July 2023 Summaries

Logan Gore's article details the process undertaken by Stytch to automate the generation of their backend SDKs from protobuf specifications, aiming to produce code that appears "humanlike" and is easier for external developers to use and debug. The project evolved from a hackathon idea into a comprehensive solution that employs Python to build abstract syntax trees (ASTs) from JSON specs, addressing numerous edge cases such as utility files and nested sub-products, to ensure consistency across SDKs. The code generation process leverages both templating and tree-walking techniques, culminating in a hybrid model that allows for efficient updates and extension to new languages. This approach significantly reduces the manual effort required from Stytch's developers, while maintaining up-to-date and consistent SDKs for their clients, showcasing the utility of internal rules enforcement and code translation to streamline SDK maintenance and expansion.

The blog post explores the intriguing connection between compiler theory and authentication, specifically in the context of maintaining client libraries for APIs like Stytch. It highlights the challenges of managing SDKs across multiple languages, emphasizing issues such as strong typing, compatibility, and mapping complex data structures. To address these challenges, Stytch considered using compiler theory principles to transpile API definitions into client code, thereby reducing human error and improving maintainability. The post chronicles the journey from the initial use of a templating system for generating API clients to experimenting with a protobuf transpiler using awk and sed. Although this approach was initially successful, it proved too complex for production use, leading the team to consider a more robust solution involving an AST-based transpiler. The article serves as an insightful primer for engineers dealing with API management and client library maintenance, offering a glimpse into innovative problem-solving approaches at Stytch.

In the pursuit of robust information security practices, Stytch has achieved ISO 27001 certification, underscoring its commitment to safeguarding sensitive information and enhancing trust with clients. ISO 27001 is an internationally recognized standard for information security management systems (ISMS) that requires companies to identify risks, implement security controls, and continuously improve processes. The certification process involves extensive preparation, including scoping an ISMS, conducting risk assessments, documenting systems, and performing internal audits before an external auditor evaluates compliance. Achieving and maintaining ISO 27001 certification not only ensures enhanced information security but also offers a competitive advantage, regulatory compliance, and increased customer trust. Stytch's journey involved defining the scope early, emphasizing thorough documentation, and prioritizing continual education to ensure the ISMS remains effective and aligned with evolving cyber threats.

Password cracking presents a significant cybersecurity threat, exploiting the weakest link in the security chain—traditional passwords. The Stytch Team discusses various password cracking techniques, such as brute force, password spraying, credential stuffing, dictionary attacks, and phishing, to highlight the vulnerabilities of passwords. They emphasize that most of these attacks exploit predictable patterns, easily guessable passwords, and poor security practices, leading to data breaches that are often preventable. While some methods focus on gaining access through trial and error, others like phishing rely on social engineering to trick users into revealing their credentials. The text also suggests strategies to mitigate these threats, including implementing strong password policies, utilizing password managers, leveraging multi-factor authentication, and transitioning to passwordless authentication solutions to ultimately enhance security and protect sensitive data.

The blog post, part of a series on mobile biometric authentication, explores the complexities and challenges associated with implementing mobile biometrics within the Android ecosystem, specifically focusing on the Android Keystore. It highlights the pitfalls and best practices necessary for secure biometric implementation, emphasizing the importance of result-based architecture over event-based architecture for enhanced security. The Android ecosystem's diverse and historically unregulated nature poses unique challenges, especially regarding cryptographic key management and the reliability of the Android Keystore. The post underscores the need for developers to be well-informed and make intentional choices about biometric security, advocating for the use of the UserAuthenticationRequired flag in key generation to enforce stronger security measures. It also details the use of industry-standard cryptographic libraries like BouncyCastle and Tink to manage encryption and decryption processes, while acknowledging the potential unreliability of the Keystore on some devices. Ultimately, the post encourages developers to weigh security risks against user experience and provides insights into building secure mobile biometric solutions, offering Stytch's SDKs as a safe-by-default option to simplify the integration of biometric authentication into applications.