SlideShare a Scribd company logo
1 of 50
Download to read offline
zen and the art of edge authentication
Dora Militaru
gh: @doramatadora
x: @doramilitaru
Dora Militaru
gh: @doramatadora
x: @doramilitaru
adjective • informal • /zen/
Relaxed and unconcerned about things beyond one's control.
zen
noun • hot topic • /edʒ kəmˈpjuː.tɪŋ/
Bringing computation and data as close as possible to
where it is needed.*
edge [computing] large-scale, coordination free.
.distributed systems ✨
noun • hot topic • /edʒ kəmˈpjuː.tɪŋ/
Bringing computation and data as close as possible to
where it is needed.*
* while retaining control of the environment
edge [computing] large-scale, coordination free.
.distributed systems ✨
at the network’s edge.
noun • /ɑːˌθen.t̬əˈkeɪ.ʃən/
The process of verifying the identity of a person or device.
authentication secure.
login flows ✨
…not very zen
OAuth • OIDC • identity provider • RBAC • SSO • certificates •
authorization • MFA • SAML • tokens • SSL/TLS • tokens • X.509
• FIDO • SCRAM • identity management • LDAP • encryption •
JWT • keys • KMS • credential stuffing • XSS • MitM • session
hijacking • phishing • data breach • brute force • SQL injection
authentication secure.
login flows 🚒 🔥.
owasp.org/API-Security/editions/2023/en/0x11-t10
2023: most critical web application security risks
Broken Object Level Authorization
Broken Authentication
devchat.edgecompute.app
FIDO credential
multi-device
FIDO credential
multi-device
discoverable WebAuthn
key pair
private key
public key
secure communication
data protection
key pair
private key
public key
encryption decryption
data
confidentiality
key pair
private key
public key
verifying signing
data
authenticity + integrity
key pair
󰞂 󰥡
private key
public key
key pair
󰞂 󰥡
private key
public key
cipher text
plain text encryption plain text
decryption
key pairs
󰞂 󰥡
private key
signing
public key
verification
private key
public key
encryption cipher text
plain text plain text
decryption
key pair
private key
public key
encryption decryption
verifying signing
key pair
private key
public key
secret
photo by 五玄土 ORIENTO on Unsplash
WebAuthn
user client server
relying party
authenticator
authentication
registration
registration
user client server (relying party) authenticator
🙏 register
using passkey
registration
user client server (RP) authenticator
get registration
options
🙏 register
using passkey
options +
random challenge
{ R4n60M57r… }
user client server (RP) authenticator
get registration
options
🙏 register
using passkey
client
navigator.credentials.create( )
{ R4n60M… }
user server (RP) authenticator
client
verify user
navigator.credentials.create( )
{ R4n60M… }
user server (RP) authenticator
client
verify user
create key pair +
sign challenge
navigator.credentials.create( )
{ R4n60M… }
sig:R4n60M… credentialId
user server (RP) authenticator
user client server (RP) authenticator
sig:R4n60M…
credentialId
user client server (RP) authenticator
verify signature +
store public key &
credential
sig:R4n60M…
credentialId
user client server (RP) authenticator
verify signature +
store public key &
credential
passkey registered
🎉
sig:R4n60M…
credentialId
registration
authentication
user client server (RP) authenticator
get authentication
options
🙏 sign in
with passkey
options +
random challenge
{ o7Hr4N60m… }
user client server (RP) authenticator
verify user
sign challenge +
get credentials
sig:o7Hr… credentialId
navigator.credentials.get( )
{ o7Hr4N60m… }
user client server (RP) authenticator
signed in 🎉
sig:o7Hr…
credentialId
verify signature +
sign in
photo by Moja Msanii on Unsplash
p w n e d?
have u been
photo by Moja Msanii on Unsplash
p w n e d?
have u been
nope
no more
fast
secure
autonomous
distributed
user client server
relying party
authenticator
edge
compute
devchat.edgecompute.app
fastly
compute
313 Tbps
global edge
capacity
Dec 2023
1.8 trillion
requests served
daily
instant
global
deployment
Fastly
Compute
edge compute =
instant
global
deployment
Fastly
Compute
WebAssembly
(Wasm)
instant
global
deployment
<50μs
execution
start-up time
Fastly
Compute
WebAssembly
(Wasm)
instant
global
deployment
<50μs
execution
start-up time
Fastly
Compute
WebAssembly
(Wasm)
terraform github actions cli api
config
store
Fastly
Compute
kv
store
secret
store
real-time
messaging
Fanout
edge
state
Compute
KV Store backend system
origin
public keys
edge compute
& state store
Code + Passkey resources
zen-edge-auth.glitch.me
DevOps Exchange Chat
devchat.edgecompute.app
@doramilitaru fastly.com fastly.dev
thank you ❤
glitch.com

