Viewing profile — omgitstom

I'm unsure why the distinction matters that was brought up in the post. It really comes down to what do you need to support, and how much weight you can swing. Are you a small time…

My dad passed away with dementia in 2019, spent a lot of time in nursing homes and also making decisions about the care of my father. I actually got to see this first hand with his…

Being in the authentication/authorization space for a while, this couldn't be truer. If OAuth 2.0 was a compelling differentiator from your API standpoint, they are doing it wrong.…

I love how Ajit keeps saying 'it does not happen' where traffic is limited or blocked. It was limited, we saw this by Comcast with Netflix back in 2014. This is what we are getting…

TL;DR Twitter gave the police information about the phone number which registered the account that sent the seizure-triggering gif AT&T gave the police information that is was a Tr…

Bad is relative, it is bad compared to other more secure methods. But if you can't guarantee that your users have a smartphone, SMS is still a needed option.

They support 2FA through SMS / TOTP / U2F. Yes, if most of their customers use GA / etc it is free, but that isn't their only option... If they implemented a provider, they will al…

I'm sure Dropbox is going to get a lot of flak for this. 2FA based on the provider that they use may not have been cheap. Authy is $0.09 an auth, if you integrate with Twilio, you …

Here you go: https://cl.ly/3q3d293k2N3X

Head of Product @ Stormpath It doesn't really matter where you start, as long as you can relate to the product and its customers. I've seen great PM from every beginning. My beginn…

Auction information is here: https://github.com/theshadowbrokers/EQGRP-AUCTION

This question is a little vague. My assumption is you mean a REST API. This is a must watch and encapsulates good design and theory: https://www.youtube.com/watch?v=hdSrT4yjS1g Goo…

"The U.S. Marshals Service (USMS) offers property for sale to the public which has been forfeited under laws enforced or administered by the United States Department of Justice, it…

"Sleeping animals are incredibly vulnerable to attacks, with no obvious benefit to make up for it — at best, they waste precious hours that could be used finding food or seducing a…

Acquisitions are complicated in tax law. There was a good write-up about this in Forbes about a year ago that your question reminded me of: http://www.forbes.com/sites/anthonynitti…

It isn't about the vesting periods, it is about the exercise period. Vesting periods are fine in most cases. The exercise period is usually 90 days, if you leave a company. What ha…

All of these points are sound. There are some benefits of using a JWT over a session identifier, though. And I think that most of these were covered in the comments of your first p…

Always happy to get feedback. Again, this article was written back in 2014, and will be updated. In regards to your advice about id_tokens and access_tokens. Usually, what I've see…

Definitely not pedantic! Believe it or not, JOSE was still a draft when this blog post was released into the wild.

Thanks, Evan. these are all good points, I'm surprised to see this on HN since it is an old article I wrote. In regards to the replay attacks, if you are using JWTs in a 3 party se…

Every company will want a PM that understands their vertical. This isn't as simple as researching, a PM should never interview without using the product and using as many of the co…

What has happened with web storage since 2015-09-09 that makes their recommendations out of date?

As a developer, I feel like I have more control over mitigating CSRF then XSS. But where I have more issues is that OWASP clearly advises not to use web storage for identities: + A…