duncan-godfrey

Sr. Director of Security and Compliance

Duncan Godfrey

Geoffrey Goodman

Staff Engineer

golo-roden

Guest Author

Golo Roden

Linda Gong

Product Marketing Manager

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

obielum-godson

Full-Stack Developer

Obielum Godson

Linda Gong is a Product Marketing Manager for Orchestration at Okta, where she leads go-to-market strategy for Okta Workflows and Auth0 Extensibility. With a background in demand generations and marketing analytics, she brings a data-driven mindset to messaging, product launches, and driving adoption. When she’s not crafting product narratives, you’ll likely find her hunting down the best local coffee shops or planning her next travel adventure.

Auth0 + Sift integration delivers real-time, risk-based fraud detection and prevention while enabling frictionless logins for legitimate users.

Nearly [$13 billion](https://javelinstrategy.com/research/2024-identity-fraud-study-resolving-shattered-identity-crisis) — that’s how much account takeover (ATO) fraud cost businesses in 2023 alone. This isn’t just another alarming stat — it’s a wake-up call for any organization managing user accounts. Industries like e-commerce and financial services are feeling the heat, with ATO attack rates spiking [36%](https://sift.com/index-reports-account-takeover-fraud-q3-2024) and [10%](https://sift.com/index-reports-account-takeover-fraud-q3-2024) year-over-year, respectively.

The methods behind these attacks aren’t new: stolen credentials from data breaches, phishing attacks, and malware are still the go-to tools for fraudsters. What is new? The scale, sophistication, and speed of these attacks. And traditional defenses—CAPTCHA, static rules, even MFA—aren’t enough on their own.

### What you need: Real-time, AI-driven fraud defense

That’s where Auth0 + Sift comes in. Together, they deliver real-time, risk-based fraud detection and authentication at scale. With the pre-built integration, businesses can achieve robust ATO defenses quickly and with minimal engineering lift. 

With the Auth0 extensible identity platform and Sift’s AI-powered risk engine, you can automatically score risk, trigger adaptive MFA, and block bad actors—without slowing down your trusted users.

![Auth0 + Sift integration](https://images.ctfassets.net/23aumh6u8s0i/4E3Z7xaIl3d7lFbAY1qJWH/265b3594668967191449fad982a03f06/Screenshot_2025-04-28_at_6.03.34_PM.png)

### Check out the solution brief to learn how to stay ahead of account takeover attacks

Download [Auth0 + Sift integration solution brief](https://cdn.auth0.com/blog/blog/auth0sift-solution-brief.pdf) to discover:

* Why real-time, AI-powered risk assessment is essential to stop ATO fraud
* How the Auth0 + Sift integration works
* A real-world example from a global e-commerce platform
* Key outcomes: reduced fraud losses, enhanced user experiences, and increased operational efficiency



Account Takeover Attacks Are Surging — Stop Them With AI-Powered Fraud Defense

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Learn how to build a tool-calling AI agent using LangGraph, Vercel AI SDK, and Next.js. Integrate different kinds of tools into them. Use Google services like Gmail, Calendar, and Drive as tools secured using Auth0 Token Vault.

**AI agents** and **Operators** are the next big things in software development. In a [previous post](https://auth0.com/blog/genai-tool-calling-intro/), we discussed how AI agents are taking center stage by seamlessly integrating with multiple digital tools to be more efficient. In this post, we will build a personal assistant that can use different types of tools. Both simple unauthenticated tools and more complex authenticated tools like Gmail, Calendar, and Google Drive.

If you haven't read the previous post, I recommend you do so before continuing to better understand tool calling in AI agents and how security is currently handled.

<include
 src="LinkCard"
 title="Tool Calling in AI Agents: Empowering Intelligent Automation Securely"
 link="https://auth0.com/blog/genai-tool-calling-intro/"
 description="Discover how AI agents are taking center stage by seamlessly integrating with multiple digital tools to be more efficient. Learn why it is important to secure them."
 img="https://images.ctfassets.net/23aumh6u8s0i/4LrNhImjPcdPVpmCIrhlG9/4efed8dfb26630e6cf48b4a478a1f550/genai-tool-calling-intro.png"
/>

To keep this post focused on tool calling, we will only focus on the AI agent part, not the UI. Each tutorial step, including building the UI, can be found as a distinct commit in the [GitHub repository](https://github.com/auth0-samples/auth0-assistant0).

## Technology Stack

We will use a [Next.js](https://nextjs.org/) application called **Assistant 0** as the base. Assistant 0 is an AI personal assistant that consolidates your digital life by dynamically accessing multiple tools to help you stay organized and efficient.

Apart from Next.js, we mainly use the following technologies:

- [LangGraph.js](https://langchain-ai.github.io/langgraphjs/) and [LangChain's JavaScript framework](https://js.langchain.com/docs/introduction/) for building agentic workflows.
- [LangChain community tools](https://js.langchain.com/docs/integrations/tools/).
- Vercel's [AI SDK](https://github.com/vercel-labs/ai) to stream response tokens to the client and display the incoming messages.
- The [Auth0 AI SDK](https://github.com/auth0-lab/auth0-ai-js) and [Auth0 Next.js SDK](https://github.com/auth0/nextjs-auth0) to secure the application and call third-party APIs.

## Prerequisites

> **You will need the following tools and services to build this application**:
>
> - [Bun v1.2](https://bun.sh/) or [NodeJS v20](https://nodejs.org/en/download)
> - An Auth for GenAI account. [Create one](https://a0.to/ai-content).
> - An OpenAI account and API key. [Create one](https://platform.openai.com) or use any [other LLM provider supported by LangChain](https://js.langchain.com/docs/integrations/llms/).
> - A SerpAPI account and API key. [Create one](https://serpapi.com/).
> - A Google account for Gmail, Calendar, and Drive. Preferably a new one for testing.

## Getting Started

First clone [the repository](https://github.com/auth0-samples/auth0-assistant0) and install the dependencies:

```bash
git clone https://github.com/auth0-samples/auth0-assistant0.git
cd auth0-assistant0
git switch step-1 # so that we skip building the UI and get straight to the AI agent

bun install # or npm install
```

Next, you'll need to set up environment variables in your repo's `.env.local` file. Copy the `.env.example` file to `.env.local`. To start, you'll just need to add your OpenAI API key.