More Related Content

Similar to Zen & the art of Edge Authentication - Dora Militaru - DevOps Live London.pdf

Similar to Zen & the art of Edge Authentication - Dora Militaru - DevOps Live London.pdf (20)

What the Heck is OAuth and OpenID Connect? Connect.Tech 2017
What the Heck is OAuth and OpenID Connect? Connect.Tech 2017What the Heck is OAuth and OpenID Connect? Connect.Tech 2017
What the Heck is OAuth and OpenID Connect? Connect.Tech 2017
 
Catching Pitfalls in Authentication Implementations (Yuchen Zhou)
Catching Pitfalls in Authentication Implementations (Yuchen Zhou)Catching Pitfalls in Authentication Implementations (Yuchen Zhou)
Catching Pitfalls in Authentication Implementations (Yuchen Zhou)
 
3D PASSWORD
3D PASSWORD3D PASSWORD
3D PASSWORD
 
In headers / Padlocks / Certificate authorities / site seals we trust
In headers / Padlocks / Certificate authorities / site seals we trustIn headers / Padlocks / Certificate authorities / site seals we trust
In headers / Padlocks / Certificate authorities / site seals we trust
 
Secure socket layer
Secure socket layerSecure socket layer
Secure socket layer
 
Design and Analyze Secure Networked Systems - 3
Design and Analyze Secure Networked Systems - 3Design and Analyze Secure Networked Systems - 3
Design and Analyze Secure Networked Systems - 3
 
Digital Identity
Digital IdentityDigital Identity
Digital Identity
 
Security Slicing for Auditing XML, XPath, and SQL Injection Vulnerabilities
Security Slicing for Auditing XML, XPath, and SQL Injection VulnerabilitiesSecurity Slicing for Auditing XML, XPath, and SQL Injection Vulnerabilities
Security Slicing for Auditing XML, XPath, and SQL Injection Vulnerabilities
 
The web beyond "usernames & passwords"
The web beyond "usernames & passwords"The web beyond "usernames & passwords"
The web beyond "usernames & passwords"
 
Stateless Microservice Security via JWT and MicroProfile - Mexico
Stateless Microservice Security via JWT and MicroProfile - MexicoStateless Microservice Security via JWT and MicroProfile - Mexico
Stateless Microservice Security via JWT and MicroProfile - Mexico
 
Stateless Microservice Security via JWT and MicroProfile - ES
Stateless Microservice Security via JWT and MicroProfile - ES Stateless Microservice Security via JWT and MicroProfile - ES
Stateless Microservice Security via JWT and MicroProfile - ES
 
Stateless Microservice Security via JWT and MicroProfile - Guatemala
Stateless Microservice Security via JWT and MicroProfile - GuatemalaStateless Microservice Security via JWT and MicroProfile - Guatemala
Stateless Microservice Security via JWT and MicroProfile - Guatemala
 
Current standard implementations for security/authorization in distributed c...
Current standard implementations for security/authorization in distributed c...Current standard implementations for security/authorization in distributed c...
Current standard implementations for security/authorization in distributed c...
 
