Machine Identity / Identifiers

• SPIFFE/SPIRE (⭐2.5k) - 🆓 A CNCF framework issuing short-lived, cryptographically-verifiable identities (SVIDs) to workloads across heterogeneous environments.

• NanoMDM (⭐645) - 🆓 Minimalist Apple MDM server and library to enroll and manage the identity of Apple devices, inspired by MicroMDM.

OAuth2 & OpenID / Other tools

• obligator (⭐838) - 🆓 Simple and opinionated OpenID Connect server designed for self-hosters. Single static binary with flat-file or SQLite storage.

Trust & Safety / Threat Intelligence

• OSINT Stuff Tool Collection (⭐8.8k) - “A collection of several hundred online tools for OSINT”: domain, IP, email, username and social-network lookups useful for unmasking fraud and abuse.

• Maigret (⭐37k) - 🆓 “Collect a dossier on a person by username from 3000+ sites”, useful for account enumeration and unmasking fraud or abuse.

Blocklists / Emails

• check-if-email-exists - 💸 Verify an email address's reachability over SMTP without sending anything, catching typos, disposable domains and role accounts at signup.

Cryptography

• Real World Crypto Symposium - Aims to bring together cryptography researchers with developers, focusing on uses in real-world environments such as the Internet, the cloud, and embedded devices.

Zero-trust Network / Identifiers

• What is BeyondCorp? What is Identity-Aware Proxy? - More companies add extra layers of VPNs, firewalls, restrictions and constraints, resulting in a terrible experience and a slight security gain. There's a better way.

Password-less auth / Security key

• Getting started with security keys - A practical guide to stay safe online and prevent phishing with FIDO2, WebAuthn and security keys.

Password-less auth / JWT

• JWT, JWS and JWE for Not So Dummies! - A signed JWT is known as a JWS (JSON Web Signature). In fact a JWT does not exist itself — either it has to be a JWS or a JWE (JSON Web Encryption). Its like an abstract class — the JWS and JWE are the concrete implementations.

Authorization / Policy models

• GCP's IAM syntax is better than AWS's - The minutiae of permission design in GCP improves the developer's experience.

Authorization / ReBAC frameworks

• Zanzibar: Google's Consistent, Global Authorization System - Scales to trillions of access control lists and millions of authorization requests per second to support services used by billions of people. It has maintained 95th-percentile latency of less than 10 milliseconds and availability of greater than 99.999% over 3 years of production use. Other bits not in the paper. Zanzibar Academy is a site dedicated to explaining how Zanzibar works.

Authorization / Macaroons

• Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud - Google's original paper.

OAuth2 & OpenID / Other tools

• Descope - Drag and drop your auth. Add authentication, user management, and authorization to your app with a few lines of code.

Secret Management / Hardware Security Module (HSM)

• HSM: What they are and why it's likely that you've (indirectly) used one today - Really basic overview of HSM usages.

Competitive Analysis / GDPR

• 163 AWS services explained in one line each - Help makes sense of their huge service catalog. In the same spirit: AWS In Plain English.

Multi-factor auth / SMS-based

• AT&T rep handed control of his cellphone account to a hacker

Password-less auth / JWT

• Hardcoded secrets, unverified tokens, and other common JWT mistakes - A good recap of all JWT pitfalls.

Authorization / Macaroons

• Google's Macaroons in Five Minutes or Less - If I'm given a Macaroon that authorizes me to perform some action(s) under certain restrictions, I can non-interactively build a second Macaroon with stricter restrictions that I can then give to you.

SAML / Other tools

• The Difficulties of SAML Single Logout - On the technical and UX issues of single logout implementations.

Secret Management / Other tools

• trufflehog - 💸 Searches through Git repositories for high entropy strings and secrets, digging deep into commit history.

Blocklists / Captcha

• How Radix trees made blocking IPs 5000 times faster - Radix trees might come handy to speed-up IP blocklists.

Blocklists / Hostnames and Subdomains

• AMF site blocklist - Official French denylist of money-related fraud sites.

UX/UI / GDPR

• Conversion Optimization - A collection of tactics to increase the chance of users finishing the account creation funnel.

Authorization / RBAC frameworks

• FerrisKey (⭐698) - 🆓 Self-hosted, open-source, RBAC system written in Rust.

Password-less auth / Public-Key Infrastructure (PKI)

• JA4+ (⭐2.1k) - 💸 A suite of network fingerprinting methods to facilitate threat-hunting and analysis.