Now, start the development server:

```bash
bun dev # or npm run dev
```

Open `http://localhost:3000` with your browser to see the result! Ask the agent something, and you'll see a streamed response.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/ePzgV9PLYqmwdsqdJC2VU/3507e783ee8199b6a5599742ef81fed7/assistant-0.png)

### A Peek into the Code

The application is structured as follows:

- `src/app`: Contains the Next.js application routes, layout, and pages.
- `src/app/page.tsx`: Home page with chat interface.
- `src/app/api/chat/route.ts`: API route for handling chat requests. This is where the AI agent is defined.
- `src/components`: UI components used in the application.
- `src/lib`: Services and configurations. This is where custom tools will be defined.
- `src/utils`: Utility functions

Let's take a look at the `src/api/chat/route.ts` file where the AI agent is defined.

```js
// src/api/chat/route.ts
// ...
const AGENT_SYSTEM_TEMPLATE = `You are a personal assistant named Assistant0.
You are a helpful assistant that can answer questions and help with tasks.
You have access to a set of tools, use the tools as needed to answer the user's question.`;

export async function POST(req: NextRequest) {
  // ... Process the request and get messages
  // Create a new OpenAI chat model
  const llm = new ChatOpenAI({ model: "gpt-4", temperature: 0 });
  const tools = [];
  // Use a prebuilt LangGraph agent.
  const agent = createReactAgent({
    llm,
    tools,
    messageModifier: new SystemMessage(AGENT_SYSTEM_TEMPLATE),
  });
  // Stream back all generated tokens and steps from their runs.
  const eventStream = agent.streamEvents({ messages }, { version: "v2" });
  // Log tool calling data. Only in development mode
  const transformedStream = logToolCallsInDevelopment(eventStream);
  // Adapt the LangChain stream to Vercel AI SDK Stream
  return LangChainAdapter.toDataStreamResponse(transformedStream);
}
```

The route uses a prebuilt LangGraph agent and OpenAI chat model. No tools are defined yet; we will add them in the next section.

Here is a high-level architecture of the application with the tools we will be adding in this post.

![Assistant 0 architecture](https://images.ctfassets.net/23aumh6u8s0i/6ZTtsivmBOPUmKGWx479Xm/d8d90c3bf3f24f1c8ce99ff703a1ba7d/architecture.jpg)

Now that the base application is running, let's start building our personal assistant with tool-calling capabilities.

## Add Tools to the Assistant

If you recall the previous post, we discussed authenticated and unauthenticated tools. Let's start with an unauthenticated tool and then proceed to add more complex tools like Gmail, Calendar, and Google Drive.

### Add a Calculator Tool

We will start with a simple calculator tool from the LangChain community tools to perform basic arithmetic operations.

Install the `@langchain/community` package.

```bash
bun add @langchain/community # or npm i @langchain/community
```

Update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { Calculator } from "@langchain/community/tools/calculator";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [new Calculator()];
  // ...
}
```

It's that simple! Now, try asking the assistant to perform some calculations. For example, `what is (2+56) x 200`. You should see the answer in the UI. If you check the console where Next.js dev server (`bun dev`) is running, you should see the tool calling data like below.

```bash
Tool calls state: {
 "call_E3Za9klJcJ5TADWiMj8XfjdB": {
   "name": "calculator",
   "args": "{\n  \"input\": \"(2+56) * 200\"\n}"
 }
}
POST /api/chat 200 in 8382ms
```

### Add a Web Search Tool

Now let's add a web search tool to search the web for information. Let's use [SerpAPI](https://serpapi.com/) for this. It's an authenticated tool. But since this is going to be API usage and not a user impersonation, we can simply use an API key.

First, get an API key from SerpAPI and add that to your `.env.local` file.

```bash
SERPAPI_API_KEY=your-api-key
```

Now, update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { SerpAPI } from "@langchain/community/tools/serpapi";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [new Calculator(), new SerpAPI()];
  // ...
}
```

Again, quite simple! Now try asking the assistant to search the web for information. For example, `What is the top 10 news today?`. You will see the response in the UI.

![Assistant 0 web search](https://images.ctfassets.net/23aumh6u8s0i/h4hWDQwBBTUiDh6gdaVET/137647c87dd51c6cc34ec0a44d6e453d/assistant-0-web-search.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
 "call_e8vqAPW45vMsUbFiIF9SW5Yn": {
   "name": "search",
   "args": "{\n  \"input\": \"top 10 news today\"\n}"
 }
}
POST /api/chat 200 in 15443ms
```

This corresponds to the `step-2` branch in case you want to double-check your code.

```bash
git switch step-2
```

### Add Gmail Tools

Now, let's get into business. I know you are here for this part, not to learn about adding calculators and web search tools. But before we can add a Gmail tool, we need to add Auth0 authentication to the application since we will be using Auth0's [Token Vault](https://auth0.com/docs/secure/tokens/token-vault) feature to get access tokens to call the Gmail API via a tool.

#### Add Auth0 Authentication

First, let's add Auth0 as the authentication provider to the application.

Follow the [Auth0 Next.js quickstart guide](https://auth0.com/ai/docs/user-authentication) to set up the application.

> If you want to create the Auth0 application manually, create a new application (Type: **Regular Web App**, Callback URL: `http://localhost:3000/auth/callback`) and get the **client ID** and **client secret**.

Update the `.env.local` file with credentials, and create the `src/lib/auth0.ts` and `src/middleware.ts` files.

If you want to skip to the next step, check out the `step-3` branch. The [full changelog for this step is on GitHub](https://github.com/auth0-samples/auth0-assistant0/commit/9a6db1ec49511afa7c361080c3f5a1854ee8efe5).

```bash
git switch step-3
```

#### Configure Auth0 for Gmail

To use Gmail API with Auth0 via a Google Social Connection, you need to do the following:

- Create Google OAuth 2.0 credentials
- [Enable Gmail API](https://console.cloud.google.com/apis/library/gmail.googleapis.com) for the credentials
- Configure Gmail social connection in Auth0

You can follow the [Google Sign-in and Authorization](https://auth0.com/ai/docs/google-sign-in-and-auth) guide from Auth0 to configure this.

#### Configure Auth0 AI SDK

First, install the `@auth0/ai-langchain` package from [Auth0 AI SDK](https://github.com/auth0-lab/auth0-ai-js).

