Security Engineering · Cluster
Authentication
Password handling, MFA, and session security.
- 01 Salted Password Hashing and the Cost of a Verification How salts, iteration counts, and memory hardness set the price of an offline guess, and why the stored record must carry its own parameters.
- 02 Constant-Time Comparison in Credential Checks Why byte-wise equality on secrets leaks prefix information through timing, how the standard constant-time primitives are built, and which comparisons in a login path actually need them.
- 03 How Cookie Attributes Bound a Session Credential What the Domain, Path, Secure, HttpOnly, and SameSite attributes actually constrain, which of them are enforced by the browser versus the server, and where the scope model leaks.
- 04 Session Fixation and Why Identifiers Must Rotate How an attacker who chooses a session identifier inherits the victim's authenticated session, and which state transitions require a fresh identifier to break the link.
- 05 Opaque Session Identifiers Versus Signed Tokens How server-side session lookup and self-contained signed tokens differ in revocation, verification cost, and failure behaviour when a key or a datastore goes away.
- 06 TOTP Time Steps, Drift Windows, and Code Replay How a shared secret and a counter quantised to thirty seconds produce a six-digit code, why the verifier searches a window, and what makes a used code reusable.
- 07 The WebAuthn Ceremony and Origin Binding What the browser signs, what the relying party verifies, and why the challenge and the origin check are what make the credential resistant to relay and phishing.
- 08 Bounding Online Guessing with Rate Limits and Lockouts How attempt budgets, keyed counters, and timing equalisation set an upper bound on password guessing, and which limit designs convert a defence into a denial of service.
- 09 Augmented PAKE and What a Stolen Verifier Costs an Attacker How a password-authenticated key exchange lets a server store a value that is not a password hash, and why that changes the economics of a database breach without making weak passwords safe.
- 10 Factor Independence and the Paths That Bypass MFA Why the assurance of two factors is the product of their independence, and how fallback, enrolment, and recovery paths quietly collapse a two-factor system to one.