OAuth2 & OpenID / Other tools

• Hydra (⭐18k) - 💸 Open-source OIDC & OAuth2 Server Provider.

• Keycloak (⭐36k) - 🆓 Open-source Identity and Access Management. Supports OIDC, OAuth 2 and SAML 2, LDAP and AD directories, password policies.

• authentik (⭐25k) - 💸 Open-source Identity Provider similar to Keycloak.

Secret Management / Other tools

• HashiCorp Vault (⭐36k) - 💸 Secure, store and tightly control access to tokens, passwords, certificates, encryption keys.

Secret Management / Hardware Security Module (HSM)

• Keystone (⭐536) - 🆓 Open-source project for building trusted execution environments (TEE) with secure hardware enclaves, based on the RISC-V architecture.

Trust & Safety / Threat Intelligence

• SpiderFoot (⭐195) - 🆓 An open source intelligence (OSINT) automation tool. It integrates with just about every data source available and uses a range of methods for data analysis, making that data easy to navigate.

• Confusable Homoglyphs - 🆓 Homoglyphs is a common phishing trick.

Trust & Safety / Captcha

• Anubis (⭐22k) - 🆓 An open-source solution to protect upstream resources from scraper bots.

Blocklists / Hostnames and Subdomains

• The Public Suffix List (⭐2.9k) - 🆓 Mozilla's registry of public suffixes, under which Internet users can (or historically could) directly register names.

Competitive Analysis / GDPR

• AWS Security, Identity & Compliance announcements - The source of all new features added to the IAM perimeter.

Overview

• IAM is hard. It's really hard. - “Overly permissive AWS IAM policies that allowed s3:GetObject to * (all) resources”, led to $80 million fine for Capital One. The only reason why you can't overlook IAM as a business owner.

OAuth2 & OpenID / Other tools

• OAuth 2.0 Security Best Current Practice - “Updates and extends the OAuth 2.0 Security Threat Model to incorporate practical experiences gathered since OAuth 2.0 was published and covers new threats relevant due to the broader application”.

Security

• Mitigating Cloud Vulnerabilities - “This document divides cloud vulnerabilities into four classes (misconfiguration, poor access control, shared tenancy vulnerabilities, and supply chain vulnerabilities)”.

Multi-factor auth / SMS-based

• Hackers Hit Twitter C.E.O. Jack Dorsey in a 'SIM Swap.' You're at Risk, Too.

Authorization / Policy models

• In Search For a Perfect Access Control System - The historical origins of authorization schemes. Hints at the future of sharing, trust and delegation between different teams and organizations.

Trust & Safety / User Identity

• How Uber Got Lost - “To limit "friction" Uber allowed riders to sign up without requiring them to provide identity beyond an email — easily faked — or a phone number. (…) Vehicles were stolen and burned; drivers were assaulted, robbed and occasionally murdered. The company stuck with the low-friction sign-up system, even as violence increased.”

Privacy / Anonymization

• The False Allure of Hashing for Anonymization - Hashing is not sufficient for anonymization no. But still it is good enough for pseudonymization (which is allowed by the GDPR).

OAuth2 & OpenID / Other tools

• Awesome OpenID Connect (⭐122) - A curated list of providers, services, libraries, and resources for OpenID Connect.

Zero-trust Network / Identifiers

• heimdall (⭐257) - 🆓 A cloud-native, identity-aware proxy and policy enforcement point that orchestrates authentication and authorization systems via versatile rules, supporting protocol-agnostic identity propagation.

Authorization / ReBAC frameworks

• Permify (⭐5.9k) - 💸 Another open-source authorization as a service inspired by Google Zanzibar, and see how it compares to other Zanzibar-inspired tools.

Authorization / AWS policy tools

• An AWS IAM Security Tooling Reference - A comprehensive list of (maintained) tools for AWS IAM.

Authorization / Other tools

• Gubernator (⭐170) - 🆓 High performance rate-limiting micro-service and library.

OAuth2 & OpenID / Other tools

• How to Implement a Secure Central Authentication Service in Six Steps - Got multiple legacy systems to merge with their own login methods and accounts? Here is how to merge all that mess by the way of OIDC.

Trust & Safety / User Identity

• Facebook Dangerous Individuals and Organizations List - Some groups and content are illegal in some juridictions. This is an example of a blocklist.

Authorization / Policy models

• Authorization Academy - An in-depth, vendor-agnostic treatment of authorization that emphasizes mental models. This guide shows the reader how to think about their authorization needs in order to make good decisions about their authorization architecture and model.

