name.  We can say that ok, we have identified the person. This is the usual  usernames and passwords approach. When the right credentials are given, a  system considers the identity valid and grants access. This is known as  1FA or (SFA). Single-factor authentication SFA is considered fairly insecure. Why? Because users are notoriously bad at keeping their login information secure. Multi-factor  authentication (MFA) is a more secure alternative that requires users to  prove their identity in more than one way. Some such ways are: Single-use PIN numbers / OTP Authentication apps run by secure 3rd party (ex. Google/Microsoft Authenticator) Biometrics Once authenticated, the person would keep performing actions freely on the application. And the application is expected to have the person  recognized throughout their journey without forgetting them. Ideally, it  would be too much to ask the user to provide the password everytime  they move to a different page, or they do some activity. So we need a  way to keep the user authenticated after they have entered their  credentials and they have been authenticated once. This is called . Session Management 2 ways to keep the user authenticated: : When a user logins to a website on a browser, the server creates a session for that user and assigns a sessionid. This sessionid is stored by the server for reference and is sent back to the user to be stored in a cookie in the browser. Now each time the user would make a request the browser will send the sessionid along with the request. Which will help in authenticating the request. And, thus, preserving authentication while the user is on the site. Session-based authentication : For this, the server creates a encrypted token which is sent to the user and is saved by the browser only, as HttpOnly Cookies. All required information such as the user information, permissions and expiry of the token are encrypted within the token. The token is sent along for calls to the server. The server simply decrypts the token with the secret key and verifies the user. This token is refreshed at intervals. Token-based authentication The main differences between these two approaches would be that token-based authn is , cause the token neednot be stored on the server side. But for  session-based authentication, the token are needed to be stored on the  server side as well, which makes it . Which brings up complications, when the system is scaled or the number of users grows. Stateless Stateful For token-based authentication, we mostly use JWTs (JSON Web Tokens). How Authorization works? Once the user is authenticated, we would still need to ensure they’re only allowed to access resources that they have permissions to access.  Unauthorized access to sensitive data can be a disaster. By the  principle of least priviledge, companies would usually set up access  policies such that by default you have access to what is required for  you absolutely. And then in progression to that you have additional  access. Common ways to segment access are: : Users are assigned to a certain group/role that comes with set permissions. Examples: admin, member, owner. Role-based Access Control (RBAC) : Dynamically determines access privileges during authorization based on policies and rules. Policies are based on user roles, job functions, and organizational requirements. Policy-based Access Control (PBAC) : Users are permitted access according to attributes like title, certification, training, and/or environmental factors like location. Attribute-based Access Control (ABAC) : Each user or entity has individual permissions that can be turned on or off, similar to installing a new app on your phone and deciding which permissions to grant (location services, contacts, etc.) Access Control Lists (ACLs) ACL is frequently used at granular level than either ABAC or RBAC - for example, to grant individual users access to a certain file. ABAC and RBAC are generally instituted as company-wide policies. Authentication System Design Requirements Lets first start with defining the of the system: Functional requirements : Allow users to register by providing necessary information. Registration : Authenticate users based on their credentials. Login : Efficiently manage user sessions to ensure security. Session Management : Provide a secure process for users to recover their passwords. Password Recovery : Define roles and permissions for different user types. Access Control : Maintain detailed logs of authentication events for auditing. Audit Trail : Ensure low latency and quick response times. Performance A few that we are not going to consider for the scope of this article are: Non-functional requirements : Implement a robust MFA system. Multi-Factor Authentication (MFA) : Prioritize data security through encryption, secure storage, and secure communication. Security : Design the system to handle a growing number of users and transactions. Scalability : Minimize system downtime and ensure high availability. Reliability : Develop an intuitive user interface for a seamless experience. Usability Capacity Estimation Traffic Estimation First lets start with . Assuming an average traffic of 100,000 per month.We are estimating a 100k user traffic per month. Which translates to 0.04 request per second. We would need to respond to each request within  500ms 90% of the time, ie we require a p90 latency of 500ms. Traffic Estimation assumed_traffic_per_month = 100000 #requests
assumed_traffic_per_day = assumed_traffic_per_month / 30
                        ~= 3350 (assuming on higher end; 3333.33 to be precise)
estimated_time_per_request = 500 #ms; P90 of 500ms
traffic_per_second = (assumed_traffic_per_month) / (30*24*60*60) 
                   = 0.04 :  500ms (maximal acceptable latency, immaterial of the load on the system) The average capacity 1 instance can take, based on our calculations  is approximately 35ms to serve a request, assuming there are no heavy  processing happening for the particular request. Service Level Objective (SLO) Lets generate two more using the above metrics. derived metrics : Acceptable backlog per instance : Maximum number of requests(load) that can be accepted by an instance, without compromising SLO. Capacity : Backlog per instance : Total number of requests (load) that flows into a unit/instance based on current traffic. Demand Thus, SLO = 500ms
approx_response_time_for_one_request = 35 #ms
capacity = SLO/approx_response_time_for_one_request
         = 500 / 35
         ~= 20

load_on_one_instance = 0.04
instances_available = 1
demand = traffic_per_second / instances_available
       = 0.04 With the demand and capacity available, lets calculate total number of instances required. total_units_required = demand / capacity
                     = 0.04 / 20
                     = 0.002
                     ~= 1 Thus, we would be easily be able to handle 100k requests per month,  with 0.04 requestsper second, with 1 instance. Where each unit can  handle 20 requests per second without compromising SLO. Storage Estimation We would ideally need to store the user details for each user for authentication and authorization access.  Assuming, 5kb /user monthly_new_users = 500
monthly_additional_storage = 500 * 5kb
                           = 2500kb 
                           ~= 2GB So every month, assuming we will onboard 500 new users, we will require 2GB more storage. Incase we would like to keep authentication logs. Each authentication request is expected to take 2kb to store. auth_request_size = 2kb #assumption
monthly_storage = monthly_visitors * auth_request_size
                = 100,000 * 2KB
                ~= 200MB Thus, each month we would require an additional of 200MB, assuming a monthly traffic of 100k. Database Design Now that we have the capacity estimation done. Lets create the schemas of the database required to support the functional requirements. Lets quickly go over the tables. We are using 6 tables. Users - To store all the user information Credentials - To store the access/refresh credentials once the user has been authorized. Passwords - To store the user encrypted user passwords. PasswordRequests - To store the password change requests that comes for a particular user. Sessions - To store when the user had an active session and when was their last activity. ActivityApproval - To store approval requests for a activity performed by a particular user, that would be verified by admin. High-Level Design for the Authentication System System Endpoints Endpoint Description /login Authenticate user credentials. /logout End user session and revoke authentication tokens. /register Create a new user. /update/:userId Update user information. /delete/:userId Delete a user account. /grant/:userId/:permission Grant specific permissions to a user. /revoke/:userId/:permission Revoke permissions from a user. /check/:userId/:resource Check user’s access to a specific resource. /create/:userId Create a new user session. /expire/:sessionId Expire a user session. /validate/:sessionId Validate an active user session. Requirements Fulfilment Now, with all the things in place lets see how we can complete all the requirements. Registration - When a new user visits our application. We need to store user details so we can authorize/identify  the user next time they visit. Requirement - When a new user visits the application, and enters user details along with their email and password. That will  get captured in the database. The user details will be stored in the  User table. And the password will be stored in the credentials table in  an encrypted form. Fulfilled Login - When an existing user visits our application. We need to identify the user so we can authorize/identify  their actions and show them data that belongs to them. Requirement - When an existing user visits the application, and enters their details, email and password. We hash the  password and match the hash against the hash stored for the user in the  Credentials Table. If it matches then we have been able to identify the  user successfully. Else they need to enter the correct password that  they entered while registering. This process is called . Fulfilled Authentication Session Management - When a user has authenticated themselves, by entering their user and password. We need to make sure  that they stay logged in as they perform their future actions / try to  see sensitive data, without having them re-entering their password again  and again. Requirement - When the user authenticates successfully. The Authentication server will share 2 tokens with the client. A and a . The access_token can have encrypted data with it and it has a short  expiry time cause of security reasons. Once the client has the  access_token, it sends the access_token back along with every request  which helps in authenticating the request. When the access_token  expires, the client has to ask for a new access_token using the  refresh_token provided. This helps in maintaining a session. Fulfilled access_token refresh_token Password Recovery - When a user forgets their password, they would need to be able to reset their password securely. Requirement - When the user forgets their password, they can submit their email address in the forgot password page, and we  will generate a one time code and send the link to their email. When the  user clicks on this link with the code and email address. We will  securely be able to identify that the password recovery request is  authentic. And provide the user to set their new password. And thus  being able to recover the password. Fulfilled Access Control - When a user performs a certain action, we need to make sure that the user is authenticated to perform that  action and only then allow the action to happen. Requirement - We will maintain a list of actions, lets say 1-12, for simplicity. For each user we will maintain the  authenticated actions for that user. So now lets say the user tries to  perform an action #id 4. We will check if the user has the permissions  to perform action 4. If yes, we will go ahead and complete the request.  Else we show that the request isnt successful cause of lack of  permissions. Fulfilled Audit Trail - Incase of a security incident, we should be able to have enough logs to look through and have a plausible  reason as to what might have happened / or any leads as to what might  have been a possible cause of it. Requirement - For such scenarios, we can keep logs for every authentication action that happens on the server. (a). For each login request, we will keep a log as to  when the authentication happened, from where, ips and other relevant  details. (b). For each password recovery request, we will keep a  log as to when it was initiated, from where, ips, whether the request  was complete and other relevant details.        (c). Additionally, we will keep logs around each time a  user is authorized / unauthorized for an action and by who. These logs in all, should be able to indicate what might  have happened incase trying to understand some scenario. Fulfilled Performance - Requirement for performance as discussed in capacity estimation section, is 0.04 requests/second and 100k requests per month. Requirement - We have already handled the requirement with enough servers in the capacity estimation section. Fulfilled Conclusion In this article, we started by understanding what is the difference between Authentication and Authorization. Next, we created a Authentication and Authorization System. That is safe, secure, delivers performance while catering to industry standards and meeting all the desired requirements. Going forward i might update certain parts of the article to make it stay relevant as well as to cover more information and insights in building such a system.