```bash
bun add @auth0/ai-langchain # or npm i @auth0/ai-langchain
```

Update `src/lib/auth0.ts` with the following code.

```js
// src/lib/auth0.ts
// ...
export const auth0 = new Auth0Client({
  // this is required to get federated access tokens from services like Google
  authorizationParameters: {
    access_type: "offline",
    prompt: "consent",
  },
});

// Get the refresh token from Auth0 session
export const getRefreshToken = async () => {
  const session = await auth0.getSession();
  return session?.tokenSet?.refreshToken;
};
```

Create a new `src/lib/auth0-ai.ts` file with the following code.

```js
// src/lib/auth0-ai.ts
import { Auth0AI } from "@auth0/ai-langchain";
import { getAccessTokenForConnection } from "@auth0/ai-langchain";
import { getRefreshToken } from "@/lib/auth0";

// Get the access token for a connection via Auth0
export const getAccessToken = async () => getAccessTokenForConnection();

const auth0AI = new Auth0AI();

// Connection for Google services
export const withGoogleConnection = auth0AI.withTokenForConnection({
  connection: "google-oauth2",
  scopes: [],
  refreshToken: getRefreshToken,
});
```

#### Add Gmail Search Tool

We can add Gmail tools now that we have Auth0 authentication in place. Let's start with a Gmail search tool. This tool will allow the assistant to search for emails in the user's Gmail account.

First, we need to get an access token for the Gmail API. We can get this using the [Auth0 Token Vault](https://auth0.com/docs/secure/tokens/token-vault) feature.

Update `src/lib/auth0-ai.ts` with the required scopes.

```js
// src/lib/auth0-ai.ts
// ...
export const withGoogleConnection = auth0AI.withTokenForConnection({
  // ...
  scopes: ["https://www.googleapis.com/auth/gmail.readonly"],
  // ...
});
```

Install the `googleapis` package.

```bash
bun add googleapis # or npm i googleapis
```

Import the `GmailSearch` tool from LangChain community tools and update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { GmailSearch } from "@langchain/community/tools/gmail";
import { withGoogleConnection, getAccessToken } from "@/lib/auth0-ai";
// ...
export async function POST(req: NextRequest) {
  // ...
  // Update the LLM model to gpt-4o-mini to support a larger context window
  const llm = new ChatOpenAI({
    model: "gpt-4o-mini",
    temperature: 0,
  });
  // Provide the access token to the Gmail tools
  const gmailParams = {
    credentials: {
      accessToken: getAccessToken,
    },
  };
  const tools = [
    // ... existing tools
    withGoogleConnection(new GmailSearch(gmailParams)),
  ];
  // ...
}
```

We are all set! Now, try asking the assistant to search for emails. For example, `What is the latest unread email?`. You should see the response in the UI.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/14n2drq2woolLeJybBMWk6/3bbc575f92493dc2322f485a6b4f4ac9/assistant-0-gmail-search.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
 "call_rCzcZRjueyD8p2kzTmeZMiSK": {
   "name": "search_gmail",
   "args": "{\"query\":\"is:unread\",\"maxResults\":1,\"resource\":\"messages\"}"
 }
}
POST /api/chat 200 in 10892ms
```

#### Add Gmail Draft Tool

We will add a Gmail draft tool next. This tool will allow the assistant to draft emails on behalf of the user.

Update `src/lib/auth0-ai.ts` with the required scopes.

```js
// src/lib/auth0-ai.ts
// ...
export const withGoogleConnection = auth0AI.withTokenForConnection({
  // ...
  scopes: [
    // ... existing scopes
    "https://www.googleapis.com/auth/gmail.compose",
  ],
  // ...
});
```

Update the `src/api/chat/route.ts` file with the following code.

```js
// src/api/chat/route.ts
import { GmailCreateDraft } from "@langchain/community/tools/gmail";
// ...
export async function POST(req: NextRequest) {
  // ...
  const tools = [
    // ... existing tools
    withGoogleConnection(new GmailCreateDraft(gmailParams)),
  ];
  // ...
}
```

Now, ask the assistant to draft an email. For example, `Draft an email to John Doe about the meeting tomorrow.` You should see the response in the UI.

![Assistant 0](https://images.ctfassets.net/23aumh6u8s0i/hWz4f6iUXTacbCNoqxwLz/c16c70d786027012b4c4944639339999/assistant-0-gmail-draft.png)

If you check the console, you should see the tool calling data like the one below.

```bash
Tool calls state: {
"call_pPAk6rFYJSSyAuYkNWFf5KYX": {
  "name": "create_gmail_draft",
  "args": "{\"message\":\"Hi John,\\n\\nI hope this message finds you well. I wanted to … [Your Name]\",\"to\":[\"john.doe@example.com\"],\"subject\":\"Meeting Reminder\",\"cc\":[],\"bcc\":[]}"
}
}
POST /api/chat 200 in 7594ms
```

You can find the [full changelog of these two steps on GitHub](https://github.com/auth0-samples/auth0-assistant0/commit/020f90f9ca85824f9cf99a82986a91bf72625041).

This corresponds to the `step-4` branch in case you want to double-check your code.