Password-less auth / WebAuthn

• Clearing up some misconceptions about Passkeys - Or why passkeys are not worse than passwords.

Secret Management / Other tools

• Infisical (⭐29k) - 💸 An alternative to HashiCorp Vault.

SAML / Other tools

• SAML vs. OAuth - “OAuth is a protocol for authorization: it ensures Bob goes to the right parking lot. In contrast, SAML is a protocol for authentication, or allowing Bob to get past the guardhouse.”

Trust & Safety / Fraud

• After Car2Go eased its background checks, 75 of its vehicles were stolen in one day. - Why background check are sometimes necessary.

Trust & Safety / Captcha

• You (probably) don't need ReCAPTCHA - Starts with a rant on how the service is a privacy nightmare and is tedious UI-wise, then list alternatives.

Multi-factor auth / Identifiers

• A Comparative Long-Term Study of Fallback Authentication - Key take-away: “schemes based on email and SMS are more usable. Mechanisms based on designated trustees and personal knowledge questions, on the other hand, fall short, both in terms of convenience and efficiency.”

Authorization / AWS policy tools

• IAMbic (⭐304) - 💸 GitOps for IAM. The Terraform of Cloud IAM. IAMbic is a multi-cloud identity and access management (IAM) control plane that centralizes and simplifies cloud access and permissions. It maintains an eventually consistent, human-readable, bi-directional representation of IAM in version control.

OAuth2 & OpenID / Other tools

• PKCE Explained - “PKCE is used to provide one more security layer to the authorization code flow in OAuth and OpenID Connect.”

Competitive Analysis / GDPR

• Best-of Digital Identity (⭐190) - Ranking, popularity and activity status of open-source digital identity projects.

Cryptography / Identifiers

• RFC #4122: UUID - Security Considerations - “Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access)”. UUIDs are designed to be unique, not to be random or unpredictable: do not use UUIDs as a secret.

• Awesome Identifiers - A benchmark of all identifier formats.

• Awesome GUID (⭐21) - Funny take on the global aspect of unique identifiers.

Authorization / ABAC frameworks

• Open Policy Agent (⭐12k) - 🆓 An open-source general-purpose decision engine to create and enforce ABAC policies.

Authorization / ReBAC frameworks

• SpiceDB (⭐7k) - 💸 An open source database system for managing security-critical application permissions inspired by Zanzibar.

• Topaz (⭐1.4k) - 💸 An open-source project which combines the policy-as-code and decision logging of OPA with a Zanzibar-modeled directory.

Authorization / AWS policy tools

• AWS IAM Roles, a tale of unnecessary complexity - The history of fast-growing AWS explains how the current scheme came to be, and how it compares to GCP's resource hierarchy.

Trust & Safety / User Identity

• Ballerine (⭐2.4k) - 💸 An open-source infrastructure for user identity and risk management.

Multi-factor auth / Identifiers

• SMS Multifactor Authentication in Antarctica - Doesn't work because there are no cellphone towers at stations in Antarctica.

Password-less auth / SMS-based

• Magic Links – Are they Actually Outdated? - What are magic links, their origin, pros and cons.

SAML / Other tools

• The SSO Wall of Shame - A documented rant on the excessive pricing practiced by SaaS providers to activate SSO on their product. The author's point is, as a core security feature, SSO should be reasonably priced and not part of an exclusive tier.

OAuth2 & OpenID / Other tools

• ZITADEL (⭐15k) - 💸 An Open-Source solution built with Go and Angular to manage all your systems, users and service accounts together with their roles and external identities. ZITADEL provides you with OIDC, OAuth 2.0, login & register flows, passwordless and MFA authentication. All this is built on top of eventsourcing in combination with CQRS to provide a great audit trail.

Authorization / ReBAC frameworks

• Open Policy Administration Layer (⭐5.5k) - 💸 Open Source administration layer for OPA, detecting changes to both policy and policy data in realtime and pushing live updates to OPA agents. OPAL brings open-policy up to the speed needed by live applications.

Multi-factor auth / Identifiers

• Your Pa$$word doesn't matter - Same conclusion as above from Microsoft: “Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.”

Secret Management / Hardware Security Module (HSM)

• Everybody be cool, this is a robbery! - A case study of vulnerability and exploitability of a HSM (in French, sorry).

Trust & Safety / Moderation

• You either die an MVP or live long enough to build content moderation - “You can think about the solution space for this problem by considering three dimensions: cost, accuracy and speed. And two approaches: human review and machine review. Humans are great in one of these dimensions: accuracy. The downside is that humans are expensive and slow. Machines, or robots, are great at the other two dimensions: cost and speed - they're much cheaper and faster. But the goal is to find a robot solution that is also sufficiently accurate for your needs.”