Designing Functional Authentication and Authorization Systems

কার্যকরী প্রমাণীকরণ এবং অনুমোদন সিস্টেম ডিজাইন করা

Entwurf funktionaler Authentifizierungs- und Autorisierungssysteme

Diseño de sistemas funcionales de autenticación y autorización

Conception de systèmes d'authentification et d'autorisation fonctionnels

कार्यात्मक प्रमाणीकरण और प्राधिकरण प्रणालियों का डिजाइन

機能的な認証および認可システムの設計

기능적 인증 및 권한 부여 시스템 설계

Projetando sistemas funcionais de autenticação e autorização

Проектирование функциональных систем аутентификации и авторизации

İşlevsel Kimlik Doğrulama ve Yetkilendirme Sistemlerinin Tasarlanması

Thiết kế hệ thống xác thực và ủy quyền chức năng

设计功能性身份验证和授权系统

UUID for authentication There is hardly a person nowadays who never clicked that "Recover password" button in deep frustration. Even if it does seem the password was without a doubt correct, the next step of recovering it mostly goes smoothly with visiting a link from an email and entering the new password (let's not fool anyone; it is hardly new as you have just typed it three times already in step 1 before pressing the obnoxious button). The logic behind email links, however, is something to take great scrutiny about as leaving its generation insecure opens a flood of vulnerabilities regarding unauthorized access to user accounts. Unfortunately, here is one example of a UUID-based recovery URL structure many probably encountered, which does not nevertheless follow security guidelines: https://.../recover/d17ff6da-f5bf-11ee-9ce2-35a784c01695 If such a link is used, it generally means that anyone can get your password, and it is as simple as that. This article aims to dive deep into UUID generation methods and select insecure approaches to their application. What is UUID UUID is a 128-bit label commonly used in generating pseudo-random identifiers with two valuable attributes: it is complex enough and unique enough. Mostly, those are key requirements for ID leaving the backend and being shown to the user explicitly in the frontend or generally sent over API with the ability to be observed. It makes one hard to guess or brute-force in comparison to id = 123 (complexity) and prevents collisions when the generated id is duplicated to previously used, e.g., a random number from 0 to 1000 (uniqueness). The "enough" parts actually come from, firstly, some versions of Universally Unique IDentifier, leaving it open for minor possibilities for duplications, which is, however, easily mitigated by additional comparison logic and does not pose a threat due to hardly controlled conditions for its occurrence. And secondly, the take on complexity of various UUID versions is described in the article, in general it is assumed to be quite good except for further corner cases. Implementations in backend Primary keys in database tables appear to rely on the same principles of being complex and unique as UUID does. With the wide adoption of built-in methods for its generation in many programming languages and database management systems, UUID often comes as the first choice to identify data entries stored and as a field to join tables in general and subtables split by normalization. Sending user IDs that come from a database over API in response to certain actions is also common practice for making a process of unifying data flows simpler without extra temporary ID generation and linking them to ones in production data storage. In terms of password reset examples, the architecture more likely includes a table responsible for such an operation that inserts rows of data with generated UUID every time a user clicks the button. It initiates the recovery process by sending an email to the address associated with the user by their user_id and checking which user to reset the password for based on the identifier they have once the reset link is opened. There are, however, security guidelines for such identifiers visible to users, and certain implementations of UUID meet them with varying degrees of success. Outdated versions Version 1 of UUID generation splits its 128 bits into using a 48-bit MAC address of the device generating identifier, a 60-bit timestamp, 14-bit stored for incrementing value, and 6 for versioning. Uniqueness guarantee is thus transferred from rules in code logic to hardware manufacturers who are supposed to assign values for every new machine in production correctly. Leaving only 60+14 bits to represent useful changeable payload deteriorates the integrity of the identifier, especially with such transparent logic behind it. Let's take a look at a sequence of consequently generated number of UUID v1: from uuid import uuid1

for _ in range(8):

    print(uuid1()) d17ff6da-f5bf-11ee-9ce2-35a784c01695
d17ff6db-f5bf-11ee-9ce2-35a784c01695
d17ff6dc-f5bf-11ee-9ce2-35a784c01695
d17ff6dd-f5bf-11ee-9ce2-35a784c01695
d17ff6de-f5bf-11ee-9ce2-35a784c01695
d17ff6df-f5bf-11ee-9ce2-35a784c01695
d17ff6e0-f5bf-11ee-9ce2-35a784c01695
d17ff6e1-f5bf-11ee-9ce2-35a784c01695 As can be seen, the "-f5bf-11ee-9ce2-35a784c01695" part stays the same all the time. The changeable part is simply a 16-bit hexadecimal representation of sequence 3514824410 - 3514824417. It is a superficial example as production values are usually generated with more significant gaps in time in between, so the timestamp-related part is also changed. 60-bit timestamp part also means that a more significant part of the identifier is visually changed over a larger sample of IDs. The core point stays the same: UUIDv1 is easily guessed, however random-looking it initially appears. Take just the first and last values from the given list of 8 ids. As identifiers are generated strictly, consequently, it is clear there are only 6 IDs generated between the given two (by subtracting hexadecimal changeable parts), and their values can also be definitively found. Extrapolation of such logic is the underlying part behind the so-called Sandwich attack aiming to brute-force UUID from knowing these two border values. Attack flow is straightforward: the user generates UUID A before the target UUID generation occurs and UUID B right after. Assuming the same device with a static 48-bit MAC part is responsible for all three generations, it sets a user with a sequence of potential IDs between A and B, where the target UUID is located. Depending on the time proximity between generated IDs to target, the range can be in volumes accessible to brute-force approach: check every possible UUID to find existing ones among empty. In API requests with the password recovery endpoint described previously, it translates to sending hundreds or thousands of requests with consequent UUIDs until a response stating the existing URL is found. With password reset, it leads to a setup where the user can generate recovery links on two accounts they control as closely as possible to press the recovery button on the target account they have no access to but only knows email/login. Letters to controlled accounts with recovery UUIDs A and B are then known, and the target link to recover the password for the target account can be brute-forced without having access to the actual reset email. Vulnerability originates from the concept of relying solely on UUIDv1 for user authentication. By sending a recovery link that grants access to resetting passwords, it is thus assumed that by following the link, a user is authenticated as the one who was supposed to receive the link. This is the part where the authentication rule fails due to UUIDv1 being exposed to straightforward brute force in the same way as if someone`s door could be opened by knowing what the keys of both their neighbor doors look like. Cryptographically insecure functions The first version of UUID is mainly considered legacy partly because generation logic only uses a smaller portion of identifier size as a randomized value. Other versions, like v4, try to solve this issue by keeping as little space as possible for versioning and leaving up to 122 bits to be random payload. In general, it brings total possible variations to a whooping , which for now is considered to satisfy the "enough" part regarding identifier uniqueness requirement and thus fulfill security standards. Opening for brute-force vulnerability might appear if generation implementation somehow significantly diminishes the bits left for the random part. But with no production tools or libraries, should that be the case? 2^122 Let's indulge in cryptography a bit and take a close look at JavaScript's common implementation of UUID generation. Here is function relying on module for pseudo-random number generation: randomUUID() math.random Math.floor(Math.random()*0x10); And the random function itself, for short it is just the part of interest for the topic in this article: hi = 36969 * (hi & 0xFFFF) + (hi >> 16);

lo = 18273 * (lo & 0xFFFF) + (lo >> 16);

return ((hi << 16) + (lo & 0xFFFF)) / Math.pow(2, 32); Pseudo-random generation requires seed value as a base to perform mathematical operations on top of it to produce sequences of random enough numbers. Such functions are solely based on it, meaning that if they are reinitialized with the same seed as before, the output sequence is going to match. The seed value in the JavaScript function in question comprises variables hi and lo, each a 32-bit unsigned integer (0 through 4294967295 decimal). A combination of both is needed for cryptographic purposes, making it close to impossible to definitively reverse the two initial values by knowing their multiple, as it relies on the complexity of integer factorization with large numbers. Two 32-bit integers together bring possible cases for guessing hi and lo variables behind the initialized function producing UUIDs. If hi and lo values are somehow known, it takes no effort to duplicate the generation function and know all the values it produces and will produce in the future due to seed value exposure. However, 64 bits in security standards can be considered intolerant to brute-force in a measurable time period for it to make sense. As always, the issue comes from specific implementation. takes various 16 bits from each of hi and lo into 32-bit results; however, on top of it shifts the value once again due to operation, and the only meaningful part all of a sudden now comes exclusively from hi. It does not affect generation in any way but causes cryptography approaches to fall apart as it only leaves possible combinations for the entire generation function seed (there is no need to brute-force both hi and lo as lo can be set to any value and does not influence the output). 2^64 Math.random() randomUUID() .floor() 2^32 Brute-force flow consists of acquiring a single ID and testing possible high values that could have generated it. With some optimization and average laptop hardware, it can take just a couple of minutes and does not require sending lots of requests to the server as in the Sandwich attack but rather performs all operations offline. The result of such an approach causes replication of the generation function state used in the backend to get all created and future reset links in the password recovery example. Steps to prevent vulnerability from emerging are straightforward and shout out for the use of cryptographically secure functions, e.g. . crypto.randomUUID() Takeaways UUID is a great concept and makes the lives of data engineers a lot easier in many application areas. However, it should never be used in relation to authentication, as in this article, flaws in certain cases of its generation techniques are brought to light. It obviously does not translate to the idea of all UUIDs being insecure. The basic approach, though, is to persuade people not to use them for security at all, which is more efficient and, well, secure than setting complex limits in documentation on which to use or how not to generate them for such purpose.