```bash
git switch step-4
```

## Learn more about AI Agents and Auth for GenAI

You have successfully built an AI personal assistant that can search the web, search your emails, and draft emails. In the next chapters, we will switch to a more production-ready architecture and add more tools like User Info, Google Calendar, Google Drive, and Slack to the assistant.

This tutorial is part of a series of posts on tool-calling Agents with [Auth for GenAI](https://a0.to/ai-content). We learned how to add tools to an AI agent and how to secure them using Auth0.

Sign up for [Auth for GenAI in Developer Preview](https://a0.to/ai-content).

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI](https://vercel.com/ai), and [GenKit](https://firebase.google.com/docs/genkit). [Auth for GenAI](https://auth0.com/blog/introducing-auth-for-genai-launching-identity-for-ai-agents/) is our new product to help you protect your user's information in GenAI-powered applications. Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.


Build an AI Assistant with LangGraph, Vercel, and Next.js: Use Gmail as a Tool Securely

Discover how AI agents are taking center stage by seamlessly integrating with multiple digital tools like Gmail, Calendar, Slack, and Google Drive to be more efficient. Learn why it is important to secure them and how to do it.

**AI agents** or **Operators** are the latest trend in AI. At their core, agents are autonomous systems that not only process natural language using Large Language Models (LLMs) but also decide when and how to act by interfacing with external tools and APIs. These smart entities blend machine learning with decision-making capabilities, enabling them to perform complex tasks, interact in real-time, use the most efficient tools to perform certain tasks, and even learn from their environment—all without constant human intervention.

<AmpContent>
<amp-youtube
    data-videoid="r7wEinUG0ns"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  className='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/r7wEinUG0ns'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

## Tool Calling Agents

LLMs on their own are still susceptible to hallucinations and mistakes, but the ability to call tools opens up a whole new world of possibilities where error-prone tasks can be offloaded to a more traditional non-AI tool, like using a calculator to do math rather than relying on the LLM for it. Similarly, tool calling allows AI agents to interface with other applications and services, like Gmail, Calendar, Slack, and Google Drive, to do more for you than just answering questions.

Tool calling can be generally classified into these:

1. **Unauthenticated Tools:** These are tools that don't require authentication and are generally simpler to configure, like a calculator, a weather API, or a unit converter.
2. **Authenticated Tools:** These are tools that require authentication and are generally complex to configure, such as an API provided by another internal application or services like Gmail, Calendar, Slack, and Google Drive.

In an enterprise environment, the authenticated tools can be further classified into:

1. **First-Party Tools:** These are services that are part of the same infrastructure and require authentication, like an API provided by another internal application or a microservice.
2. **Third-Party Tools:** These are external services that require more complex authentication. They could be services that are authenticated using service accounts or API keys, like a payment API, or services that need to be authenticated by the end user, such as Gmail, Calendar, Slack, and Google Drive.

Tool calling provides many key advantages to an AI agent:

- **Autonomous Decision-Making:** AI agents analyze context and determine the next best action, reducing the need for manual oversight.
- **Optimized Task Execution:** They can connect to various services and APIs, enabling them to perform specialized tasks like data retrieval, scheduling, and communication.
- **Scalability and Adaptability:** As systems evolve, agents can easily incorporate new functionalities, adapting to changes in workflow or priorities.
- **Improved User Experience:** Their ability to tackle diverse tasks leads to more personalized and efficient interactions, making technology feel both intuitive and proactive.

## Tool Calling Agent: A Conceptual Example

Imagine an AI personal assistant that consolidates your digital life by dynamically accessing multiple tools to help you stay organized and efficient. Here’s how it could work:

1. **Gmail Integration:** The assistant regularly scans your inbox to generate concise summaries. It highlights urgent emails, categorizes conversations by importance, and even suggests drafts for quick replies.
2. **Calendar Management:** By interfacing with your calendar, it can remind you of upcoming meetings, check for scheduling conflicts, and even propose the best time slots for new appointments based on your availability.
3. **Slack Notifications:** For team communications, the assistant monitors Slack channels. It identifies key messages and creates action items, ensuring you never miss an important update from your colleagues.
4. **Google Drive Access:** Whether you need immediate access to the latest project document or a file related to a current task, the assistant retrieves pertinent documents from Google Drive on demand. It can create document summaries and even create new documents based on your instructions.

With tool-calling capabilities, the possibilities are endless. In this conceptual scenario, the AI agent embodies a digital personal secretary—one that not only processes information but also proactively collates data from connected services to provide comprehensive task management. This level of integration not only enhances efficiency but also ushers in a new era of intelligent automation, where digital assistants serve as reliable, all-in-one solutions that tailor themselves to your personal and professional needs.

## Security Challenges with Tool Calling AI Agents

Building such an assistant is not that difficult. Thanks to frameworks like [LangChain](https://www.langchain.com/), [LlamaIndex](https://www.llamaindex.ai/), and [Vercel AI](https://vercel.com/ai), you can get started quickly. The difficult part is doing it securely so that you can protect the user's data and credentials.

Many current solutions involve storing credentials and secrets in the AI agent application’s environment or letting the agent impersonate the user. Storing credentials securely in the environment might work for APIs that require API keys or service accounts. However, this is not a good idea for cases where the end users need to authenticate to the service, as it can lead to security vulnerabilities and excessive scope and access for the AI agent.

<br>

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487 icon-info"></i>
  <b>To learn more about other security concerns and vulnerabilities in AI check out this blog post on <a href="https://auth0.com/blog/identity-challenges-for-ai-powered-apps/">Identity Challenges for AI-Powered Applications</a>.</b><br> 
</div>

When you build an AI agent, you need to consider all its other security implications as well. You don't want an LLM to have unlimited access to your personal data like email and documents, and more importantly, you don't want to provide your credentials to the LLM to access these tools. Let's face it, regardless of how secure the LLM is, there is always a possibility of it getting manipulated into divulging sensitive information or doing something you don't want it to do.

## Tool Calling with the Help of Auth0

This is where Auth0 comes to the rescue. As the leading identity provider (IdP) for modern applications, our upcoming product, [Auth for GenAI](https://auth0.com/blog/auth-for-genai/), provides standardized ways built on top of OAuth and OpenID Connect to call APIs of tools on behalf of the end user from your AI agent.