SSL/TLS Introduction with Practical Examples Including Wireshark Captures
SSL/TLS Introduction with Practical Examples Including Wireshark CapturesSSL/TLS Introduction with Practical Examples Including Wireshark Captures
SSL/TLS Introduction with Practical Examples Including Wireshark Captures
 
Which Came First: The Phish or the Opportunity to Defend Against It
Which Came First: The Phish or the Opportunity to Defend Against ItWhich Came First: The Phish or the Opportunity to Defend Against It
Which Came First: The Phish or the Opportunity to Defend Against It
 
Digital signature & certificate
Digital signature & certificateDigital signature & certificate
Digital signature & certificate
 
REST Service Authetication with TLS & JWTs
REST Service Authetication with TLS & JWTsREST Service Authetication with TLS & JWTs
REST Service Authetication with TLS & JWTs
 
Security and Your Salesforce Org
Security and Your Salesforce OrgSecurity and Your Salesforce Org
Security and Your Salesforce Org
 
BlueHat v18 || May i see your credentials, please
BlueHat v18 || May i see your credentials, pleaseBlueHat v18 || May i see your credentials, please
BlueHat v18 || May i see your credentials, please
 
Authentication services
Authentication servicesAuthentication services
Authentication services
 

Recently uploaded

Recently uploaded (20)

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptxIOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx
 
Enterprise Knowledge Graphs - Data Summit 2024
Enterprise Knowledge Graphs - Data Summit 2024Enterprise Knowledge Graphs - Data Summit 2024
Enterprise Knowledge Graphs - Data Summit 2024
 
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
Integrating Telephony Systems with Salesforce: Insights and Considerations, B...
 
Introduction to Open Source RAG and RAG Evaluation
Introduction to Open Source RAG and RAG EvaluationIntroduction to Open Source RAG and RAG Evaluation
Introduction to Open Source RAG and RAG Evaluation
 
Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...
Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...
Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...
 
Top 10 Symfony Development Companies 2024
Top 10 Symfony Development Companies 2024Top 10 Symfony Development Companies 2024
Top 10 Symfony Development Companies 2024
 
Intro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджераIntro in Product Management - Коротко про професію продакт менеджера
Intro in Product Management - Коротко про професію продакт менеджера
 
Connecting the Dots in Product Design at KAYAK
Connecting the Dots in Product Design at KAYAKConnecting the Dots in Product Design at KAYAK
Connecting the Dots in Product Design at KAYAK
 
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
Choosing the Right FDO Deployment Model for Your Application _ Geoffrey at In...
 
The Metaverse: Are We There Yet?
The  Metaverse:    Are   We  There  Yet?The  Metaverse:    Are   We  There  Yet?
The Metaverse: Are We There Yet?
 
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdfWhere to Learn More About FDO _ Richard at FIDO Alliance.pdf
Where to Learn More About FDO _ Richard at FIDO Alliance.pdf
 
Buy Epson EcoTank L3210 Colour Printer Online.pdf
Buy Epson EcoTank L3210 Colour Printer Online.pdfBuy Epson EcoTank L3210 Colour Printer Online.pdf
Buy Epson EcoTank L3210 Colour Printer Online.pdf
 
PLAI - Acceleration Program for Generative A.I. Startups
PLAI - Acceleration Program for Generative A.I. StartupsPLAI - Acceleration Program for Generative A.I. Startups
PLAI - Acceleration Program for Generative A.I. Startups
 
Syngulon - Selection technology May 2024.pdf
Syngulon - Selection technology May 2024.pdfSyngulon - Selection technology May 2024.pdf
Syngulon - Selection technology May 2024.pdf
 
IoT Analytics Company Presentation May 2024
IoT Analytics Company Presentation May 2024IoT Analytics Company Presentation May 2024
IoT Analytics Company Presentation May 2024
 
What's New in Teams Calling, Meetings and Devices April 2024
What's New in Teams Calling, Meetings and Devices April 2024What's New in Teams Calling, Meetings and Devices April 2024
What's New in Teams Calling, Meetings and Devices April 2024
 
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdfHow Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
How Red Hat Uses FDO in Device Lifecycle _ Costin and Vitaliy at Red Hat.pdf
 
Speed Wins: From Kafka to APIs in Minutes
Speed Wins: From Kafka to APIs in MinutesSpeed Wins: From Kafka to APIs in Minutes
Speed Wins: From Kafka to APIs in Minutes
 
Extensible Python: Robustness through Addition - PyCon 2024
Extensible Python: Robustness through Addition - PyCon 2024Extensible Python: Robustness through Addition - PyCon 2024
Extensible Python: Robustness through Addition - PyCon 2024
 
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
FDO for Camera, Sensor and Networking Device – Commercial Solutions from VinC...
 

Zen & the art of Edge Authentication - Dora Militaru - DevOps Live London.pdf