Never Rely on UUID for Authentication: Generation Vulnerabilities and Best Practices

প্রমাণীকরণের জন্য কখনই UUID-এর উপর নির্ভর করবেন না: প্রজন্মের দুর্বলতা এবং সর্বোত্তম অনুশীলন

Verlassen Sie sich bei der Authentifizierung niemals auf UUID: Generierungsschwachstellen und Best Practices

Nunca confíe en UUID para la autenticación: vulnerabilidades de generación y mejores prácticas

Ne vous fiez jamais à l'UUID pour l'authentification : vulnérabilités de génération et meilleures pratiques

प्रमाणीकरण के लिए कभी भी UUID पर निर्भर न रहें: उत्पन्न होने वाली कमज़ोरियाँ और सर्वोत्तम अभ्यास

認証に UUID を決して使用しないでください: 生成の脆弱性とベスト プラクティス

인증을 위해 UUID에 의존하지 마십시오: 생성 취약점 및 모범 사례

Nunca confie no UUID para autenticação: vulnerabilidades de geração e práticas recomendadas

Никогда не полагайтесь на UUID для аутентификации: уязвимости поколений и лучшие практики

Kimlik Doğrulama için Asla UUID'ye Güvenmeyin: Güvenlik Açıkları Oluşturma ve En İyi Uygulamalar

Không bao giờ dựa vào UUID để xác thực: Các lỗ hổng thế hệ và các phương pháp hay nhất

永远不要依赖 UUID 进行身份验证：生成漏洞和最佳实践

How To Implement API Key Authentication Middleware in ASP NET Core

The Noonification: UX Considerations for Better Multi-Factor Authentication (4/12/2024)

Keeping online identities and sensitive data safe is always critical. Cyberthreats are constantly growing more sophisticated, so defenses must grow with them. Part of keeping users’ information secure is through multifactor authentication (MFA). This tool adds layers of protection beyond the traditional password. Although MFA can enhance security, developers should also implement it to improve the user experience. Maintaining both assets empowers users, ensuring a wider adoption of MFA while bolstering their overall security. What Is Multifactor Authentication? MFA is a security system that requires users to provide more than one form of verification to prove their identity. It acts as a multilayered shield protecting accounts and information. Instead of simply asking for a password, MFA adds one or two more questions to the mix. It may request a code sent to someone’s phone or a fingerprint or facial recognition. Combining different pieces of evidence ensures it’s the actual user trying to access their account and not someone else. Is this extra work worth it? According to security experts, the answer is yes. Research suggests that MFA can stop about 80%-90% of cyberattacks, which rely on stealing or guessing simple passwords. A hacker can get a password, but they still need the other pieces of the puzzle to break into an account. MFAs deter cyberattackers from hacking users by adding more hurdles, making unauthorized access more challenging. They add more protections to ensure online accounts remain secure. The Importance of Good UX Security measures are crucial for protecting online activities. However, the success of those safety protocols depends on the user experience. UX is a concept that impacts how people interact with technology. Don Norman — the godfather of UX — introduced this term in 1993 and stressed the importance of designing functional and user-friendly technology. Good UX is about making tech as intuitive as engaging in everyday activities. When devices and platforms feel effortless, users are more likely to integrate them into their daily lives. Products designed with UX in mind should enable people to interact with them seamlessly without interruption. Simultaneously, UX should balance protective security measures well without imposing unnecessary barriers. Therefore, MFA should feel effortless and ensure users feel safe and secure in a digital environment. Enable Copy-Paste for Passwords Making account access convenient is crucial for the overall user experience. One feature that enhances this process is copying and pasting passwords. While turning off copy-paste functionality may seem intuitive to avoid cyberattacks, it keeps users from adopting secure login management practices. Around 30% of people worldwide rely on password managers to secure their login information. These digital vaults allow users to store passwords encrypted by a master password. These tools can generate and store complex identifiers for every account, significantly boosting security. Enabling copy and paste allows individuals to leverage their password manager without memorizing or manually entering them. Implement Adaptive Authentication Methods Adaptive or risk-based authentication can achieve a seamless yet secure user experience. This process evaluates the risk level or a login attempt in real-time. It considers various factors, such as someone’s location, device, network, time of access, and behavior patterns. Based on its assessment, it decides whether to allow or deny access or request additional verification. Using adaptive authentication is helpful to users because it offers swift and hassle-free access. However, when the system detects unusual behavior, it automatically introduces additional authentication steps. This security measure operates on the principle that security should be as stringent as necessary but as unobtrusive as possible. It respects people’s time and effort, making safety measures supportive rather than disruptive. Create Fallback Options A good digital security strategy recognizes that even the best plans can encounter unexpected challenges. This is especially true for MFA, where the primary verification method could be unavailable. Implementing fallback options is a critical UX consideration to ensure continuous access while maintaining safety. Fallback options are alternative methods for verifying a user’s identity when the primary function is unavailable. For example, if someone typically receives a verification code via SMS but doesn’t have cell service, a fallback option could be to send it via email. These other methods are essential for avoiding lockouts and ensuring people always have access to their accounts. When designing fallback options, each method should be secure enough to prevent unauthorized access but not so cumbersome that it frustrates the user. Fallback options can include backup codes, other communication channels, and security questions. Streamline the Authentication Flow How can developers seamlessly integrate MFA into the user’s journey? Keep the primary objective in mind, which is to minimize friction while maintaining high-end security. A smooth authentication process involves simplifying input. Reduce the amount of information people need to provide by leveraging data already available. This will keep MFA straightforward and encourage users to adopt this protection method. Another approach is to implement single sign-on (SSO). Using this in MFA reduces the need for multiple logins. Once users have verified their identity, they can access their applications without having to authenticate again. The fewer steps provided, the easier it is for someone to maintain strong safety. However, it is important to realize that while streamlining is desirable, maintaining security is crucial. Simplifying the authentication process without making it too easy for intruders can be challenging. That is why continuously refining the flow is vital to ensure it meets users’ needs and security protocols. Regularly Test and Update Cybersecurity threats are constantly evolving. Regular testing and updating are necessary to ensure MFA systems remain effective while providing a positive user experience. This helps identify potential vulnerabilities and improve functionality even when new security issues emerge. Testing involves simulating various scenarios to ensure MFA is working as intended. This includes checking for usability with actual users to ensure the system is accessible. It also helps identify areas where designers can enhance people’s experience by reducing time or streamlining actionable steps. Simplifying MFA Without Sacrificing Security Quality While multifactor authentication can enhance digital security, its success relies on a user-centric approach. Developers should follow the latest design principles and user feedback so more people can use the safest system. Utilizing both approaches will help individuals feel confident while encouraging them to keep their MFA settings on. Keeping online identities and sensitive data safe is always critical. Cyberthreats are constantly growing more sophisticated, so defenses must grow with them. Part of keeping users’ information secure is through multifactor authentication (MFA). This tool adds layers of protection beyond the traditional password. Although MFA can enhance security , developers should also implement it to improve the user experience. Maintaining both assets empowers users, ensuring a wider adoption of MFA while bolstering their overall security. security What Is Multifactor Authentication? MFA is a security system that requires users to provide more than one form of verification to prove their identity. It acts as a multilayered shield protecting accounts and information. users to provide more than one form of verification users to provide more than one form of verification Instead of simply asking for a password, MFA adds one or two more questions to the mix. It may request a code sent to someone’s phone or a fingerprint or facial recognition. Combining different pieces of evidence ensures it’s the actual user trying to access their account and not someone else. Is this extra work worth it? According to security experts, the answer is yes. Research suggests that MFA can stop about 80%-90% of cyberattacks , which rely on stealing or guessing simple passwords. A hacker can get a password, but they still need the other pieces of the puzzle to break into an account. about 80%-90% of cyberattacks about 80%-90% of cyberattacks MFAs deter cyberattackers from hacking users by adding more hurdles, making unauthorized access more challenging. They add more protections to ensure online accounts remain secure. The Importance of Good UX Security measures are crucial for protecting online activities. However, the success of those safety protocols depends on the user experience. UX is a concept that impacts how people interact with technology. Don Norman — the godfather of UX — introduced this term in 1993 and stressed the importance of designing functional and user-friendly technology. introduced this term in 1993 introduced this term in 1993 Good UX is about making tech as intuitive as engaging in everyday activities. When devices and platforms feel effortless, users are more likely to integrate them into their daily lives. Products designed with UX in mind should enable people to interact with them seamlessly without interruption. Simultaneously, UX should balance protective security measures well without imposing unnecessary barriers. Therefore, MFA should feel effortless and ensure users feel safe and secure in a digital environment. Enable Copy-Paste for Passwords Making account access convenient is crucial for the overall user experience. One feature that enhances this process is copying and pasting passwords. While turning off copy-paste functionality may seem intuitive to avoid cyberattacks, it keeps users from adopting secure login management practices. Around 30% of people worldwide rely on password managers to secure their login information. These digital vaults allow users to store passwords encrypted by a master password. These tools can generate and store complex identifiers for every account, significantly boosting security. Enabling copy and paste allows individuals to leverage their password manager without memorizing or manually entering them. 30% of people worldwide 30% of people worldwide Implement Adaptive Authentication Methods Adaptive or risk-based authentication can achieve a seamless yet secure user experience. This process evaluates the risk level or a login attempt in real-time. It considers various factors, such as someone’s location, device, network, time of access, and behavior patterns. Based on its assessment, it decides whether to allow or deny access or request additional verification. Using adaptive authentication is helpful to users because it offers swift and hassle-free access. However, when the system detects unusual behavior, it automatically introduces additional authentication steps. This security measure operates on the principle that security should be as stringent as necessary but as unobtrusive as possible. It respects people’s time and effort, making safety measures supportive rather than disruptive. Create Fallback Options A good digital security strategy recognizes that even the best plans can encounter unexpected challenges. This is especially true for MFA, where the primary verification method could be unavailable. Implementing fallback options is a critical UX consideration to ensure continuous access while maintaining safety. Fallback options are alternative methods for verifying a user’s identity when the primary function is unavailable. For example, if someone typically receives a verification code via SMS but doesn’t have cell service, a fallback option could be to send it via email. These other methods are essential for avoiding lockouts and ensuring people always have access to their accounts. When designing fallback options, each method should be secure enough to prevent unauthorized access but not so cumbersome that it frustrates the user. Fallback options can include backup codes, other communication channels, and security questions. Streamline the Authentication Flow How can developers seamlessly integrate MFA into the user’s journey? Keep the primary objective in mind, which is to minimize friction while maintaining high-end security. A smooth authentication process involves simplifying input. Reduce the amount of information people need to provide by leveraging data already available. This will keep MFA straightforward and encourage users to adopt this protection method. Another approach is to implement single sign-on (SSO). Using this in MFA reduces the need for multiple logins. Once users have verified their identity, they can access their applications without having to authenticate again. The fewer steps provided, the easier it is for someone to maintain strong safety. without having to authenticate without having to authenticate However, it is important to realize that while streamlining is desirable, maintaining security is crucial. Simplifying the authentication process without making it too easy for intruders can be challenging. That is why continuously refining the flow is vital to ensure it meets users’ needs and security protocols. Regularly Test and Update Cybersecurity threats are constantly evolving. Regular testing and updating are necessary to ensure MFA systems remain effective while providing a positive user experience. This helps identify potential vulnerabilities and improve functionality even when new security issues emerge. Testing involves simulating various scenarios to ensure MFA is working as intended. This includes checking for usability with actual users to ensure the system is accessible. It also helps identify areas where designers can enhance people’s experience by reducing time or streamlining actionable steps. checking for usability with actual users checking for usability with actual users Simplifying MFA Without Sacrificing Security Quality While multifactor authentication can enhance digital security, its success relies on a user-centric approach. Developers should follow the latest design principles and user feedback so more people can use the safest system. Utilizing both approaches will help individuals feel confident while encouraging them to keep their MFA settings on.