Blocklists / Hostnames and Subdomains

• Subdomain denylists: #1, #2 (⭐43), #3 (⭐166).

Password-less auth / Public-Key Infrastructure (PKI)

• PKI for busy people - Quick overview of the important stuff.

Multi-factor auth / Identifiers

• Kanidm (⭐5.4k) - 🆓 Simple, secure and fast identity management platform.

Account Management

• UserFrosting (⭐1.7k) - 🆓 Modern PHP user login and management framework.

Multi-factor auth / Identifiers

• Authelia (⭐29k) - 🆓 Open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for your applications via a web portal.

Authentication / Identifiers

• A Child's Garden of Inter-Service Authentication Schemes - In the same spirit as above, but this time at the service level.

Authorization / Policy models

• Why Authorization is Hard - Because it needs multiple tradeoffs on Enforcement which is required in so many places, on Decision architecture to split business logic from authorization logic, and on Modeling to balance power and complexity.

• The never-ending product requirements of user authorization - How a simple authorization model based on roles is not enough and gets complicated fast due to product packaging, data locality, enterprise organizations and compliance.

Authorization / Policy models

• RBAC like it was meant to be - How we got from DAC (unix permissions, secret URL), to MAC (DRM, MFA, 2FA, SELinux), to RBAC. Details how the latter allows for better modeling of policies, ACLs, users and groups.

• The Case for Granular Permissions - Discuss the limitations of RBAC and how ABAC (Attribute-Based Access Control) addresses them.

Authorization / RBAC frameworks

• Cerbos (⭐4.6k) - 💸 An authorization endpoint to write context-aware access control policies.

Authentication / Identifiers

• API Tokens: A Tedious Survey - An overview and comparison of all token-based authentication schemes for end-user APIs.

SAML / Other tools

• SAML is insecure by design - Not only weird, SAML is also insecure by design, as it relies on signatures based on XML canonicalization, not XML byte stream. Which means you can exploit XML parser/encoder differences.

Competitive Analysis / GDPR

• DigitalOcean Accounts changelog - All the latest accounts updates on DO.

Multi-factor auth / Identifiers

• 2FA is missing a key feature - “When my 2FA code is entered incorrectly I'd like to know about it”.

UX/UI / GDPR

• 11 Tips for Better Signup / Login UX - Some basic tips on the login form.

Authorization / RBAC frameworks

• Biscuit - Merges concepts from cookies, JWTs, macaroons and Open Policy Agent. “It provide a logic language based on Datalog to write authorization policies. It can store data, like JWT, or small conditions like Macaroons, but it is also able to represent more complex rules like role-based access control, delegation, hierarchies.”

Password-less auth / SMS-based

• An argument for passwordless - Passwords are not the be-all and end-all of user authentication. This article tries to tell you why.

Password-based auth / Identifiers

• Password Storage Cheat Sheet - The only way to slow down offline attacks is by carefully choosing hash algorithms that are as resource intensive as possible.

OAuth2 & OpenID / Other tools

• Hidden OAuth attack vectors - How to identify and exploit some of the key vulnerabilities found in OAuth 2.0 authentication mechanisms.

Authorization / AWS policy tools

• IAM Floyd (⭐572) - 🆓 AWS IAM policy statement generator with fluent interface. Helps with creating type safe IAM policies and writing more restrictive/secure statements by offering conditions and ARN generation via IntelliSense. Available for Node.js, Python, .Net and Java.

Overview

• The EnterpriseReady SaaS Feature Guides - The majority of the features making B2B users happy will be implemented by the IAM perimeter.

• IAM Is The Real Cloud Lock-In - A little click-baity, but author admit that “It depends on how much you trust them to 1. Stay in business; 2. Not jack up your prices; 3. Not deprecate services out from under you; 4. Provide more value to you in business acceleration than they take away in flexibility.”

Security

• Enterprise Information Security - Mozilla's security and access guidelines.

• Open guide to AWS Security and IAM (⭐36k)

Account Management

• As a user, I want… - A meta-critic of account management, in which features expected by the business clash with real user needs, in the form of user stories written by a fictional project manager.

• Things end users care about but programmers don't - In the same spirit as above, but broader: all the little things we overlook as developers but users really care about. In the top of that list lies account-centric features, diverse integration and import/export tools. I.e. all the enterprise customers needs to cover.