Auth0 brokers a secure and controlled handshake between the AI agents and the services you want the agent to interact with on your behalf – in the form of scoped access tokens. This way, the agent and LLM do not have access to the credentials and can only call the tools with the permissions you have defined in Auth0. This also means your AI agent only needs to talk to Auth0 for authentication and not the tools directly, making integrations easier.

### Call first-party APIs on users' behalf

When your AI agent, secured with Auth0, needs to call another application also secured with Auth0, you can use standard OAuth 2.0 flows, like the [Authorization Code Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow), to get an API token from that application with user consent. In this case, Auth0 will manage the retrieval of new access tokens using cached refresh tokens when the API token expires.

### Call third-party APIs on users' behalf

When your AI agent, secured with Auth0, wants to call external services like Gmail, Calendar, Slack, and Google Drive, Auth0 can help the agent get access tokens for the external service on behalf of the end user. In this case, Auth0 brokers the API access token from the external service to the AI agent.

![Tool calling with Federated API token exchange](https://images.ctfassets.net/23aumh6u8s0i/1gY1jvDgZHSfRloc4qVumu/d44bb7102c1e858e5ac64dea324478fe/tool-calling-with-federated-api-token-exchange.jpg)

This is made possible by Federated API token exchange, which is a way to obtain an access token from an external identity provider without the need for the user to re-authenticate every time. The end user authenticates and connects the external service once, and Auth0 intermediates the authentication and authorization process and provides the API access token to the AI agent. Auth0 takes care of storing refresh tokens and getting new access tokens when the current access token expires.

## Security Best Practices for Tool Calling AI Agents

Here is a summary of security best practices to consider when building a tool-calling AI agent:

- **Least Privilege**: Grant the minimum permissions needed (e.g., read-only access).
- **Audit Logs**: Track API calls and credential usage.
- **Proxying**: Use an IdP like Auth0 as a broker between the AI agent and the tools to protect the user's credentials.
- **Encryption**: Encrypt credentials at rest and in transit (HTTPS/TLS).
- **Token Rotation**: Regularly rotate API keys and tokens.
- **Sandboxing**: Run tools in isolated environments when possible to limit damage from leaks.

## Learn More about AI Agents and Auth for GenAI

This post offers a glimpse into the transformative potential of AI agents and highlights how secure and intelligent tool calling can empower AI agents to deliver a more connected and personalized experience. Stay tuned for a series of posts on tool-calling Agents with [Auth for GenAI](https://a0.to/ai-content), where we will build the conceptual personal assistant from the previous section in Node.js and Python, showing how to integrate with different types of services securely using your favorite AI frameworks and Auth0.

Before you go, we have some great news to share: we are working on more content and sample apps in collaboration with amazing GenAI frameworks like [LlamaIndex](https://www.llamaindex.ai/), [LangChain](https://www.langchain.com/), [CrewAI](https://www.crewai.com/), [Vercel AI](https://vercel.com/ai), and [GenKit](https://firebase.google.com/docs/genkit). [Auth for GenAI](https://auth0.com/blog/auth-for-genai/) is our upcoming product to help you protect your user's information in GenAI-powered applications. Make sure to join the [Auth0 Lab Discord server](http://a0.to/auth0-lab-discord) to hear more and ask questions.

Tool Calling in AI Agents: Empowering Intelligent Automation Securely

samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you.

Identity is the connective tissue between every person and technology in your ecosystem. This connective role also places Identity at the center of your risk profile. It’s no surprise that Identity remains the No. 1 attack vector in today’s threat landscape —  over 80% of data breaches involve some form of compromised Identity.

Properly addressing this fact means taking a serious and expansive look at your organization’s approach to Identity — because here’s the thing: Identity is more than just a login box. A rigorous, modern approach to Identity mitigates threats before, at, and after authentication.

Accordingly, technology leaders can’t limit themselves exclusively to Identity-related threats. They must also consider the impact their Identity solution has on core business priorities such as revenue, customer satisfaction, and growth goals.

This blog dives into how technology leaders can deliver Identity security solutions that also drive growth. If you’re curious about how to stay ahead of increasingly sophisticated attacks without putting your business goals at risk with excessive friction, this resource is for you.

## It’s Time to Ditch Dated Identity and Excessive Friction

Protecting customers from account takeover and other malicious actions is crucial. But when that protection creates frustrating stumbling blocks for customers, like passwords, frequent CAPTCHAs, and multi-factor authentication (MFA) fatigue, your business is at risk. By introducing excessive friction into customer journeys, good-faith security efforts built on legacy Identity methods can lead to abandoned customer journeys, lower conversion rates, and lost business.

It’s a raw deal, and the worst part is that Identity security that burdens your customers doesn’t necessarily translate to better security. For example, traditional usernames and passwords with SMS as a second factor are vulnerable to social engineering and SIM-swapping attacks.

The clock has run out on legacy Identity. It’s time to embrace a modern approach that leverages Identity as more than a login box and, instead, drives better security and better business.

## Protect Every Stage of the Customer Journey

If the stats on pervasive Identity-related breaches teach us anything, it’s that legacy Identity simply isn’t enough in today’s threat landscape. Technology leaders need Identity security that can discover weaknesses, protect against vulnerabilities, and limit access if an adversary gets in.

In order to modernize security, you must modernize Identity. Auth0’s layered defense strategy improves security before, at, and after the login box alongside a SecOps dashboard, tools, and integrations. Here’s how our Auth0 Identity platform drives stronger security, privacy, and user experience (UX) across the customer journey.

### Before login

Bots make up 42% of all internet traffic today and 65% of these are bad bots.A versatile, scalable method for bad actors to carry out automated attacks, bots are also a major drain on your marketing budget. Whenever bots sign up for new accounts, they eat into your sign-up bonuses and block new connections with real customers.

Generative AI is poised to add gas to the bot fire: Between 2023 and 2030, AI adoption in cybercrime is expected to rise by 37%. Soon, businesses will be dealing with an even higher number of sophisticated bots capable of outsmarting simple bot-detection CAPTCHAs.

Modern Identity should stop bad bots in their tracks while maintaining customer-friendly experiences that protect revenue. Auth0 Bot Detection continuously monitors Identity threats across hundreds of millions of users, enabling us to detect bad bots and respond in real time with user-friendly challenges like the time-based authentication challenge. In addition, our Bot Detection solution now features a machine-learning model designed for signup attacks. Tailored models greatly improve detection and prevention of bots across the user journey, while reducing bot challenges presented to real customers.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection)

### At login

Ultimately, driving your business forward comes down to providing customers with a simple and seamless user experience without compromising on security. Customers want on-demand convenience — fast, easy access with flexible login options — which means digital teams need to design phishing-resistant authentication experiences that also deliver a quick and easy customer journey.