UX Considerations for Better Multi-Factor Authentication

উন্নত মাল্টি-ফ্যাক্টর প্রমাণীকরণের জন্য UX বিবেচনা

UX-Überlegungen für eine bessere Multi-Faktor-Authentifizierung

Consideraciones de UX para una mejor autenticación multifactor

Considérations UX pour une meilleure authentification multifacteur

बेहतर मल्टी-फैक्टर प्रमाणीकरण के लिए UX विचार

より良い多要素認証のためのUXの考慮事項

더 나은 다단계 인증을 위한 UX 고려 사항

Considerações de UX para melhor autenticação multifator

Daha İyi Çok Faktörlü Kimlik Doğrulama için Kullanıcı Deneyimi Konuları

Những cân nhắc về trải nghiệm người dùng để xác thực đa yếu tố tốt hơn

更好的多因素身份验证的用户体验注意事项

**PORTLAND, Oregon, April 4th, 2024/CyberNewsWire/--**Center Identity, a pioneering cybersecurity company, is excited to unveil its patented secret location authentication, reshaping how businesses manage workforce digital identity. This proprietary technology enables users to authenticate their identity using a secret location selected on a map. The benefits of this novel approach to digital identity management include: ● Simplicity: There is no need to remember a long list of complicated passwords or seed phrases. ● Security: Secret locations are less likely to be shared and far less susceptible to brute force hacking. ● Recovery: The use of Artificial Intelligence ensures that hints for selected secret locations meet robust cybersecurity standards, offering users an easy recovery mechanism. Compared with other passwordless authentication solutions which require the user to possess one or more hardware devices, secret locations are a cost effective solution which do not require purchasing devices for your entire workforce. Center Identity is also launching the integration of secret location authentication with OpenID Connect, a widely adopted open standard, making integration a straightforward process. "Traditional password management and account recovery methods fail to keep pace with the rising tide of security threats. Our secret location-based algorithm changes all that by authenticating based on geo-coordinates. Users only need to remember a place of personal significance, which is both intuitive and incredibly secure," says Matt Vogel, Founder and CTO of Center Identity. Moreover, Center Identity addresses the security concerns of businesses with stringent endpoint security measures, taking advantage of firewalls and VPNs to enhance protection even further. “Our technology allows these organizations to block satellite map traffic based on which website the user is on, effectively neutralizing the threat of phishing by ensuring that only whitelisted websites can access map-based authentication services,” says Vogel. This new protocol transforms access management in a way that mitigates the risks and reduces the hassles associated with traditional password-based systems. "We know that businesses lose around 30% of their time resetting passwords. Our solution not only plugs this productivity drain, but also enhances security without compromising convenience," adds Vogel. Users and businesses can visit Center Identity’s passwordless solutions here. About Center Identity is a pioneering cybersecurity company based in the United States with a patented approach to digital identity management. Leveraging cutting-edge solutions and blockchain technology, the expert team at Center Identity ensures unparalleled security for data and networks, empowering both individuals and businesses to navigate the digital landscape with confidence. Center Identity About Matt Vogel Matt Vogel is a distinguished software engineer with a profound impact on digital security, holding key patents in digital identity, cybersecurity, and artificial intelligence. His contributions have significantly influenced technological standards and innovations. As a recognized author and advisor, Vogel's expertise has been instrumental in shaping industry discourse and guiding the future of technology. For more information users can . visit Contact Stoyan Bojinov pr@centeridentity.com This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here.

Center Identity Launches Patented Passwordless Authentication For Businesses

Using Firebase Authentication with the Latest Next.js Features

সর্বশেষ Next.js বৈশিষ্ট্য সহ Firebase প্রমাণীকরণ ব্যবহার করা

Verwenden der Firebase-Authentifizierung mit den neuesten Next.js-Funktionen

Uso de la autenticación de Firebase con las últimas funciones de Next.js

Utilisation de l'authentification Firebase avec les dernières fonctionnalités Next.js

नवीनतम Next.js सुविधाओं के साथ फायरबेस प्रमाणीकरण का उपयोग करना

Usando o Firebase Authentication com os recursos Next.js mais recentes

Использование аутентификации Firebase с новейшими функциями Next.js

Firebase Kimlik Doğrulamasını En Son Next.js Özellikleriyle Kullanma

Sử dụng Xác thực Firebase với các tính năng Next.js mới nhất

将 Firebase 身份验证与最新的 Next.js 功能结合使用

How to Master Authentication and User Flow in Node.js With Knex and Redis

Knex এবং Redis দিয়ে Node.js-এ প্রমাণীকরণ এবং ব্যবহারকারীর প্রবাহ কীভাবে আয়ত্ত করা যায়

So meistern Sie die Authentifizierung und den Benutzerfluss in Node.js mit Knex und Redis

Cómo dominar la autenticación y el flujo de usuarios en Node.js con Knex y Redis

Comment maîtriser l'authentification et le flux d'utilisateurs dans Node.js avec Knex et Redis

Knex और Redis के साथ Node.js में प्रमाणीकरण और उपयोगकर्ता प्रवाह में कैसे महारत हासिल करें

Knex と Redis を使用して Node.js で認証とユーザー フローをマスターする方法

Knex 및 Redis를 사용하여 Node.js에서 인증 및 사용자 흐름을 마스터하는 방법

Como dominar a autenticação e o fluxo do usuário em Node.js com Knex e Redis

Как освоить аутентификацию и поток пользователей в Node.js с помощью Knex и Redis