• Separate the account, user and login/auth details - Sound advice to lay down the foundation of a future-proof IAM API.

• Identity Beyond Usernames - On the concept of usernames as identifiers, and the complexities introduced when unicode characters meets uniqueness requirements.

Cryptography

• Cryptographic Right Answers - An up to date set of recommendations for developers who are not cryptography engineers. There's even a shorter summary available.

• An Overview of Cryptography - “This paper has two major purposes. The first is to define some of the terms and concepts behind basic cryptographic methods, and to offer a way to compare the myriad cryptographic schemes in use today. The second is to provide some real examples of cryptography in use today.”

• Papers we love: Cryptography (⭐109k) - Foundational papers of cryptography.

• Lifetimes of cryptographic hash functions - “If you are using compare-by-hash to generate addresses for data that can be supplied by malicious users, you should have a plan to migrate to a new hash every few years”.

Cryptography / Identifiers

• Security Recommendations for Any Device that Depends on Randomly-Generated Numbers - “The phrase 'random number generator' should be parsed as follows: It is a random generator of numbers. It is not a generator of random numbers.”

Zero-trust Network / Identifiers

• BeyondCorp: A New Approach to Enterprise Security - Quick overview of Google's Zero-trust Network initiative.

• oathkeeper (⭐3.6k) - 💸 Identity & Access Proxy and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP requests. Inspired by the BeyondCorp / Zero Trust white paper.

• Pomerium (⭐5k) - 💸 An identity-aware proxy that enables secure access to internal applications.

Authentication / Identifiers

• Scaling backend authentication at Facebook - How-to in a nutshell: 1. Small root of trust; 2. TLS isn't enough; 3. Certificate-based tokens; 4. Crypto Auth Tokens (CATs). See the slides for more details.

Password-based auth / Identifiers

• The new NIST password guidance - A summary of NIST Special Publication 800-63B covering new password complexity guidelines.

• Password expiration is dead - Recent scientific research calls into question the value of many long-standing password-security practices such as password expiration policies, and points instead to better alternatives such as enforcing banned-password lists and MFA.

• Banks, Arbitrary Password Restrictions and Why They Don't Matter - “Arbitrary low limits on length and character composition are bad. They look bad, they lead to negative speculation about security posture and they break tools like password managers.”

• Password Manager Resources (⭐4.8k) - 🆓 A collection of password rules, change URLs and quirks by sites.

• How to change the hashing scheme of already hashed user's passwords - Good news: you're not stuck with a legacy password saving scheme. Here is a trick to transparently upgrade to stronger hashing algorithm.

Multi-factor auth / Identifiers

• Breaking Password Dependencies: Challenges in the Final Mile at Microsoft - The primary source of account hacks is password spraying (on legacy auth like SMTP, IMAP, POP, etc.), second is replay attack. Takeaway: password are insecure, use and enforce MFA.

• Beyond Passwords: 2FA, U2F and Google Advanced Protection - An excellent walk-trough over all these technologies.

• Secrets, Lies, and Account Recovery: Lessons from the Use of Personal Knowledge Questions at Google - “Our analysis confirms that secret questions generally offer a security level that is far lower than user-chosen passwords. (…) Surprisingly, we found that a significant cause of this insecurity is that users often don't answer truthfully. (…) On the usability side, we show that secret answers have surprisingly poor memorability”.

• How effective is basic account hygiene at preventing hijacking - Google security team's data shows 2FA blocks 100% of automated bot hacks.

• Attacking Google Authenticator - Probably on the verge of paranoia, but might be a reason to rate limit 2FA validation attempts.

• Compromising online accounts by cracking voicemail systems - Or why you should not rely on automated phone calls as a method to reach the user and reset passwords, 2FA or for any kind of verification. Not unlike SMS-based 2FA, it is currently insecure and can be compromised by the way of its weakest link: voicemail systems.

• Getting 2FA Right in 2019 - On the UX aspects of 2FA.

Multi-factor auth / SMS-based

• SMS 2FA auth is deprecated by NIST - NIST has said that 2FA via SMS is bad and awful since 2016.

• SMS: The most popular and least secure 2FA method

• Is SMS 2FA Secure? No. - Definitive research project demonstrating successful attempts at SIM swapping.

Password-less auth / WebAuthn

• WebAuthn guide - Introduce WebAuthn as a standard supported by all major browsers, and allowing “servers to register and authenticate users using public key cryptography instead of a password”.

