Contents
All 60 chapters of How Identity Works, in 5 parts. 769,316 words.
Every chapter
- 1The Oldest ProblemYou will be able to explain, in one sentence at a dinner table, why a village needs no identity system and a city cannot survive without one.52 min
- 2Identifier, Attribute, ClaimYou will be able to look at any field in a database table and say whether it is an identifier, an attribute, or a claim, and defend the answer.52 min
- 3Identification, Authentication, AuthorisationYou will be able to take any sentence containing the word "auth" and say which of three completely different operations the speaker meant.52 min
- 4The RecordYou will be able to look at any table that holds people and say, for every column, whether it belongs to the record's own identity, to what the record…54 min
- 5Names Are Not IdentifiersYou will be able to take any form that asks for a name and say, for each box on it, which group of human beings that box excludes.52 min
- 6The DocumentYou will be able to state in one sentence what a passport proves and what it does not, and defend that sentence against a fraud investigator.52 min
- 7EnrolmentYou will be able to name the three separate steps hidden inside the phrase "identity proofing" — resolution, validation and verification — and say what…51 min
- 8Matching and DeduplicationYou will be able to explain to somebody with no technical training why two records that clearly describe one person can fail an exact comparison, and why…57 min
- 9The RegisterYou will be able to say what a register actually is — an authority's written assertion that a stated fact is true — and explain why its value comes from…56 min
- 10Anonymity, Pseudonymity and LinkabilityYou will be able to place any system on a four-rung ladder — identified, pseudonymous, unlinkable, anonymous — and say what would have to change to move…61 min
- 11What Goes Wrong When Identity Is WrongYou will be able to name the four shapes an identity error takes — a record matched to the wrong person, a record that fails to match the right one, one…53 min
- 12The Three FactorsYou will be able to state the three classical factors in the words the standards use, and place almost any authenticator you meet into one of them.52 min
- 13The Shared SecretYou will be able to explain what a password is, a secret two parties both hold, and why that one decision causes every problem that follows.52 min
- 14Storing a PasswordYou will be able to explain why storing a password in readable form, and storing it in a form you can decrypt, are the same mistake wearing two different…56 min
- 15Cracking a PasswordYou will be able to describe exactly what an attacker holds the morning after a password database is stolen, and why that is a different problem from…43 min
- 16Password Rules Are Mostly WrongYou will be able to name the exact document, appendix and year that turned "one capital, one number, one symbol" from a rough estimate into a worldwide…58 min
- 17The One-Time CodeYou will be able to explain to someone who has never heard the term what a one-time code is, and why a number that works once is worth far more than a…56 min
- 18The Second Factor That Is NotYou will be able to explain why most of the second factors a person is offered stop one attacker and not another, and name which attacker each one stops.60 min
- 19BiometricsYou will be able to explain what a fingerprint reader actually stores, why it is not a picture, and what is in the small file it keeps instead.60 min
- 20Face and VoiceYou will be able to explain why "does this face match this one record" and "does this face appear anywhere in this database" are two different machines…63 min
- 21The Key PairYou will be able to explain, to somebody with no mathematics, why a lock can be made public without making the thing it protects public, and why that…62 min
- 22Challenge and ResponseYou will be able to explain to somebody with no technical background why a system that asks the same question every time can be defeated by a tape…61 min
- 23Passkeys and WebAuthnYou will be able to explain to somebody with no technical background why a passkey cannot be stolen from a website's database, and why that is a…59 min
- 24RecoveryYou will be able to explain to somebody with no technical background why the strongest login in the world can be worth nothing, and why the thing that…63 min
- 25Why You Cannot Trust a Key You Were HandedYou will be able to state the introduction problem in one sentence and explain why no amount of cryptography solves it on its own.52 min
- 26The CertificateYou will be able to say, in one sentence, what a certificate is and what it is not, without using the word "trust" as a hiding place.50 min
- 27The ChainYou will be able to explain why a website certificate is almost never signed directly by anything your computer trusts, and why that is deliberate.52 min
- 28The Certificate AuthorityYou will be able to say in one sentence what a certificate authority actually sells, and why the answer is not "encryption".52 min
- 29The HandshakeYou will be able to state the three things a TLS connection promises you — secrecy, tamper-detection, and knowing who is at the far end — and say which…52 min
- 30RevocationYou will be able to say in one sentence why a certificate must sometimes be cancelled before it expires, and name the three situations that force it.52 min