Knex ve Redis ile Node.js'de Kimlik Doğrulama ve Kullanıcı Akışında Ustalaşma

Cách làm chủ xác thực và luồng người dùng trong Node.js với Knex và Redis

如何使用 Knex 和 Redis 在 Node.js 中掌握身份验证和用户流程

What is identity in the digital space? Is it a mere reflection of what we are offline, or is it an augmented version of ourselves? Is there a “minimum viable tech stack” that can be combined to create verifiable individuals? In my article, I’ll lean toward the technical side of this matter, and I won't provide one trivial answer but I’ll consider different aspects of digital identities, verifiable individuals, security, privacy, anonymity, unique digital fingerprints, and verification approaches. Digital identity The digital identity is a complex set of data points – often referred to as a digital footprint and fingerprint that you leave behind everywhere you present yourself online. These data points can be traced back to the real “YOU”, revealing unique aspects of your presence in the digital space/online. What is Identity? Identity is a collection of information and attributes/parameters that describe an entity. It is used to determine the actions in which this entity can participate or has participated. Three main categories of entities – people like you and me and anyone else. Individuals Corporations, companies, services. – physical items - objects, such as houses, laptops, planes, etc, and nonphysical items - such as software, data, etc. Assets The identity of each entity is based on its attributes, which can be divided into 3 main categories: Core: base characteristics (for example: name, date of birth). Derived: computed or inferred from core attributes - base characteristics (for example: age, location, gender). Transactional: related to specific actions (for example: tax or bank account number, online shopping history). Digital identity systems In the past, identification systems relied on face-to-face interactions and physical proofs. The transition to digital systems introduces new identity systems. A digital identity system uses the structure of a physical one but operates entirely with digital artifacts/attributes. It eliminates the usage of physical documents and manual processes. Modern trends driving the need for identification systems include increasing transaction volumes, data breaches, and the global shift toward digital/virtual interactions. Importance of digital identity Privacy and security cannot be ensured solely by constructing walls around sensitive information. Identity is now the matter where privacy and security intersect. Strong identity protocols protect against cyber risks and enable secure transactions of any kind and activities – logging into a website, making an online purchase, or accessing services – identity (or some technical attributes of it) plays a critical role in many aspects of our daily lives and actions. Your digital identity is more than just a username, profile photo, name/nickname, age, location, etc, and password – it’s a multifaceted representation of who you are in the digital and real world. Real and digital identities might be different because different attributes define them but they may intersect and be traceable to each other. Digital fingerprints and online identity In the digital world, where our virtual presence is often more noticeable than our physical one, the concept of online identity has become complex and unclear. At the bottom of this digital identity lies . These fingerprints serve as the basic characteristics of our online identity, leaving behind a trail of unique identifiers/params that reveal our digital and real identity, and influence how we interact within the virtual world – software, different online services, DBs, and other real and virtual identities. a huge set of details/attributes known as digital fingerprints Understanding digital fingerprints Digital fingerprints, in a nutshell, are a bunch of parameters that define our online identity. These parameters include everything from user-agents, IPs, and screen resolutions to browser plugins, time zones, and hardware characteristics. Each parameter contributes to the set of characteristics (params) of our digital identity, forming a unique “signature” that distinguishes us in cyberspace. For example, user agents provide critical information about the user's browser, OS, and device, giving valuable info on users’ digital environment. IPs serve as coordinates, revealing the user's network and geo-location, and affecting their online experiences and interactions. These simple and familiar to everyone params, when they are together in one set, create identifiers that reflect our online presence and define the way we navigate and interact with online services. Detection and spoofing Detecting and manipulating digital fingerprints is a complicated process for users seeking anonymity and platforms seeking authenticity. , users can use different techniques to hide/spoof their digital trails and change their true identities. By using tools such as VPNs, you can encrypt their network traffic and mask their IPs (some basic parameters of digital fingerprints and identity), making it challenging to trace their online activities back to their original identities. Through fingerprint spoofing, users can manipulate the aforementioned parameters such as user-agents, browser characteristics, and device params to mask as unique, verifiable entities, and evade detection by bot detection systems and identity verification protocols. For example, you may use the fingerprint of a legitimate user, to gain access to restricted content or circumvent security measures designed to detect fraudulent activities. There is a constant battle for anonymity and authenticity in the digital world. Speaking about proxies and VPNs Implications for online identity The ability to detect and spoof digital fingerprints has different implications for online presence, changing the dynamics of authenticity and flooding digital services with fake/incomplete data. Consider a scenario where a user in a country with strict censorship can’t access blocked content on social media. By using a VPN to mask their IPs and manipulate their digital fingerprints, the user can circumvent geo-restrictions and access the blocked content anonymously, expressing their freedom of access to information. Speaking about online security, the manipulation of digital fingerprints can be used to evade detection by bot detection systems, allowing users to engage in activities that may be suspicious or fraudulent. Fingerprint spoofing also raises concerns about potential abuse and misuse, as people/services may exploit these approaches for malicious goals, such as spreading fake information or engaging in cyberattacks. Balancing privacy and security involves managing digital fingerprints and online identity carefully, which requires strong security policies and ethical guides. Faking online identity The manipulation of fingerprints gives us the ability to fake online identities that are significantly different from our offline ones, blurring the lines between authenticity and fake. By crafting digital fingerprints that use ones of authentic users, we can assume roles and identities that ensure their physical existence, expanding the boundaries of our online presence and influence. Let’s consider a case where a user spoofs fingerprints to create multiple online accounts for social media marketing. By masking their true identity and presenting themselves as distinct, authentic users, these people can amplify their online presence and get a wider audience, all while tricking detection algorithms and security measures. However, fake online identities also raise concerns about trust and credibility in online interactions, as individuals may struggle to identify genuine users and imposters/bots. Faking online identity raises ethical concerns that outweigh the need for transparency and accountability, as well as the importance of technical literacy in these aspects and responsible online behavior. Digital fingerprints are important aspects and characteristics of our online identities. From detection to spoofing, the manipulation of these unique parameters offers a way to anonymity and different positive and negative cases of using this “anonymity”. The essence of our online identities is not only in the set of our digital fingerprints but also in the choices we make and the actions we take on the web. Understanding digital fingerprints gives us additional depth in understanding online identities, and concepts of authenticity, transparency, privacy, and autonomy. Modern Tech's Approach to Identity and Information Identity Digital identity – our identity is no longer limited to physical one. It includes our digital footprint – interactions, actions, preferences, and behaviors across different platforms, services and devices. Multiple identities – we can have different identities online, each tailored to specific contexts and goals (e.g. professional, social networks, gaming, etc). Self-representation – social media profiles, avatars, photos, music, posts, bios, etc allow us to show how we present ourselves to others. Personal expression Social networks – , , , , etc allow us to express our identity through photos, videos, stories, posts, etc. We share thoughts, experiences, and expertise, creating a sense of community. Emojis and GIFs are visual elements that show emotions and reactions – showing parts of our identities. From profile pictures to personalized music playlists, different platforms give us tools to express our uniqueness. Instagram TikTok YouTube FB Verification mechanisms Biometrics - fingerprint (real, not digital fingerprints) scanners, facial recognition, and voice recognition can verify identity quite securely. 2FA – combining passwords with a second factor (or even 3rd %) ) (e.g. SMS/OTP codes, app notifications, secure questions) improves security. Decentralized systems ensure transparency and prevent identity fraud. Digital proofs (for example: diplomas, degrees, certifications, etc) can be cryptographically verified. Prove knowledge without revealing sensitive data - zero-knowledge proofs. Challenges Balancing personalization with privacy and anonymity is crucial. Access to tech may vary for different people, affecting the online presence and, as a result, identity representation. Cybersecurity measures to protect identities and personal data. Responsible use of data and avoiding biases in algorithms, and false alerts without getting and storing too much personal data which poses additional risks. Verifiable individuals There isn’t a one-size-fits-all solution but here’s some tech stack (a combination of technologies and protocols) that can contribute to establishing verifiable identities. Blockchain or DLT (distributed ledger technology) An immutable and decentralized record of identity-related transactions can be created. The idea: Our identity attributes (such as name, date of birth, avatar, location, bio, etc) are stored on the blockchain. Transactions related to identity verification (e.g. permissions, updating personal info) are recorded as blocks. The decentralization ensures transparency and prevents tampering. For example, check out Ethereum and Hyperledger Indy. SSI (self-sovereign identity) Give people control over their identity data. The idea: People create a “digital wallet” where they store their verifiable credentials. Credentials (artifacts) are issued by trusted organizations (governments, universities, corporations, etc) and digitally/cryptographically signed. People can share these pieces of data with others without relying on any kind of central authority. For example, check out Sovrin or uPort. DIDs (decentralized identifiers) Create globally unique and verifiable identifiers for people. The idea: DIDs are linked to crypto keys and stored on a decentralized network. They allow people to prove ownership of their identity without revealing their data. For example, check out the DID specification by W3C. VCs (verifiable credentials) Issue and verify digital credentials. The idea: VCs are digitally signed statements about a person’s attributes. Issuers sign VCs, and holders present them as proof. Verifiers (e.g. corporations and service providers) verify the credentials. For example, check out the W3C verifiable credentials data model. ZKPs (zero-knowledge proofs) Prove a statement without revealing the actual data. The idea: ZKPs allow people to prove knowledge (age, eligibility, etc) without showing the particular data. Ensuring privacy and verification. For example, check out zk-SNARKs and Bulletproofs. Biometric auth Verify an identity based on unique biological features. The idea: Biometrics (fingerprint (real, not digital fingerprints), eye scan) are captured while using some online services. During authentication, the system compares the biometric data with stored templates. For example, probably, many of you have seen and have used fingerprint scanners or facial recognition. The tech stack is a starting point. Depending on the use case, additional components (such as secure hardware modules, identity wallets, and privacy-preserving algorithms) may be implemented. Different approaches might be combined and implemented as a multistep procedure – more steps passed more transparent verification and credibility. Verifiable identities in the digital space require a complex approach with a balance of security, privacy, anonymity, uniqueness, verification, and usability.

Identity in the Digital Era: Balancing Security, Privacy, and Authenticity

ডিজিটাল যুগে পরিচয়: নিরাপত্তা, গোপনীয়তা এবং সত্যতার ভারসাম্য

Identität im digitalen Zeitalter: Sicherheit, Datenschutz und Authentizität in Einklang bringen

Identidad en la era digital: equilibrio entre seguridad, privacidad y autenticidad

L'identité à l'ère numérique : équilibrer sécurité, confidentialité et authenticité

डिजिटल युग में पहचान: सुरक्षा, गोपनीयता और प्रामाणिकता को संतुलित करना

デジタル時代のアイデンティティ: セキュリティ、プライバシー、信頼性のバランスをとる

디지털 시대의 신원: 보안, 개인정보 보호, 신뢰성의 균형

Identidade na Era Digital: Equilibrando Segurança, Privacidade e Autenticidade

Идентичность в цифровую эпоху: баланс безопасности, конфиденциальности и подлинности

Dijital Çağda Kimlik: Güvenlik, Gizlilik ve Orijinalliğin Dengelenmesi

Bản sắc trong kỷ nguyên số: Cân bằng giữa bảo mật, quyền riêng tư và tính xác thực