Password-less auth / Security key

• Webauthn and security keys - Describe how authentication works with security keys, details the protocols, and how they articulates with WebAuthn. Key takeaway: “There is no way to create a U2F key with webauthn however. (…) So complete the transition to webauthn of your login process first, then transition registration.”

• OpenSK (⭐3.4k) - 🆓 Open-source implementation for security keys written in Rust that supports both FIDO U2F and FIDO2 standards.

• YubiKey Guide (⭐12k) - Guide to using YubiKey as a SmartCard for storing GPG encryption, signing and authentication keys, which can also be used for SSH. Many of the principles in this document are applicable to other smart card devices.

Password-less auth / Public-Key Infrastructure (PKI)

• Everything you should know about certificates and PKI but are too afraid to ask - PKI lets you define a system cryptographically. It's universal and vendor neutral.

• lemur - 🆓 Acts as a broker between CAs and environments, providing a central portal for developers to issue TLS certificates with 'sane' defaults.

• CFSSL (⭐9.5k) - 🆓 A swiss army knife for PKI/TLS by CloudFlare. Command line tool and an HTTP API server for signing, verifying, and bundling TLS certificates.

Password-less auth / JWT

• Introduction to JSON Web Tokens - Get up to speed on JWT with this article.

• Learn how to use JWT for Authentication (⭐4.2k) - Learn how to use JWT to secure your web app.

• Using JSON Web Tokens as API Keys - Compared to API keys, JWTs offers granular security, homogeneous auth architecture, decentralized issuance, OAuth2 compliance, debuggability, expiration control, device management.

• Adding JSON Web Token API Keys to a DenyList - On token invalidation.

• Stop using JWT for sessions - And why your "solution" doesn't work, because stateless JWT tokens cannot be invalidated or updated. They will introduce either size issues or security issues depending on where you store them. Stateful JWT tokens are functionally the same as session cookies, but without the battle-tested and well-reviewed implementations or client support.

• JOSE is a Bad Standard That Everyone Should Avoid - The standards are either completely broken or complex minefields hard to navigate.

• JWT.io - Allows you to decode, verify and generate JWT.

Authorization / Policy models

• Semantic-based Automated Reasoning for AWS Access Policies using SMT - Zelkova is how AWS does it. This system perform symbolic analysis of IAM policies, and solve the reachability of resources according user's rights and access constraints. Also see the higher-level introduction given at re:inforce 2019.

Authorization / ABAC frameworks

• Keto (⭐5.4k) - 💸 Policy decision point. It uses a set of access control policies, similar to AWS policies, in order to determine whether a subject is authorized to perform a certain action on a resource.

• Ladon (⭐2.5k) - 💸 Access control library, inspired by AWS.

Authorization / AWS policy tools

• Become an AWS IAM Policy Ninja - “In my nearly 5 years at Amazon, I carve out a little time each day, each week to look through the forums, customer tickets to try to find out where people are having trouble.”

• Policy Sentry (⭐2.2k) - 🆓 Writing security-conscious IAM Policies by hand can be very tedious and inefficient. Policy Sentry helps users to create least-privilege policies in a matter of seconds.

Authorization / Macaroons

• Google paper's author compares Macaroons and JWTs - As a consumer/verifier of macaroons, they allow you (through third-party caveats) to defer some authorization decisions to someone else. JWTs don't.

OAuth2 & OpenID / Other tools

• An Illustrated Guide to OAuth and OpenID Connect - Explain how these standards work using simplified illustrations.

• OAuth 2 Simplified - A reference article describing the protocol in simplified format to help developers and service providers implement it.

• OAuth 2.0 and OpenID Connect (in plain English) - Starts with an historical context on how these standards came to be, clears up the inaccuracies in the vocabulary, then details the protocols and its pitfalls to make it less intimidating.

• OAuth in one picture - A nice summary card.

• Open-Sourcing BuzzFeed's SSO Experience - OAuth2-friendly adaptation of the Central Authentication Service (CAS) protocol. You'll find there good OAuth user flow diagrams.

SAML / Other tools

• The Beer Drinker's Guide to SAML - SAML is arcane at times. A another analogy might helps get more sense out of it.

Secret Management / Other tools

• Secret at Scale at Netflix - Solution based on blind signatures. See the slides.

• High Availability in Google's Internal KMS - Not GCP's KMS, but the one at the core of their infrastructure. See the slides.

Secret Management / Hardware Security Module (HSM)

• Tidbits on AWS Cloud HSM hardware - AWS CloudHSM Classic is backed by SafeNet's Luna HSM, current CloudHSM rely on Cavium's Nitrox, which allows for partitionable "virtual HSMs".