- 31Certificate TransparencyYou will be able to explain without jargon why the owner of a domain name once had no way at all of learning that a certificate had been issued for it.52 min
- 32The Digital SignatureYou will be able to state, in one sentence and without hedging, the only thing a verified digital signature proves, and name the three assumptions that…59 min
- 33What a Signature Means in LawYou will be able to name the three legal tiers of electronic signature under European law, state the exact test each one has to pass, and say which of…61 min
- 34Time, and Signatures That Must Outlive Their KeysYou will be able to name the three mechanisms by which a good signature becomes unverifiable over time, and say which one is a problem of cryptography…52 min
- 35When a Certificate Authority FailsYou will be able to state, in one sentence a non-technical colleague can repeat, why the security of every website on the internet is bounded by the…58 min
- 36The SessionYou will be able to state precisely what it means to say that HTTP is stateless, quote the sentence in the specification that says it, and explain why…52 min
- 37The CookieYou will be able to read any Set-Cookie header aloud and say what every attribute on it does and which attack it was added to stop.50 min
- 38The TokenYou will be able to state, in the words of the specification, what makes a token a bearer token, and say what that property costs you.52 min
- 39JSON Web TokensYou will be able to take any JSON Web Token, split it correctly, decode both halves by hand without a tool, and say what every field in it means.52 min
- 40OAuth 2.0You will be able to name the four roles OAuth defines, say which real piece of software plays each one in a system you use, and spot the common mistake…52 min
- 41OpenID ConnectYou will be able to explain why a system built only on OAuth 2.0 cannot tell you who a user is, and name the exact step where the reasoning breaks.56 min
- 42SAML and the EnterpriseYou will be able to name the four layers of SAML — assertions, protocols, bindings and profiles — and say which OASIS document defines each one.55 min
- 43Single Sign-On and FederationYou will be able to say exactly where single sign-on ends and federation begins, and name the boundary that separates them.58 min
- 44DirectoriesYou will be able to explain why a directory is a tree rather than a table, and name the 1988 standard that fixed its shape.60 min
- 45Provisioning and the LifecycleYou will be able to name the three events every identity system must handle — joiner, mover, leaver — and say which of the three nearly every…53 min
- 46Deciding What You May DoYou will be able to state the difference between authentication and authorization in one sentence, and say precisely why the second question is the…61 min
- 47Machines Have Identities TooYou will be able to explain why a running program needs an identity of its own, and name the four things that identity can be bound to.60 min
- 48How Sure Are YouYou will be able to explain why one "security level" cannot describe identity confidence, and name the three things it tries to compress.53 min
- 49Know Your CustomerYou will be able to explain why a bank asks for your documents, and name the international body whose rules made it do so.52 min
- 50A Billion People and One NumberYou will be able to say exactly what an Aadhaar number is, what it legally is not, and describe the enrolment process step by step.52 min
- 51Europe's WalletYou will be able to explain what the European Union has legislated, naming the regulation, its date, and the single obligation it places on every member…52 min
- 52Britain's ApproachYou will be able to explain what the Identity Cards Act 2006 actually created, name the register at its centre, and say precisely how and when it was…52 min
- 53Credentials You CarryYou will be able to describe the three-party model of issuer, holder and verifier, and say precisely which arrow in the old two-party model it removes.52 min
- 54Proving How Old You AreYou will be able to define age verification, age estimation, age inference and age assurance exactly as the law and the standards use them, and cite the…54 min
- 55Identity and Privacy LawYou will be able to say exactly what makes a piece of information personal data under Article 4(1) of the General Data Protection Regulation, apply the…65 min
- 56The Right Not to Be IdentifiedYou will be able to explain why the cost of identifying a person, rather than the law about it, was the thing that used to limit surveillance, and what…67 min
- 57When Identity Is StolenYou will be able to place any real fraud case into one of four categories - account takeover, new-account fraud, synthetic identity fraud, or first-party…60 min
- 58Breaches That Taught Us SomethingYou will be able to narrate the 2015 OPM intrusions in order, name the two intruders that investigators labelled X1 and X2, and explain why the…60 min
- 59Designing an Identity SystemYou will be able to list the eleven decisions that fix the shape of any identity system, put them in the order that makes each one cheapest to get right,…66 min
- 60What Breaks and What It CostsYou will be able to name the five ways an identity system fails - false accept, false reject, exclusion, leak and lock-out - define each one in a single…66 min