数字时代的身份：平衡安全性、隐私性和真实性

Hey everyone! I recently tackled the task of integrating Webflow OAuth into my app, and as someone who doesn't code, I wanted to share my approach using Xano as a backend and Webflow as a frontend. If you're a coding pro, please bear with me—no throwing rotten tomatoes! This is one no-coder to another, hoping to smoothen your journey a bit. TLDR: I've compiled every step into a video for those who prefer visual learning, but you'll find a detailed text version of the process below. https://youtu.be/bTUatl6eTec?embedable=true Understanding OAuth Let's quickly grasp the fundamental concept of how OAuth operates. Picture this: you're on holiday and want to rent an apartment in a foreign country. You find an apartment building where you can rent a unit. Upon arrival, instead of being given keys to all the flats, the owner sends you a one-time code to access your specific flat's key lockbox. You use this code to open the lockbox and retrieve a key card, granting you access to the apartment during your stay. In this analogy, Webflow represents the apartment owner, the one-time code serves as an access code, and the key card is analogous to an access token. If you need access to any information about a user's Webflow projects—such as lists of pages, assets, collections, or forms—you'll require an access token. This token is used with any API requests sent to Webflow on behalf of the user. In the example below, I'll demonstrate building a simple Webflow app that displays information about the user's project without storing the access token in my database (although in real-world scenarios, it's advisable to store tokens associated with users). Step 1: Create a New Webflow App Navigate to your Webflow dashboard's "Apps & Integrations" tab and create a new app. Provide general information about your app, including its name, description, and home page URL. Specify the required permissions—I'll use a data client app in my example, granting "Read" access to "Sites." You can adjust these permissions later if needed. The crucial pieces of information we need here are the and , automatically generated for your app. Leave the Redirect URL field blank for now; we'll revisit it in the next step. Client ID Client Secret Step 2: Setting Up a New Webflow Project as the Frontend Create a new Webflow project with two pages: Home and Sites. On the Home page, add a button labeled "Show Sites," which will trigger a request to Webflow for the access code. Set the button's URL to , replacing YOUR_CLIENT_ID with the actual Client ID obtained earlier. Adjust the URL if your app requires additional permissions. https://webflow.com/oauth/authorize?response_type=code&client_id=YOUR_CLIENT_ID&scope=sites%3Aread Clicking this button will display a permissions screen to the user, allowing them to choose which projects to grant access to. Upon authorizing the app, they'll be redirected to the Redirect URL—remember to copy the URL of the Sites page (the second page you created) and paste it into the Redirect URL field of your app. Upon completing this step, clicking "Show Sites" will redirect users to the Sites page, with the access code included in the URL. Step 3: Setting Up a Xano Project and Creating the First API Create a new project in Xano, and navigate to the APIs tab. Add a new API Group, and then within that group, add a new API Endpoint—let's call it "getToken." In the "getToken" endpoint: Add a text input named "accessCode" to receive the access code from the frontend. Make a POST request to with body parameters: https://api.webflow.com/oauth/access_token client_id: Your Client ID client_secret: Your Client Secret grant_type: authorization_code code: accessCode (using the variable from the input) Define the output of the first API request as "accessToken," which will be the access token associated with the user. Make a second API request (for demonstration purposes) to retrieve the user's site list—a GET request to . Include the following headers: https://api.webflow.com/v2/sites accept: application/json authorization: accessToken.response.result.access_token Define the output of the second API as "siteList," which represents the list of Webflow projects. Return the "siteList" in the response. Copy the API endpoint URL for later use. Step 4: Configuring a Frontend Request From Your Webflow Project Return to the Webflow project and open the Sites page—the page where users are redirected after granting access to their Webflow projects. Here, add the following JavaScript functions in the custom code area before the </body> tag. First, let's create the function to retrieve the sites: getSites() function getSites() {
 const url = window.location.search;
 const params = new URLSearchParams(url);
 const accessCode = params.get('code');
 const options = {
 method: 'POST',
 headers: {accept: 'application/json', 'content-type': 'application/json'},
 body: JSON.stringify({accessCode: accessCode})
 };
 fetch('YOUR_API_ENDPOINT', options)
 .then(response => response.json())
 .then(response => {
 const siteList = response.response.result.sites;
 showSites(siteList);
 })
 .catch(err => console.log(err));
} Then, let's create the function to display the retrieved sites: showSites() function showSites(sites) {
 const container = document.querySelector('#result');
 sites.forEach(site => {
 const siteDiv = document.createElement('div');
 siteDiv.classList.add('site');
 const siteContent = 
 `<h2>${site.displayName}</h2>
 ID: ${site.id}
 Workspace ID: ${site.workspaceId}
 Short Name: ${site.shortName}
 Time Zone: ${site.timeZone}
 Created On: ${site.createdOn}
 Last Updated: ${site.lastUpdated}
 Last Published: ${site.lastPublished}
 <img src="${site.previewUrl}" alt="Preview">
 `;
 siteDiv.innerHTML = siteContent;
 container.appendChild(siteDiv);
 });
} Lastly, ensure that the function runs on page load: getSites() document.addEventListener('DOMContentLoaded', function() {
 getSites();
}); And there you have it! I hope this guide proves helpful for my fellow no-coders! Feel free to reach out if you have any questions or need further clarification. Happy coding!

No-Code Webflow OAuth: Make Authenticated Requests to the Webflow API Using Xano

নো-কোড ওয়েবফ্লো OAuth: Xano ব্যবহার করে Webflow API-তে প্রমাণীকৃত অনুরোধ করুন

No-Code-Webflow-OAuth: Stellen Sie mit Xano authentifizierte Anfragen an die Webflow-API

Webflow OAuth sin código: realice solicitudes autenticadas a la API de Webflow utilizando Xano

No-Code Webflow OAuth : effectuez des requêtes authentifiées à l'API Webflow à l'aide de Xano

नो-कोड वेबफ़्लो OAuth: Xano का उपयोग करके वेबफ़्लो API के लिए प्रमाणित अनुरोध करें

ノーコード Webflow OAuth: Xano を使用して Webflow API への認証済みリクエストを行う

코드 없는 Webflow OAuth: Xano를 사용하여 Webflow API에 인증된 요청 만들기

No-Code Webflow OAuth: Faça solicitações autenticadas para a API Webflow usando Xano

OAuth Webflow без кода: выполнение аутентифицированных запросов к API Webflow с помощью Xano

Kodsuz Webflow OAuth: Xano Kullanarak Webflow API'sine Kimliği Doğrulanmış İstekler Yapın

OAuth luồng web không mã: Thực hiện các yêu cầu được xác thực đối với API luồng web bằng Xano

无代码 Webflow OAuth：使用 Xano 向 Webflow API 发出经过身份验证的请求

How to Implement Authentication in Next.js 14 With NextAuth.js, Shadcn/ui, react-hook-form, and Zod

NextAuth.js, Shadcn/ui, react-hook-form, এবং Zod-এর সাহায্যে Next.js 14-এ কীভাবে প্রমাণীকরণ প্রয়োগ করা যায়

So implementieren Sie die Authentifizierung in Next.js 14 mit NextAuth.js, Shadcn/ui, React-Hook-Form und Zod

Cómo implementar la autenticación en Next.js 14 con NextAuth.js, Shadcn/ui, react-hook-form y Zod

Comment implémenter l'authentification dans Next.js 14 avec NextAuth.js, Shadcn/ui, React-hook-form et Zod

NextAuth.js, Shadcn/ui, प्रतिक्रिया-हुक-फॉर्म और ज़ोड के साथ Next.js 14 में प्रमाणीकरण कैसे लागू करें

NextAuth.js、Shadcn/ui、react-hook-form、Zod を使用して Next.js 14 に認証を実装する方法

NextAuth.js, Shadcn/ui, React-hook-form 및 Zod를 사용하여 Next.js 14에서 인증을 구현하는 방법

Como implementar autenticação em Next.js 14 com NextAuth.js, Shadcn/ui, react-hook-form e Zod

Как реализовать аутентификацию в Next.js 14 с помощью NextAuth.js, Shadcn/ui, response-hook-form и Zod

Next.js 14'te Kimlik Doğrulaması NextAuth.js, Shadcn/ui, react-hook-form ve Zod ile Nasıl Uygulanır?

Cách triển khai xác thực trong Next.js 14 với NextAuth.js, Shadcn/ui, Reac-hook-form và Zod

如何使用 NextAuth.js、Shadcn/ui、react-hook-form 和 Zod 在 Next.js 中实现身份验证 14

What is Authentication? 🔐 Authentication is the process of verifying the identity of users, ensuring they are who they claim to be before granting access to a system or application. In the context of web applications, this is crucial for protecting sensitive information and resources. Authentication involves: User Credentials:🔑 Users provide credentials, such as usernames and passwords. Verification Process:✔️ The system verifies the provided credentials against stored data. Successful verification grants access; otherwise, access is denied Spring Security🍃 For developers building Spring-based applications, Spring Security serves as the de-facto standard for securing their creations. This comprehensive framework provides robust authentication and authorization mechanisms, ensuring your application’s data and functionality remain safe from unauthorized access. Java JWT (JSON Web Token)Authentication: A Secure and Scalable 🔐📈 Approach JWT stands for JSON Web Token, a self-contained token that contains information about the user and is signed by the server for verification. It has become a popular choice for authorization due to its numerous advantages. Use Cases: JWTs are widely used in various scenarios: Public APIs: Securely access public APIs without requiring frequent logins. Mobile Applications: Store user information and authorization details within the token for offline use. Single Sign-On (SSO): This allows users to seamlessly access multiple applications with a single login. Practical application of JWT by implementing it in a Spring Boot application to secure our API endpoints⛏👷 Now, we will configure the in-memory user and JWT. We will create an API endpoint and secure it using Spring Boot security. Create a Spring Boot Project Use Spring Initializr to create a new Spring Boot project with the following dependencies: For Web: <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-web</artifactId>
</dependency> For Security <dependency>
 <groupId>org.springframework.boot</groupId>
 <artifactId>spring-boot-starter-security</artifactId>
</dependency> Lombok: <dependency>
 <groupId>org.projectlombok</groupId>
 <artifactId>lombok</artifactId>
 <optional>true</optional>
</dependency> For JWT: <dependency>
 <groupId>io.jsonwebtoken</groupId>
 <artifactId>jjwt-api</artifactId>
 <version>0.11.5</version>
</dependency>
<dependency>
 <groupId>io.jsonwebtoken</groupId>
 <artifactId>jjwt-impl</artifactId>
 <version>0.11.5</version>
 <scope>runtime</scope>
</dependency>
<dependency>
 <groupId>io.jsonwebtoken</groupId>
 <artifactId>jjwt-jackson</artifactId> 
 <version>0.11.5</version>
 <scope>runtime</scope>
</dependency> Let’s start with creating an endpoint to be secured: @RestController
@RequestMapping("/home")
public class Controller {
 @Autowired
 private UserService userService;
 @GetMapping("/users")
 public List<User> getUsers(){
 System.out.println("getting users");
 return userService.getUsers();
 }
} Create a user: @Getter
@Setter
@NoArgsConstructor
@AllArgsConstructor
@ToString
public class User {
 private String userId;
 private String name;
 private String email;
} Create a service class: @Service
public class UserService {
 private List<User> store=new ArrayList<>();
 public UserService() {
 store.add(new User(UUID.randomUUID().toString(), "Bhushan", "bhushan@gmail.com"));
 store.add(new User(UUID.randomUUID().toString(), "Ramesh", "ramesh@gmail.com"));
 store.add(new User(UUID.randomUUID().toString(), "Suresh", "suresh@gmail.com"));
 store.add(new User(UUID.randomUUID().toString(), "Paresh", "paresh@gmail.com"));
 }
 public List<User> getUsers(){
 return this.store;
 }
} Create an in-memory user with UserDetailService bean: @Configuration
public class AppConfig {
 @Bean
 public UserDetailsService userDetailsService() {
 UserDetails userDetails = User.builder().
 username("Bhushan")
 .password(passwordEncoder().encode("Nemade")).roles("ADMIN").
 build();
 return new InMemoryUserDetailsManager(userDetails);
 }
 @Bean
 public PasswordEncoder passwordEncoder() {
 return new BCryptPasswordEncoder();
 }
 @Bean
 public AuthenticationManager authenticationManager(AuthenticationConfiguration builder) throws Exception {
 return builder.getAuthenticationManager();
 }
} Start with creating the class JWTAthenticationEntryPoint that will be implementing : Used to handle authentication-related exceptions. Specifically, it is responsible for returning an unauthorized (401) response to clients who attempt to access protected resources without proper authentication. AuthenticationEntryPoint @Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
 @Override
 public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException)
 throws IOException, ServletException {
 response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
 PrintWriter writer = response.getWriter();
 writer.println("Access Denied !! " + authException.getMessage());
 }
} The helper class is often created to encapsulate the logic related to the generation, parsing, validation, and manipulation of JWTs in a more modular and maintainable way. It provides a set of methods and utilities to interact with JWTs. Create a JWT helper class: @Component
public class JwtHelper {
 public static final long JWT_TOKEN_VALIDITY = 5 * 60 * 60;
 private String secret = "afafasfafafasfasfasfafacasdasfasxASFACASDFACASDFASFASFDAFASFASDAADSCSDFADCVSGCFVADXCcadwavfsfarvf";
 public String getUsernameFromToken(String token) {
 return getClaimFromToken(token, Claims::getSubject);
 }
 public Date getExpirationDateFromToken(String token) {
 return getClaimFromToken(token, Claims::getExpiration);
 }
 public <T> T getClaimFromToken(String token, Function<Claims, T> claimsResolver) {
 final Claims claims = getAllClaimsFromToken(token);
 return claimsResolver.apply(claims);
 }
 private Claims getAllClaimsFromToken(String token) {
 return Jwts.parser().setSigningKey(secret).parseClaimsJws(token).getBody();
 }
 private Boolean isTokenExpired(String token) {
 final Date expiration = getExpirationDateFromToken(token);
 return expiration.before(new Date());
 }
 public String generateToken(UserDetails userDetails) {
 Map<String, Object> claims = new HashMap<>();
 return doGenerateToken(claims, userDetails.getUsername());
 }
 private String doGenerateToken(Map<String, Object> claims, String subject) {