Modern Identity can provide that perfect balance with flexible, secure passwordless login options. Passkeys allow users to log in quickly and securely, similar to how they unlock their mobile devices. They are also a phishing-resistant alternative to less user-friendly login options like the commonly used username and password plus MFA combination. Adaptive MFA can also reduce MFA fatigue by assessing risk signals such as a new device, network, or location, impossible travel, and untrusted IP, only triggering a second challenge for higher-risk authentication attempts.

In addition to login options, Auth0 offers layered security features for login. Auth0 Breached Password Detection and Credential Guard screen for and block compromised credentials. Auth0’s Brute-Force Protection and Suspicious IP Throttling help prevent account takeover attacks that target single and multiple user accounts, respectively.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Single Sign-On](https://auth0.com/docs/authenticate/single-sign-on) 
* [Passwordless](https://auth0.com/docs/authenticate/passwordless),[ Passkeys](https://auth0.com/docs/authenticate/database-connections/passkeys) 
* [Multi-Factor Authentication](https://auth0.com/docs/secure/multi-factor-authentication)
* [Adaptive MFA](https://auth0.com/docs/secure/multi-factor-authentication/adaptive-mfa)
* [Suspicious IP Throttling](https://auth0.com/docs/secure/attack-protection/suspicious-ip-throttling)
* [Breached Password Detection and Credential Guard](https://auth0.com/docs/secure/attack-protection/breached-password-detection)
* [Brute Force Protection](https://auth0.com/docs/secure/attack-protection/brute-force-protection)

### After login

The ongoing rise in post-login threats also necessitates a defense-in-depth, layered security approach at every step of the user journey. The stakes are high, and the pain caused by breaches has the potential for extensive reach. Breaches not only incur painful financial losses but also lead to substantial brand and compliance-related effects that threaten the core business. Modern Identity can help avoid these outcomes.

Modern Identity elevates security, privacy, and experience post-login to protect sensitive customer interactions and user sessions. For example, with Auth0 Highly Regulated Identity, configure your organization to send financial-grade contextual approval requests to customers’ devices for sensitive interactions like account updates or money transfers. With Auth0 Continuous Session Protection, your organization can also continuously monitor user sessions to detect and prevent hijacking attempts, revoke suspicious sessions, and set custom timeouts.

Auth0 SOLUTIONS TO EXPLORE FURTHER:

* [Highly Regulated Identity](https://auth0.com/docs/secure/highly-regulated-identity)
* [Continuous Session Protection](https://auth0.com/docs/secure/continuous-session-protection)

## SecOps

Security is a team sport, which is why Auth0 enables better collaboration between security, product teams, and developers with real-time insights and ready-made integrations that connect Auth0 functionality to a broader security apparatus.

For example, Auth0’s Security Center helps organizations detect and respond to attacks faster and fine-tune their security posture with intelligent insights and custom threshold alerting for Identity-related events, anomalies, and general efficacy. Security Log Streaming further supports faster event response by allowing the streaming of relevant Customer Identity Cloud activity to third-party SIEM tooling.

Auth0 SOLUTIONS TO EXPLORE FURTHER

* [Security Center](https://auth0.com/docs/secure/security-center)
* [Security Log Streaming](https://auth0.com/docs/secure/security-center/prioritized-log-streams)

## The Perfect Blend of Security and Usability

It’s tempting to think of Identity as a box to be checked. Equip your customer-facing applications with SSO and MFA–check. It's time to dust off your hands and declare victory, right? If only it was that easy.

To adapt to the ever-shifting risks of the business landscape with equal attention to security and revenue, technology leaders need an approach to Identity-based security that also functions as a business driver. That means integrating secure, seamless Identity functions into your security and revenue strategies at each customer touchpoint.

Legacy approaches to Identity fall far short of this goal. But, by entrusting your organization’s Identity with a leader in modern Identity, you can position your business to lead the pack in customer Identity security and core business KPIs.

## It All Starts with Auth0

[Thousands of customers](https://www.okta.com/customers/) worldwide trust Auth0 to strike the perfect balance of robust security and seamless customer experience across more than 10 billion monthly authentications.

We’ve invested in a layered defense strategy to improve security before, during, and after the login box — plus a dashboard and tools for SecOps that improve visibility and enable faster responses to potential and emerging threats.

Curious about how the Auth0 can help you build trust with your customers, secure your applications, and protect revenue?[ Reach out to our team](https://auth0.com/contact-us?place=header&type=button&text=contact%20sales) to schedule a demo.


Identity Security 101: How to Drive Trust and Loyalty across the User Journey

37590801?s=460&v=4

A software engineer who dreams about non-electric sheep and autonomous vehicles and likes to champion security.

Software Engineer

Dan Arias

Learn how to prevent CSRF attacks from compromising your users when implementing Google OAuth for user registration and user login.

Growing an active user base is a top priority for all developers. Your product pages need copy, design, and engineering that can efficiently and effectively convert visitors into users. A visitor is an anonymous person browsing your site or app. A user is a visitor who exchanges some information to access more layers or features of your app. Even with just an email address or username, you can build a profile or identity for a user.

As such, user authentication is the backbone of conversion. User registration and login must be secure and as frictionless as possible. Long and tedious forms or requirements during registration can turn prospects away. Errors or downtime during login can frustrate even your most loyal customers, leading to dissatisfaction or support tickets.

## Why Use Google OAuth for User Authentication

A reliable way to implement user registration and authentication in an application and turn visitors into users quickly and securely is by using a registration and authentication system that your visitors already use and trust, such as Google.

As a developer, you can take advantage of Google's high security and trust Google as a source to safeguard user credentials so that you don't have to. Google social login leverages the OAuth 2.0 protocol for authorization and uses [OpenID Connect (OIDC)](https://developers.google.com/identity/openid-connect/openid-connect) as the standard for user authentication. You can delegate to Google's UI/UX and engineering the burden of password requirements, password protection, password error handling, email verification, profile data collection, and more. 

How easy or difficult is it to implement Google Login on your own? It depends. On the surface, it may be like a simple endeavor: In the JavaScript ecosystem, use a library like [`google-auth-library`](https://www.npmjs.com/package/google-auth-library), write a few lines of code, and call it a day.

While `google-auth-library` is a robust client library for using OAuth 2.0 authorization and authentication with Google APIs, it's essential to know how to use it effectively to avoid introducing security vulnerabilities in your application that could put your end-users and your organization at risk.

For instance, a recent [post on X](https://x.com/forgebitz/status/1858616526540042521) went viral: a developer named Klaas shared with the X developer community a code snippet on how to implement "google login with just the google-auth-library, no frameworks in 50 lines of code":

