Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up for free
Knock! Knock! Who's There?
Markus H
September 10, 2021
Programming
0
33
Knock! Knock! Who's There?
My talk from the Snakeoil Acadamy / PyCon AU 2021
Markus H
September 10, 2021
Tweet
Share
More Decks by Markus H
See All by Markus H
An Introduction To Kubernetes ☸
markush
0
53
Writing Safe Database Migrations (DjangoCon Europe 2021)
markush
0
7k
A Pony On The Move: How Migrations Work In Django 🐎
markush
0
6.4k
All Hands on Deck — Handling Security Issues
markush
0
6.6k
Logging Rethought 2: The Actions of Frank Taylor Jr. (PyCon UK 2019)
markush
0
27
Logging Rethought 2: The Actions of Frank Taylor Jr. (PyCon Australia 2019)
markush
1
130
Logging Rethought 2: The Actions of Frank Taylor Jr. (DjangoCon Europe 2019)
markush
0
6.5k
Less Obvious Things To Do With Django's ORM (PyCon SK 2019)
markush
0
6.6k
Oh, I Found a Security Issue (Python.Pizza.Berlin 🐍🍕🐻)
markush
0
6.4k
Other Decks in Programming
See All in Programming
httputil.ReverseProxy でもリトライがしたい
toga4
0
120
あなたの会社の古いシステム、なんとかしませんか?~システム刷新から考えるDX化への道筋とバリエーション~/webinar20220420-grapecity
grapecity_dev
0
140
バンドル最適化マニアクス at tfconf
mizchi
4
2.3k
NieR Re[in]carnationにおけるUnityアニメーション活用術
applibot
1
850
Micro Frontends with Module Federation: Beyond the Basics @jax2022
manfredsteyer
PRO
1
290
未経験QAの私が、よきQA(Question Asker) になっていく物語
atamaplus
0
340
【Qiita Night】新卒エンジニアによるSwift6与太予想
eiji127
0
180
SPA/MPA 議論の俯瞰と 現代における設計のポイント - #tfcon 2022 フロントエンド設計
ahomu
3
1.9k
tfcon2022_Web3Dひとめぐり.pdf
emadurandal
0
1.1k
UI State Modeling 어떤게 좋을까?
laco2951
1
240
「新卒だけ」じゃない!学び直しを支えるミクシィの技術研修を紹介
mixi_engineers
PRO
0
180
Airflow1=>Airflow2へのupgrade 事例紹介
reizist
0
120
Featured
See All Featured
Streamline your AJAX requests with AmplifyJS and jQuery
dougneiner
125
8.5k
Optimizing for Happiness
mojombo
365
63k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
38
12k
Building Better People: How to give real-time feedback that sticks.
wjessup
343
17k
Atom: Resistance is Futile
akmur
255
20k
Navigating Team Friction
lara
175
11k
Imperfection Machines: The Place of Print at Facebook
scottboms
253
11k
The Success of Rails: Ensuring Growth for the Next 100 Years
eileencodes
3
530
Why Our Code Smells
bkeepers
PRO
324
54k
Creatively Recalculating Your Daily Design Routine
revolveconf
207
10k
The Cult of Friendly URLs
andyhume
68
4.7k
Mobile First: as difficult as doing things right
swwweet
212
7.5k
Transcript
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Knock! Knock!
Who’s There?
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Hi, I’m
Markus Holtermann
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Hi, I’m
Markus Holtermann W e're hiring
Snakeoil Academy 2021 • PyCon AU • @m_holtermann The Beginning
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Marian Vanhaeren/Francesco
d'Errico
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Sketch by
Sydney Parkinson (1784) Portrait by Louis John Steele (1891)
Snakeoil Academy 2021 • PyCon AU • @m_holtermann
Snakeoil Academy 2021 • PyCon AU • @m_holtermann
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Snakeoil Academy
2021 • PyCon AU • @m_holtermann # scrypt >>> import base64, hashlib, secrets >>> salt = secrets.token_bytes(16) >>> password = b"my p4ssw0rd!"0 >>> hash = hashlib.scrypt(password, salt=salt, n=2**14, r=8, p=1, maxmem=0, dklen=64).hex() >>> base64.b64encode(hash).decode('ascii').strip() '8ln2EySYjOZRSLaIzjvaOaQQfGshxdH7vxptMyWo9zWJbM1glu0K8LbZf56QH+GefdiCP079IErDhVw UmPsRzQ==' # argon2 >>> from argon2 import PasswordHasher >>> hasher = PasswordHasher() >>> hasher.hash(password) '$argon2id$v=19$m=102400,t=2,p=8$d85wm2Zga0oSPiK6Uxm4zA$03Kc+n7lf3SpL+VYSbMnfA'
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Basic &
Digest Authentication RFC 2069, RFC 2617, RFC 7617
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Snakeoil Academy
2021 • PyCon AU • @m_holtermann WWW-Authenticate: Basic realm="PyConAU 2021", charset="UTF-8" Authorization: Basic Y3VybHlib2k6c25ha2VvaWwuYWNhZGVteQ== Server replies with: Client sends:
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Token Authentication
Authorization: Token soM3r4nDOmByt3s
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Bearer Authentication
RFC 6750 Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIy MDIxIiwibmFtZSI6ImN1cmx5Ym9pIn0.W8-ixoAkGMe5Gs7c5 DLXFO0fCLypn2xhNExulY5iSEY
Snakeoil Academy 2021 • PyCon AU • @m_holtermann JWT https://groups.google.com/g/django-developers
/c/6oS9R2GwO4k/m/Rep92xfsAwAJ
Snakeoil Academy 2021 • PyCon AU • @m_holtermann JWT
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Snakeoil Academy
2021 • PyCon AU • @m_holtermann >>> import base64, json, hmac >>> key = b"snakeoil.academy" >>> data = {"uid": 123, "name": "curlyboi"} >>> payload = base64.b64encode(json.dumps(data).encode()) >>> mac = hmac.new(key, payload, digestmod="sha256") >>> payload + b"." + base64.b64encode(mac.digest()) >>> ret b'eyJ1aWQiOiAxMjMsICJuYW1lIjogImN1cmx5Ym9pIn0=.oJPUWmHZGJIXPCna082U8/SMseX+hZ5av Kjgt1TKovg=' >>> signed, signature = ret.split(b".", 1) >>> hmac.compare_digest(signature, ... base64.b64encode(hmac.new(key, signed, digestmod="sha256").digest())) True >>> json.loads(base64.b64decode(signed)) {'uid': 123, 'name': 'curlyboi'}
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Mutual Authentication
Snakeoil Academy 2021 • PyCon AU • @m_holtermann FIDO2 /
WebAuthn https://www.w3.org/TR/webauthn-2/
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Snakeoil Academy
2021 • PyCon AU • @m_holtermann
Snakeoil Academy 2021 • PyCon AU • @m_holtermann I! I
who? Identification and Authentication!
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Thank you!
Snakeoil Academy 2021 • PyCon AU • @m_holtermann Sources •
https://www.newscientist.com/article/dn9392-ancient-beads-imply-culture-older-than-we-thought/ • https://rss.onlinelibrary.wiley.com/doi/pdf/10.1111/j.1740-9713.2013.00706.x • https://www.smithsonianmag.com/history/tattoos-144038580/ • https://www.trulioo.com/blog/infographic-the-history-of-id-verification • https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/