 return Jwts.builder().setClaims(claims).setSubject(subject).setIssuedAt(new Date(System.currentTimeMillis()))
 .setExpiration(new Date(System.currentTimeMillis() + JWT_TOKEN_VALIDITY * 1000))
 .signWith(SignatureAlgorithm.HS512, secret).compact();
 }
 public Boolean validateToken(String token, UserDetails userDetails) {
 final String username = getUsernameFromToken(token);
 return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
 }
} Extending the class for a JWT authentication filter in Spring Security is a common approach to ensure that the filter is only executed once per request. This helps prevent unnecessary duplicate processing and ensures that the filter logic is applied consistently. Create a JwtAuthenticationFilter class which will extend OncePerRequestFilter: OncePerRequestFilter @Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
 private Logger logger = LoggerFactory.getLogger(OncePerRequestFilter.class);
 @Autowired
 private JwtHelper jwtHelper;
 @Autowired
 private UserDetailsService userDetailsService;
 @Override
 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
 String requestHeader = request.getHeader("Authorization");
 logger.info(" Header : {}", requestHeader);
 String username = null;
 String token = null;
 if (requestHeader != null && requestHeader.startsWith("Bearer")) {
 token = requestHeader.substring(7);
 try {
 username = this.jwtHelper.getUsernameFromToken(token);
 } catch (IllegalArgumentException e) {
 logger.info("Illegal Argument while fetching the username !!");
 e.printStackTrace();
 } catch (ExpiredJwtException e) {
 logger.info("Given jwt token is expired !!");
 e.printStackTrace();
 } catch (MalformedJwtException e) {
 logger.info("Some changed has done in token !! Invalid Token");
 e.printStackTrace();
 } catch (Exception e) {
 e.printStackTrace();
 }
 } else {
 logger.info("Invalid Header Value !! ");
 }
 if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
 UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
 Boolean validateToken = this.jwtHelper.validateToken(token, userDetails);
 if (validateToken) { 
 UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
 authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
 SecurityContextHolder.getContext().setAuthentication(authentication);
 } else {
 logger.info("Validation fails !!");
 }
 }
 filterChain.doFilter(request, response);
 }
} Create a SecurityConfig class as spring security in the configuration file: @Configuration
public class SecurityConfig {
 @Autowired
 private JwtAuthenticationEntryPoint point;
 @Autowired
 private JwtAuthenticationFilter filter;
 @Bean
 public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
 http.csrf(csrf -> csrf.disable())
 .authorizeRequests().
 requestMatchers("/test").authenticated().requestMatchers("/auth/login").permitAll()
 .anyRequest()
 .authenticated()
 .and().exceptionHandling(ex -> ex.authenticationEntryPoint(point))
 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
 http.addFilterBefore(filter, UsernamePasswordAuthenticationFilter.class);
 return http.build();
 }
} Create a login API to accept the username and password: @RestController
@RequestMapping("/auth")
public class AuthController {
 @Autowired
 private UserDetailsService userDetailsService;
 @Autowired
 private AuthenticationManager manager;
 @Autowired
 private JwtHelper helper;
 private Logger logger = LoggerFactory.getLogger(AuthController.class);
 @PostMapping("/login")
 public ResponseEntity<JwtResponse> login(@RequestBody JwtRequest request) {
 this.doAuthenticate(request.getEmail(), request.getPassword());
 UserDetails userDetails = userDetailsService.loadUserByUsername(request.getEmail());
 String token = this.helper.generateToken(userDetails);

 JwtResponse response = JwtResponse.builder()
 .jwtToken(token)
 .username(userDetails.getUsername()).build();
 return new ResponseEntity<>(response, HttpStatus.OK);
 }
 private void doAuthenticate(String email, String password) {
 UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(email, password);
 try {
 manager.authenticate(authentication);
 } catch (BadCredentialsException e) {
 throw new BadCredentialsException(" Invalid Username or Password !!");
 }
 }
 @ExceptionHandler(BadCredentialsException.class)
 public String exceptionHandler() {
 return "Credentials Invalid !!";
 }
} : Creating a JWT request and response involves defining structures for sending and receiving JWTs during the authentication process. Typically, a JWT request is used to send user credentials (e.g., username and password) to the server for authentication, and a JWT response is used to deliver a token upon successful authentication. Create a JWT Request and JWT Response to receive data and send login details @Getter
@Setter
@AllArgsConstructor
@NoArgsConstructor
@Builder
@ToString
public class JwtRequest {
 private String email;
 private String password;
} @Getter
@Setter
@AllArgsConstructor
@NoArgsConstructor
@Builder
@ToString
public class JwtResponse {
 private String jwtToken;
 private String username;
} Test the API using Postman to generate a JWT token, then use that token as a header in subsequent requests to access the protected API and verify successful authentication. Dive Deeper : youtube.com/watch?v=q2l91Ffc_8U&t=3299s https://springframework.guru/jwt-authentication-in-spring-microservices-jwt-token/ Thank you for reading😊 Also published here.

Mastering JWT Authentication & Authorization in Spring Boot 3.1

**GRAND CAYMAN, Cayman islands, January 25th, 2024/Chainwire/--**Gaming, Ecommerce and DeFi applications are leveraging Sui’s singular social authentication to eliminate the biggest hurdle blocking mainstream audiences from web3. , the rapidly ascending Layer-1 blockchain created by the leaders of Facebook's Diem project, today announced that over 10 decentralized applications (dApps) in the Sui ecosystem have integrated zkLogin, the first-of-its-kind primitive that makes Web3 login as simple as signing in with familiar web credentials such as Google or Twitch. Sui Sui continues to advance zkLogin, adding new providers and additional features such as multi-sig capability and more. Thanks to these recent additions, it’s estimated that thousands of users will now be able to use zkLogin and experience one of the world’s first one-click onboarding into crypto. “zkLogin is a native utility unique to Sui that empowers developers to offer users the ability to use the same social logins they use everywhere else to authenticate with web3 applications,” said Kostas Chalkias, Co-Founder & Chief Cryptographer of Mysten Labs, the a16z and Circle-backed company that created the Sui Network. “As we enter the next phase of adoption, the existence of tools like zkLogin will become a prerequisite to onboard mainstream users into the decentralized web.” Among the wallets that now support zkLogin are Chrome-based wallets such as Ethos Wallet and Sui Wallet. zkLogin is now also integrated into mobile applications (both on Play Store and AppStore) by using Suiet and Surf Wallet. Similarly, web3 gaming experiences such as Suilette and Quantum Temple are using zkLogin, to give their users an easier, more intuitive onboarding experience. Lastly, DeFi applications on Sui are also taking advantage of this unique strength of Sui. Well-known protocols like DegenHive, Blockbolt, Aftermath, Navi, and BlueFin have integrated the technology, allowing users to manage their digital assets and participate in financial activities without the hassle of managing private keys. “zkLogin is a game-changer in Web3 and particularly in DeFi,” said Zabi Mohebzada, Co-Founder at Bluefin. “With zkLogin, users only need a Google account to sign up and trade. No wallets are required. This enables us to unlock the security benefits of decentralized trading for a much broader universe of investors.” Launched in 2023 as one of the first industry solutions for Web2-based authentication for Web3, zkLogin makes it possible for users to join the Sui ecosystem without having to install separate wallets or memorize and manage seed phrases. Contact Sui Foundation media@sui.io This story was distributed as a release by Chainwire under HackerNoon’s Business Blogging Program. Learn more about the program here.