• Project Oak (⭐1.5k) - 🆓 A specification and a reference implementation for the secure transfer, storage and processing of data.

Trust & Safety / Hardware Security Module (HSM)

• Trust and safety 101 - A great introduction on the domain and its responsibilities.

• What the Heck is Trust and Safety? - A couple of real use-case to demonstrate the role of a TnS team.

• Awesome List of Billing and Payments: Fraud links (⭐1.3k) - Section dedicated to fraud management for billing and payment, from our sister repository.

Trust & Safety / User Identity

• The Laws of Identity - Is this paper aims at identity metasystem, its laws still provides great insights at smaller scale, especially the first law: to always allow user control and ask for consent to earn trust.

• A Comparison of Personal Name Matching: Techniques and Practical Issues - Customer name matching has lots of application, from account deduplication to fraud monitoring.

• Statistically Likely Usernames (⭐1.4k) - 🆓 Wordlists for creating statistically likely usernames for use in username-enumeration, simulated password-attacks and other security testing tasks.

• Sherlock (⭐91k) - 🆓 Hunt down social media accounts by username across social networks.

Trust & Safety / Fraud

• Investigation into the Unusual Signups - A really detailed analysis of suspicious contributor signups on OpenStreetMap. This beautiful and high-level report demonstrating an orchestrated and directed campaign might serve as a template for fraud reports.

• Gephi (⭐6.6k) - 🆓 Open-source platform for visualizing and manipulating large graphs.

Trust & Safety / Moderation

• Still Logged In: What AR and VR Can Learn from MMOs - “If you host an online community, where people can harm another person: you are on the hook. And if you can't afford to be on the hook, don't host an online community”.

Trust & Safety / Threat Intelligence

• Awesome Threat Intelligence (⭐11k) - “A concise definition of Threat Intelligence: evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard.”

• Standards related to Threat Intelligence - Open standards, tools and methodologies to support threat intelligence analysis.

• MISP taxonomies and classification - Tags to organize information on “threat intelligence including cyber security indicators, financial fraud or counter-terrorism information.”

• Browser Fingerprinting: A survey - Fingerprints can be used as a source of signals to identify bots and fraudsters.

• The challenges of file formats - At one point you will let users upload files in your system. Here is a corpus of suspicious media files (⭐1.6k) that can be leveraged by scammers =to bypass security or fool users.

• SecLists (⭐73k) - 🆓 Collection of multiple types of lists used during security assessments, collected in one place. List types include usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and many more.

• PhishingKitTracker (⭐103) - 🆓 CSV database of email addresses used by threat actor in phishing kits.

• PhoneInfoga (⭐18k) - 🆓 Tools to scan phone numbers using only free resources. The goal is to first gather standard information such as country, area, carrier and line type on any international phone numbers with a very good accuracy. Then search for footprints on search engines to try to find the VoIP provider or identify the owner.

Trust & Safety / Captcha

• Awesome Captcha (⭐1.4k) - Reference all open-source captcha libraries, integration, alternatives and cracking tools.

• reCaptcha - 💸 Still an effective, economical and quick solution when your company can't afford to have a dedicated team to fight bots and spammers at internet scale.

Blocklists / Captcha

• Bloom Filter - Perfect for this use-case, as bloom filters are designed to quickly check if an element is not in a (large) set. Variations of bloom filters exist for specific data types.

Blocklists / Hostnames and Subdomains

• hosts - 🆓 Consolidates reputable hosts files, and merges them into a unified hosts file with duplicates removed.

• nextdns/metadata - 💸 Extensive collection of list for security, privacy and parental control.

• Country IP Blocks (⭐927) - 🆓 CIDR country-level IP data, straight from the Regional Internet Registries, updated hourly.

• common-domain-prefix-suffix-list.tsv - Top-5000 most common domain prefix/suffix list.

• xkeyscorerules100.txt - NSA's XKeyscore matching rules for TOR and other anonymity preserving tools.

Blocklists / Emails

• Burner email providers (⭐1.2k) - 🆓 A list of temporary email providers. And its derivative Python module (⭐5.5k).

• MailChecker (⭐1.9k) - 💸 Cross-language temporary (disposable/throwaway) email detection library.

• Temporary Email Address Domains - A list of domains for disposable and temporary email addresses. Useful for filtering your email list to increase open rates (sending email to these domains likely will not be opened).

• gman - 🆓 “A Ruby gem to check if the owner of a given email address or website is working for THE MAN (a.k.a verifies government domains).” Good resource to hunt for potential government customers in your user base.