```typescript
export const googleLoginAction = {
  getAuthUrl: () => {
    const query = {
      client_id: oauth_google.client_id,
      redirect_uri: oauth_google.redirect_uri,
      response_type: "code",
      scope: oauth_google.scopes,
    };

    const url = new URL(oauth_google.endpoint);
    url.search = new URLSearchParams(query).toString();
    return url.toString();
  },
  verifyGoogleCode: async ({ code }: { code: string }) => {
    log.info({ code }, "verifying google auth code");

    try {
      const tokenResponse = await fetch("https://oauth2.googleapis.com/token", {
        method: "POST",
        headers: {
          "Content-Type": "application/x-www-form-urlencoded",
        },
        body: new URLSearchParams({
          client_id: oauth_google.client_id,
          client_secret: oauth_google.client_secret,
          code,
          grant_type: "authorization_code",
          redirect_uri: oauth_google.redirect_uri,
        }),
      });

      const tokenData = (await tokenResponse.json()) as { id_token: string };

      const ticket = await client.verifyToken({
        idToken: tokenData.id_token,
        audience: oauth_google.client_id,
      });

      const userData = ticket.getPayload();
      log.info({ userData }, "google auth successful");
    } catch (error) {
      log.error({ error }, "failed to verify google auth code");
      throw new Error("Failed to verify Google authentication");
    }
  },
};
```

Klaas' X post ignited a passionate discussion around user authentication and general security. As of the time of writing, the post had gathered 449k impressions, 4.7k likes, 387 reposts, and 83 comments.

## Google OAuth Implementation Can Go Wrong

Some of the commenters asked questions about the code's security posture, while others offered insights and advice on how to improve the security of that Google OAuth implementation.

Some commenters assumed the code was running on the client and were alarmed by the code handling a client secret, which could lead to a security compromise. Klaas clarified that the code is intended to run in the backend and [further explained its purpose as follows](https://x.com/forgebitz/status/1858776267266441324):

 "_this [code] has two simple functions, create a URL where you redirect the user to and a verify code function, you have the create a /callback (on the server) to get that URL. You still need to make authentication/authorization_"

Some other commenters pointed out that the code could be subject to a [Cross-Site Request Forgery (CSRF) attack](https://en.wikipedia.org/wiki/Cross-site_request_forgery), which confused others: How can there be a CSRF attack if there's no cookie involved or when the code does not run in the client?

First and foremost, let's recap what a Cross-Site Request Forgery (CSRF) attack is. [Andrea Chiarelli](https://auth0.com/blog/authors/andrea-chiarelli), Principal Developer Advocate at Okta, [summarizes a CSRF attack as follows](https://auth0.com/blog/cross-site-request-forgery-csrf/#--What-is-CSRF--):

- A typical Cross-Site Request Forgery (CSRF or XSRF) attack aims to perform an operation in a web application on behalf of a user without their explicit consent.
- The attacker leads the user to perform an action, like clicking a link.
- This action sends an HTTP request to a website on behalf of the user.
- If the user has an active authenticated session on the trusted website, the request is processed as a legitimate request sent by the user.

Andrea warns us that "even though CSRF attacks are commonly associated with session cookies, be aware that [Basic Authentication sessions](https://en.wikipedia.org/wiki/Basic_access_authentication) are also vulnerable to CSRF attacks" and that, in fact, "a CSRF vulnerability relies on the authenticated session management".

[Sandrino Di Mattia](https://x.com/sandrinodm) is a Senior Director on the Product Architecture team at Okta with robust and deep experience in cloud, identity, and security. In the thread, Sandrino commented that the code doesn’t seem to perform any state validation, making it open to CSRF attacks.

You may be wondering like others did: ["CSRF attack without any cookies, must be a new thing"](https://x.com/__morse/status/1858951728852295909). Let's explore how improperly implemented OAuth can lead to a CSRF attack.

## Cross-Site Reference Forgery (CSRF) Are Not About Cookies

Sandrino shares that CSRF is not related to cookies. Missing state validation is the most basic vulnerability in OAuth flows. [OAuth 2.0 specification recommends a `state` parameter](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.1) that allows you to verify the authenticated state of your browser. The `state` parameter preserves the browser's authenticated state set by the client in an authorization request, and the authorization server makes it available to the client in the response.

[The `state` parameter helps you mitigate CSRF attacks](https://datatracker.ietf.org/doc/html/rfc6749#section-10.12) by using a unique and non-guessable value associated with each authentication request about to be initiated. That value allows you to prevent the attack by confirming that the value from the response matches the one you sent.

**But how does a CSRF attack work without cookies?**

Sandrino explains that an attacker can go through the OAuth flow but stop right when the redirect with the authorization code to the callback URL happens. Now, the attacker can send the link to the callback URL, including the code, to the victim, which consumes the code on their machine.

Depending on the implementation of your application, a few security, privacy, and data exploits could happen. For example, the attacker's account is now forced on the victim’s browser. The victim now could be uploading docs or filling in and sending personal data to the attacker's account, thinking it’s the victim's account. Or a worse scenario: the victim is already signed in, and now this new identity (the attacker's identity) is automatically linked to the victim's existing account.

## Prevent CSRF Attacks in Google OAuth

Sandrino advises us that preventing this type of attack takes a few lines of code. In practice, on redirect, you store a random value in a cookie. You then send that value to Google using the `state` param. On callback, you validate the incoming `state` parameter with the value in the cookie. If the `state` value in the response does not match the `state` value in the cookie, you reject the login operation and stop further access. The `state` parameter and PKCE can help prevent this type of attack.

> For a deep dive on this topic, you can consult the ["More Guidelines Than Rules: CSRF Vulnerabilities from Noncompliant OAuth 2.0 Implementations"](https://www.cise.ufl.edu/~butler/pubs/dimva15.pdf) paper from the Georgia Institute of Technology and the University of Florida. Check out section 3.3 on page 8.

There's a saying that goes: "You don't know what you don't know". But then, how can you know? By doing precisely what Klaas did: share code with others and be open to feedback and constructive criticism. At the same time, you can leverage the knowledge and expertise of others who have been through similar and more complex situations, which can help you avoid falling into traps or dangerous holes.

You may be thinking, "I can rely on AI for that!" You can use AI tools to learn and understand, but remember that those tools are imperfect, as they are an aggregation of human knowledge and can also make mistakes. There are instances where an AI tool can present you with "security" code with high confidence. Still, that code could be anything but secure, missing the implementation of security best practices or defensive mechanisms.

## Use Libraries to Implement Google OAuth 

It's important to highlight that if you want to implement a standard protocol yourself, you need to understand its specifications well, be aware of its nuances, and follow its details diligently. Instruments like the `state` parameter and all other security measures included in specifications and standards are the result of discussions and experience of industry experts throughout the years.

As developers, we often fall into the dilemma of reinventing the wheel (do it yourself) or relying on those who have already done it in the best way (use a library).

Sandrino suggested in the thread that it's better to use a library like Passport.js over the code shared on the tweet&mdash;or rather, X post. Passport.js implements OAuth 2.0 the way that the standard defines it. You can inspect the implementation of Google OAuth in Passport.js by looking at the [`lib/strategy.js`](https://github.com/jaredhanson/passport-google-oauth2/blob/master/lib/strategy.js) file of the [`passport-google-oauth20`](https://github.com/jaredhanson/passport-google-oauth2/tree/master) npm package.

The `OAuth2Strategy` from Passport is well-documented. The comments in the code can quickly guide you on what's happening through that flow:

- The Google authentication strategy authenticates requests by delegating to Google using the OAuth 2.0 protocol.
Applications must supply a `verify` callback function that accepts an `accessToken`, `refreshToken`, and service-specific `profile` and then calls another `cb` callback function, supplying a `user`. The `user` value should be set to `false` if the credentials are invalid. If an exception occurs, `err` should be set.

Let's see an example of how you'd use Google OAuth login with Passport.js:

