Proving It Is You
Secrets, codes, bodies and keys. From the first password in 1961 to the passkey in your phone, and what each of them actually proves.
The Three Factors
You will be able to state the three classical factors in the words the standards use, and place almost any authenticator you meet into one of them.
11,994 words/52 min read13The Shared Secret
You will be able to explain what a password is, a secret two parties both hold, and why that one decision causes every problem that follows.
11,974 words/52 min read14Storing a Password
You will be able to explain why storing a password in readable form, and storing it in a form you can decrypt, are the same mistake wearing two different…
12,827 words/56 min read15Cracking a Password
You will be able to describe exactly what an attacker holds the morning after a password database is stolen, and why that is a different problem from…
9,986 words/43 min read16Password Rules Are Mostly Wrong
You will be able to name the exact document, appendix and year that turned "one capital, one number, one symbol" from a rough estimate into a worldwide…
13,406 words/58 min read17The One-Time Code
You will be able to explain to someone who has never heard the term what a one-time code is, and why a number that works once is worth far more than a…
12,820 words/56 min read18The Second Factor That Is Not
You will be able to explain why most of the second factors a person is offered stop one attacker and not another, and name which attacker each one stops.
13,854 words/60 min read19Biometrics
You will be able to explain what a fingerprint reader actually stores, why it is not a picture, and what is in the small file it keeps instead.
13,874 words/60 min read20Face and Voice
You will be able to explain why "does this face match this one record" and "does this face appear anywhere in this database" are two different machines…
14,380 words/63 min read21The Key Pair
You will be able to explain, to somebody with no mathematics, why a lock can be made public without making the thing it protects public, and why that…
14,288 words/62 min read22Challenge and Response
You will be able to explain to somebody with no technical background why a system that asks the same question every time can be defeated by a tape…
13,927 words/61 min read23Passkeys and WebAuthn
You will be able to explain to somebody with no technical background why a passkey cannot be stolen from a website's database, and why that is a…
13,655 words/59 min read24Recovery
You will be able to explain to somebody with no technical background why the strongest login in the world can be worth nothing, and why the thing that…
14,518 words/63 min read