Brad Hill

Single sign on and cloud identity technologies are improving user experiences and increasing the velocity of personal data around the web. But are we deluding ourselves and our users that all these new “tokens” provide any better security than the passwords and credit card numbers they’re supposed to replace? All too often they don’t, and authentication protocols from 2010 are providing less cryptographic assurance than those from 1978. What risks are we are still leaving unmanaged, and how can we do better?