May 2023 Summaries

In the blog, readers learn how to enhance the JWT response payload by adding custom attributes such as the user's email using Descope, a no-code platform for creating authentication flows. By leveraging Descope Flows, users can quickly create authentication journeys with a simple drag-and-drop interface. The process involves setting up a Descope account, creating a project, and using the "Custom Claims" action to add custom attributes to the JWT by specifying key-value pairs, like setting the key to "eml" for email and the value to "user.email." Once configured, these custom claims can be integrated into the flow with easy-to-make connections, and the resulting JWT can be inspected using the Descope Getting Started Wizard. The blog also encourages experimentation with various custom fields beyond email, highlighting the flexibility and ease of using Descope Flows for authentication needs.

In an interview series called "Meet a Descoper," Descope highlights app builders, including employees and users, by exploring their daily work and career insights. The latest interview features Itai Hanski, a developer, entrepreneur, and musician, who shares his journey from an accidental entry into computer science to his current role at Descope. Itai emphasizes the importance of diverse experiences, understanding customer perspectives, and the value of mentorship. He recounts his past roles, including a significant tenure at healthy.io, and his decision to join Descope for new challenges. He also discusses his passion for music and the parallels between personal growth in hobbies and professional development. Itai advises new developers to seek mentorship early in their careers and later challenge themselves independently to foster personal growth.

Password spraying is a widespread cyberattack technique that involves attempting a small set of commonly used passwords across numerous accounts, targeting weak or easily guessable passwords within organizations or online platforms. Unlike targeted attacks, password spraying focuses on volume and is particularly threatening to businesses with shared password practices, often aiming at cloud services, email accounts, and remote access systems. It is distinguished from brute force attacks, which target a single account with numerous password attempts, and from credential stuffing, which uses stolen credentials from data breaches. To counter these attacks, robust password policies, multi-factor authentication, anomaly detection, and adopting passwordless authentication methods are recommended, with tools like Intrusion Detection and Prevention Systems (IDPS) and Security Information and Event Management (SIEM) systems playing a crucial role in monitoring and mitigation efforts. Descope's passwordless authentication solutions further bolster security by eliminating the reliance on traditional passwords, thereby reducing the risk of password-based vulnerabilities.

Passkeys are emerging as a strong, convenient alternative to traditional passwords, offering a passwordless authentication method that enhances security and user experience. Unlike passwords, which are susceptible to theft and require user management, passkeys use asymmetric cryptography, with private keys stored on users' devices and public keys on servers, making them virtually unphishable. They incorporate multi-factor authentication (MFA) in a single step by using biometrics to unlock the private key on the device, emphasizing privacy as biometric data never leaves the device. Built on widely-supported standards like FIDO2 and WebAuthn, passkeys are gaining cross-industry backing from major tech companies such as Google, Apple, and Microsoft. While still in the early stages, passkeys are poised to replace passwords, reducing the burden on developers and IT teams by preventing server-side authentication complexities. Descope offers developers tools to easily implement passkey authentication into their applications, facilitating a secure and frictionless user experience.

Authentication protocols are essential tools in the digital age, serving as gatekeepers to verify online identities and secure access to protected information and services. They dictate how users (claimants) and authenticators (verifiers) communicate through processes that involve encryption, hashing, and digital signatures to protect sensitive data. Popular protocols include Kerberos, which uses secret-key cryptography for secure communication; Challenge-Response, which involves generating and responding to secure codes; OAuth/OpenID Connect, which facilitates sharing resources and authentication without revealing personal details; SAML, which employs XML for identity exchange and is favored for Single Sign-On (SSO) in enterprise contexts; FIDO2/WebAuthn, which supports passwordless authentication using registered devices or security keys; and TOTP, which generates time-sensitive, one-time passwords for enhanced security. When choosing an authentication protocol, developers should consider factors such as security levels, integration capabilities, scalability, and the desired user authentication experience, often opting for multi-factor authentication for added security. Tools like Descope can simplify the implementation of these protocols by offering a user-friendly platform to integrate secure login features into applications.

Biometric authentication has become increasingly popular, with more than half of users employing it daily, resulting in a variety of methods available for verifying identities. Common physiological methods include facial recognition, fingerprint scanning, iris/retina recognition, voice recognition, and hand geometry, each with its own strengths and limitations in terms of security, accuracy, usability, and cost. Emerging technologies like DNA, gait, and vein recognition, although still niche and expensive, offer promising future applications. When selecting a biometric method, factors such as security, accuracy, user experience, and cost must be considered. FIDO authentication standards have been widely adopted, offering secure and seamless authentication by keeping biometric data on the user's device. Companies like Descope provide tools to easily integrate biometric authentication into apps, enhancing security and user experience without requiring extensive technical expertise.