Cheat Sheet

How Does the Internet Know It's You? A Deep Dive Into the Modern Authentication Landscape

8 core ideas from the full deep dive, condensed onto one page you can scan in two minutes.

#01

Fundamentals

The Four Concerns of Auth

—Identification, Authentication, Session, and Authorization are four separate concerns — conflating any two is how privilege-escalation and impersonation bugs happen.
—Identity is a noun (persistent); Authentication and Authorization are verbs, checked at different frequencies.
—Authorization must be re-evaluated on every request — permissions can change mid-session even when identity hasn't.

#02

Theory

Cryptographic Cost

—Argon2id/bcrypt are deliberately slow — memory-hardness, not just CPU delay, is what defeats GPU/ASIC brute force.
—Hashing is one-way (passwords); Encryption is two-way (secrets); Signing proves authenticity, not secrecy (JWTs).
—RSA verifies faster than ECDSA despite larger keys — why many high-throughput APIs still default to RS256.

Argon2id hash

~250–500 ms

RSA verify

~0.05 ms

#03

Stateful

Sessions & Cookies

—Server holds state; browser carries only an opaque session ID via an HttpOnly, Secure, SameSite=Strict cookie.
—Regenerate the session ID immediately after login to defend against session fixation.
—Instant revocation: delete the server-side record and access ends everywhere, immediately.

Best for

Server-rendered apps

Revocation

Instant

#04

Stateless

Tokens & JWTs

—A JWT's payload is encoded, not encrypted — anyone holding it can read every claim in plaintext.
—Short-lived access tokens (5–15 min) + rotating refresh tokens bound the blast radius of a leak.
—Stateless tokens can't truly be revoked before expiry — only a blocklist hybrid reintroduces a lookup.

Access token TTL

5–15 min

Revocation

Only via expiry

#05

OAuth / OIDC

Federated Identity

—OAuth 2.0 answers 'what can this app do'; OIDC answers 'who is this person'; SAML is the enterprise-legacy counterpart.
—PKCE prevents authorization-code interception on the same device — a real, historically-exploited vulnerability.
—Federating to one identity provider means that provider's outage can lock users out of every downstream service.

#06

Passwordless

Passkeys & WebAuthn

—The private key never leaves the device's secure hardware — only the public key is ever sent to the server.
—Origin-bound by design: a phishing look-alike domain cannot trigger a valid signature — structurally, not just harder.
—Immune to MFA fatigue attacks — there's no approval prompt to spam, no shared secret to phish.

#07

M2M

Machine & Service Identity

—mTLS, signed requests, and OAuth Client Credentials are the machine-to-machine equivalents of user login.
—IoT devices authenticate via per-device X.509 certs provisioned at manufacture — there's no username/password concept.
—AI agents should hold scoped, short-lived delegated tokens, never the human's real session or credentials.

#08

Defense

Threats & Decision Framework

—Credential stuffing attacks your users' memory, not your crypto — a % always match due to password reuse elsewhere.
—HttpOnly cookies close the XSS token-theft vector that localStorage-stored JWTs leave wide open.
—Match the mechanism to the scenario: passkeys for humans, short JWTs for APIs, mTLS for services — rarely just one.

Banking app

Passkeys + step-up

IoT fleet

mTLS certs