Blocklists / Reserved IDs

• General List of Reserved Words - This is a general list of words you may want to consider reserving, in a system where users can pick any name.

• Hostnames and usernames to reserve - List of all the names that should be restricted from registration in automated systems.

Blocklists / Profanity

• List of Dirty, Naughty, Obscene, and Otherwise Bad Words (⭐3.4k) - 🆓 Profanity blocklist from Shutterstock.

• profanity-check - 🆓 Uses a linear SVM model trained on 200k human-labeled samples of clean and profane text strings.

Privacy / Profanity

• Paper we love: Privacy (⭐109k) - A collection of scientific studies of schemes providing privacy by design.

• Have I been Pwned? - Data breach index.

• Automated security testing for Software Developers - Most privacy breaches were allowed by known vulnerabilities in third-party dependencies. Here is how to detect them by the way of CI/CD.

• Email marketing regulations around the world (⭐469) - 🆓 As the world becomes increasingly connected, the email marketing regulation landscape becomes more and more complex.

Privacy / Anonymization

• Four cents to deanonymize: Companies reverse hashed email addresses - “Hashed email addresses can be easily reversed and linked to an individual”.

• Why differential privacy is awesome - Explain the intuition behind differential privacy, a theoretical framework which allow sharing of aggregated data without compromising confidentiality. See follow-up articles with more details and practical aspects.

Privacy / GDPR

• GDPR Developer Guide (⭐359) - Best practices for developers.

• GDPR – A Practical guide for Developers - A one-page summary of the above.

• Dark Patterns after the GDPR - This paper demonstrates that, because of the lack of GDPR law enforcements, dark patterns and implied consent are ubiquitous.

• GDPR Enforcement Tracker - List of GDPR fines and penalties.

UX/UI / GDPR

• The 2020 State of SaaS Product Onboarding - Covers all the important facets of user onboarding.

• User Onboarding Teardowns - A huge list of deconstructed first-time user signups.

• Discover UI Design Decisions Of Leading Companies - From Leaked Screenshots & A/B Tests.

• Don't get clever with login forms - Create login forms that are simple, linkable, predictable, and play nicely with password managers.

• Why are the username and password on two different pages? - To support both SSO and password-based login. Now if breaking the login funnel in 2 steps is too infuriating to users, solve this as Dropbox does: an AJAX request when you enter your username.

• HTML attributes to improve your users' two factor authentication experience - “In this post we will look at the humble <input> element and the HTML attributes that will help speed up our users' two factor authentication experience”.

• Remove password masking - Summarizes the results from an academic study investigating the impact removing password masking has on consumer trust.

• For anybody who thinks "I could build that in a weekend," this is how Slack decides to send a notification - Notifications are hard. Really hard.

Competitive Analysis / GDPR

• GCP IAM release notes - Also of note: Identity Platform, Resource Manager, Key Management Service/HSM, Access Context Manager, Identity-Aware Proxy, Data Loss Prevention and Security Scanner.

• Unofficial Weekly Google Cloud Platform newsletter - Relevant keywords: IAM and Security.

History / GDPR

• cryptoanarchy.wiki - Cypherpunks overlaps with security. This wiki compiles information about the movement, its history and the people/events of note.

Password-based auth / Identifiers

• Practical Recommendations for Stronger, More Usable Passwords - This study recommend the association of: blocklist checks against commonly leaked passwords, password policies without character-class requirements, minimum-strength policies.

Account Management

• Kratos (⭐14k) - 💸 User login, user registration, 2FA and profile management.

Trust & Safety / Moderation

• The despair and darkness of people will get to you - Moderation of huge social networks is performed by an army of outsourced subcontractors. These people are exposed to the worst and generally ends up with PTSD.

• The Cleaners - A documentary on these teams of underpaid people removing posts and deleting accounts.

SAML / Other tools

• What's the Difference Between OAuth, OpenID Connect, and SAML? - Identity is hard. Another take on the different protocol is always welcome to help makes sense of it all.

SAML / Other tools

• The Difference Between SAML 2.0 and OAuth 2.0 - “Even though SAML was actually designed to be widely applicable, its contemporary usage is typically shifted towards enterprise SSO scenarios. On the other hand, OAuth was designed for use with applications on the Internet, especially for delegated authorisation.”

Privacy / GDPR

• GDPR Tracker - Europe's reference site.

Trust & Safety / Captcha

• Anti-captcha - 💸 Captchas solving service.