10 Decentralized Applications Integrate Sui’s Groundbreaking zkLogin Google Authentication

Strong authentication practices are paramount to any zero-trust architecture. A company’s insider threat and breach risks are much higher without them. On the other hand, deploying best practices can substantially improve their overall protection from internal and external threats. Why Is Authentication Crucial to Zero Trust? Zero trust suggests organizations should trust no individual or device by default — even if the person has previously enjoyed access privileges or already operates within the network. To properly deploy this security concept, companies must leverage strong authentication practices. Authentication is crucial for establishing expectations and monitoring privileges — no zero-trust strategy can exist without it. Regardless of context or authority, everyone must verify their identity to prove the company can have confidence in them. Authentication practices validate users’s identities to determine whether or not to grant the use of company assets. Without them, anyone could pose as someone else to escalate their privileges — rendering the entire concept ineffective. If there’s no way to monitor and control who accesses systems and data sets, there is little point to a zero-trust architecture. Moreover, strong authentication practices protect companies from insider threats and data breach damages by minimizing access and accelerating threat identification. In addition to limiting lateral movement, they also help the information technology department trace attackers. Perimeter security isn’t foolproof, so more organizations use zero-trust authentication to protect their most valuable assets. As of 2022, already use or plan to adopt it. However, it isn’t an off-the-shelf solution — instead, it is a system of strategies and policies. If they want to see results, they must leverage best practices. 80% of companies worldwide Best Practices for User Authentication Although zero trust authentication has no industry-standard applications, widely accepted fundamentals exist. 1. Continuously Reauthenticate Users Unlike other security measures, authentication requires persistent reapplication. Zero trust revolves around granting access — one round of authentication is not enough to grant users access to all resources. Instead, authentication practices should be repetitive: users must be authenticated before accessing any and every resource. For example, users should get a one-time passcode for each login attempt instead of a personal code they must remember. on a circumstantial basis If a user were to successfully verify their identity once and later fall victim to malware, social engineering, or device hijacking, their pre-approved access privileges would put sensitive data and systems at risk. For continued organizational security, re-authentication is crucial. 2. Leverage Anti-Automation Practices With the rise of artificial intelligence, automated attacks have increased. Companies should leverage rate limiters to prevent cybercriminals from using brute force or credential-stuffing attacks. This way, excess authentication attempts will be flagged for manual review. Alternative anti-automation practices involve specific tools. For example, even if an attacker successfully breaches their defenses. This way, companies can protect their networks if their initial security measures fail. multi-factor authentication prevents lateral movement 3. Enforce the Principle of Least Privilege Even when users successfully verify their identity, they should only get bare-minimum privileges. This practice mitigates human error and insider threats by ensuring individuals can’t unintentionally or maliciously alter or share data. If certain data sets or systems aren’t critical for a user’s current task, there’s no reason they need to be able to view or manipulate them. Limiting the scope of their access to the bare essentials prevents them from engaging in risky behavior and minimizes lateral movement in the event an attacker breaches network defenses. 4. Do Not Allow Bypasses An authentication bypass vulnerability occurs when someone finds a workaround to identity verification by exploiting development or deployment gaps. Although many security tools are supposedly foolproof, mistakes happen. If employees were to routinely manipulate the system, they’d make the zero trust architecture arbitrary. Companies should ensure bypassing authentication measures is impossible. Considering workers are consistently in any workplace’s security, allowing workarounds for convenience puts sensitive data and systems at risk. All verification methods must be strict to combat human error and people’s susceptibility to social engineering. among the top weak points 5. Enforce Device Authentication When establishing best practices, many companies overlook device authentication. Even though company computers are already within the network, they are still vulnerable to external interference and insider threats. Consequently, companies shouldn’t allow any technology to access their assets without prior security validation. This authentication approach is particularly applicable to remote workers since many use personal computers or phones. Requiring them to verify their technology protects their employer’s systems and data. 6. Leverage Multiple Tools A proper zero-trust architecture leverages multiple security tool tiers. However, it’s not uncommon for industry professionals to parrot unbelievable success rate statistics, prompting companies to put too much trust in a single solution. For example, a 2018 report from Microsoft prompted dozens of claims that multi-factor authentication prevents 99% of cyber attacks. Even respected authorities like the U.S. Cybersecurity and Infrastructure Security Agency assert it — which simply isn’t true. lowers hacking success rates by 99% People often refer to authentication methods as something a person knows, has, and is — like passwords, one-time passcodes, and biometrics. Companies should take this saying to heart, leveraging each type to ensure maximum protection. 7. Allow Passwordless Authentication Although strong passwords are a cornerstone of any security strategy, they’re ultimately unreliable. Companies should adopt passwordless authentication practices instead of shifting responsibility onto staff prone to human error. Forcing users to sign in with one-time passcodes and randomly generated codes is much safer than trusting them to create secure login details. In fact, multi-factor authentication alone , according to an industry expert. As this technology advances, the need for systems relying on flimsy security measures like passwords lessens. can prevent 50% of cyber attacks 8. Leverage Risk-Based Analysis Unauthorized access instances are among the leading causes of breaches and cyber-attacks. In fact, it in 2022, up from 1,108 in 2021 — and over 422 million people were impacted as a result. was responsible for 1,862 data compromises Although no strategy is foolproof, companies can get close to a 100% success rate if they use risk analysis to inform their authentication decisions. Since zero trust revolves around protecting assets instead of reinforcing perimeter security, a well-informed approach can enhance protection. Strong Authentication Practices Are Crucial to Success Deploying a zero-trust architecture without strong authentication practices is like serving a pie without filling — it’s pointless. Identity management and governance are fundamental to the success of this security strategy. If companies want to mitigate risks and improve their level of protection, they should seriously consider implementing the best practices.

Support Zero Trust With Strong Authentication Practices

Keep it real. Keep it 100. Keep it . Say hello to the 2023 word of the year according to the big dictionary folks, Merriam-Webster. authentic Authentic follows and marks Merriam-Webster’s 20th anniversary of choosing a top word. 2022’s choice of “gaslighting” We all use authentic. Authentic self. Authentic food. Authentic experience. In business we can want authentic leadership and authentic brands. Lookups for the word are routinely heavy on the Merriam-Webster’s site but jumped to new heights during 2023, editor at large Peter Sokolowski told The Associated Press. https://youtu.be/faPnxrEOhLA?si=Yw_rZFX6xcmjsyc1&embedable=true Merriam-Webster’s Word of the Year: What Does It Mean? Merriam-Webster is one of the most important  dictionaries in the English language, known for carefully choosing a word that represents the current culture each year. When it comes to language and its impact on society, I find myself captivated by the latest trends and the cultural shifts that emerge from them. Consider globalization and language convergence. This is evident in the growing popularity of English as a global language, as well as the adoption of foreign slang and expressions into everyday communication. As the world becomes increasingly interconnected, we see a convergence of languages and cultures. This convergence also leads to a blurring of cultural lines, creating a more diverse and interconnected global society. Globally we choose words to reflect our values, desires, and collective experiences. So it is no surprise that Merriam-Webster’s Word of the Year holds such significance and fascination for people around the world. The Relevance of Authenticity for Crypto The word "authentic" is important for crypto for several key reasons: Crypto projects need to build trust directly with their users. Cryptocurrencies and other blockchain-based technologies rely on trust in a decentralized environment. This breaks free from the shackles of centralized control where trust is placed in central authorities. The crypto space is prone to scams, rugs, and fraudulent activities. Emphasizing aspects like open-source code, verifiable identities, and audits reinforces trust and authenticity. Highlighting authenticity helps differentiate legitimate projects from those aiming to exploit users. Being authentic can boost brand reputation and value. . By demonstrating genuine intentions and values, client projects can attract more investors and users. For the overall industry, this can lead to increased adoption and higher valuations. I’ve seen that in a competitive market, authenticity can be a key differentiator for crypto projects In an era where trust is at a premium, investors are increasingly drawn to blockchain projects that demonstrate authentic behavior and values. Users want to feel a genuine connection with the brands they choose to support. By embracing authenticity, crypto projects can cultivate trust, establish loyalty, and retain a passionate community. Authenticity as a Guiding Principle for Your Brand Cultivating ; it’s a strategic decision that can set your brand apart. authenticity within your brand is not just a trendy buzzword Here are some and interactions: practical steps to incorporate authenticity into your brand’s messaging Tell your unique story: I wrote previously about how to create the brand story that sells. Share the journey, triumphs, and even failures that define your brand’s story. Authenticity lies in openly expressing your brand’s history and values. Engage with your audience: Actively listen to your customers. Respond to their concerns and genuinely engage with them. Here email marketing can be great. Authenticity is conveyed through meaningful interactions that demonstrate your brand’s commitment to customer satisfaction. Be transparent: Share your brand’s processes, ingredients and sourcing methods. Show some behind-the-scenes work. Consumers appreciate brands that are open and honest about their practices, reinforcing the sense of authenticity. Avoid excessive self-promotion: Avoid bombarding customers with self-congratulatory messages. Instead focus on delivering value and building trust. Authenticity is best conveyed through actions rather than empty words. The Danger of Inauthenticity: Avoiding the “Authenticity Trap” While authenticity can be a powerful asset, it is essential for brands to avoid the trap of . inauthenticity Trying to appear authentic without genuinely embodying those qualities can lead to severe consequences. The risks include loss of trust and customer loyalty. One notable example of a global brand that suffered due to a perceived inauthenticity is Pepsi. In 2017, the company released an protesting against police brutality. The ad was widely criticized for being tone-deaf and exploitative. It was seen as an attempt by Pepsi to capitalize on a serious social issue without genuine concern. ad campaign featuring Kendall Jenner "Clearly we missed the mark, and we apologize," Pepsi said after facing blazing backlash. Brands must navigate the fine line between authenticity and inauthenticity by staying true to their core values and consistently delivering on their promises. Customers are increasingly adept at detecting inauthenticity, and brands that fail to live up to their stated values risk damaging their reputation. Conclusion The selection of “Authentic” as Merriam-Webster’s Word of the Year highlights the growing in our society. importance of transparency and genuine connection For crypto projects and brands, embracing authenticity is not just a trend but a . By cultivating authenticity you can build trust, attract more investors and create a loyal following. Whether it’s through , the power of authenticity should not be underestimated. strategic imperative genuine storytelling, transparent practices or meaningful customer engagement As we navigate an ever-changing world, let us embrace the power of authenticity. Being authentic has the potential to reshape our relationships, our brands and our communications. It is time to create connections that transcend language and cultural barriers. How authentic is your crypto project or brand? Imagine making the “word of the year” a guiding light for us all. Let me know your thoughts in the comments. Also published here

Merriam-Webster Crowns ‘Authentic’ Word of the Year: What Does It Mean for Crypto and Brands?

Stories, News & Mentions about AUTHENTICUS

Authenticus’s Stories on HackerNoon