```javascript
passport.use(new GoogleStrategy({
    clientID: '123-456-789',
       clientSecret: 'shhh-its-a-secret'
       callbackURL: 'https://www.example.net/auth/google/callback'
     },
     function(accessToken, refreshToken, profile, cb) {
       User.findOrCreate(..., function (err, user) {
         cb(err, user);
       });
     }
));
```

As you inspect the implementation code, you'll notice that Passport.js does much more than handle the login. [OAuth 2.0 provides consented access and restricts actions](https://auth0.com/intro-to-iam/what-is-oauth-2) of what a client app can perform on resources on behalf of the user without users ever sharing their credentials with the application. Using Google OAuth 2.0, you can also request access to user contacts and other resources on the Google platform. As the needs of your application scale, you may see yourself needing a more complex data access policy that calls for more code to write and maintain and more scenarios and edge cases to be aware of.

## Google OAuth Attacks Go Beyond CSRF Attacks

Security is an ever-evolving landscape. It's critical for you to stay on the vanguard regarding security in the industry, especially with the rise of artificial intelligence (AI). Implementing authentication on your own is an investment in money, risk, and time. Relying on robust, time-tested libraries or identity service providers can minimize some of those costs.

As mentioned in the post, implementing social login with Google OAuth for your app is just one piece of the authentication puzzle. Once you have users, you are responsible for protecting the data they entrust you. For example, depending on the region where you operate, you may be subject to regulations around user management and privacy, such as GDPR, which also extends to logs, not just the user data you have in your databases.

As you scale and grow in popularity, you may also gain unwanted attention from bad actors and attackers who may want what you are securing: rich user data. But, even on a small scale, you may become the target of bad actors looking to test their skills to break into apps.

> Recommended read: [The biggest underestimated security threat of today](https://techcrunch.com/2024/11/01/the-biggest-underestimated-security-threat-of-today-advanced-persistent-teenagers/)

In the X thread we have been discussing, Jared Hanson, the creator of Passport.js and a Principal Product Architect at Okta, validated that "checking a nonce or state is highly recommended." Jared added, "It’s less simple, but it protects against common attacks."

[Aaron Parecki](https://aaronparecki.com/), Director of Identity Standards at Okta, reminded me that it's not just CSRF attacks that are the concern when it comes to OAuth 2.0 flows. Even if you fix the CSRF attacks we have described, you could still be open to an OAuth 2.0 authorization code injection attack, which you can prevent with PKCE. You can learn more about that type of attack by watching the video below: 

<AmpContent>
<amp-youtube
    data-videoid="1ot45WwQWJE"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>
<NonAmpContent>
<div className='embed-container' style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;"><iframe style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;" src='https://www.youtube.com/embed/1ot45WwQWJE' frameborder='0' allowfullscreen></iframe></div>
</NonAmpContent>

Aaron also hosted an "OAuth Happy Hour", which includes [a demo of the authorization code injection attack](https://www.youtube.com/watch?v=moQidjdV5cw). Be sure to check it out!

Let us know if you'd like a detailed follow-up blog post covering the OAuth 2.0 authorization code injection attack.

## Aside: Use Auth0 to Implement Google Social Login

Auth0 makes it even easier to get started with Google. Every new tenant has the Google social connection enabled by default. You don't even have to set up a Google Cloud project to see Google social login in action. Auth0 maintains a set of developer keys you can use to start testing Google social login in your applications in development. Follow the ["Google Social Connection to Login"](https://developer.auth0.com/resources/labs/authentication/google-social-connection-to-login#introduction) lab to learn how to use those Google dev keys and set up ones for production.


Prevent CSRF Attacks in OAuth 2.0 Implementations

eric wu

With over 7 years of experience in product marketing, I am passionate about creating and delivering impactful marketing strategies that drive customer value, business growth, and competitive differentiation. I have a strong background in launching new products, especially in Security, Generative AI and Cloud domains, where I have led several successful end-to-end product releases. I currently work as a Senior Product Marketing Manager at Okta, a leading identity and access management platform that empowers organizations to securely connect their people and technology.

Product Marketing Manager - Customer Identity Cloud

Eric Wu

Edgar Chirivella

I'm an engineer who focuses on creating high-performance solutions to address real-world problems.

When I'm not coding, you can find me playing musical instruments or dancing.

Software Engineer II

Machine-to-Machine Access for Organizations reaches General Availability (GA), unlocking SaaS APIs for developers

Within Auth0 by Okta, the [Organizations](https://auth0.com/docs/manage-users/organizations) feature allows business-to-business (B2B) software-as-a-service (SaaS) providers to manage their partners and customers and to customize the ways that end users access their applications.

Through a programmatic toolset of APIs and SDKs or directly on the Auth0 dashboard, B2B SaaS providers can use Organizations to:

* Represent their business customers and partners in Auth0 and manage their membership
* Configure branded, federated login flows for each business
* Build administration capabilities into their products, using Organizations APIs, so that those businesses can manage their own organizations

Until now, Organizations was limited to *user*-based authentication in browser-based flows — but with the General Availability (GA) of Machine-to-Machine Access for Organizations, B2B SaaS providers can now define the Organization(s) that a given app can access on its own behalf, via the Client Credentials Flow, for each API. This change allows B2B SaaS providers to open up their APIs, enabling machine-to-machine (M2M) use cases while allowing access to sensitive data and operations of each Organization to be restricted to authorized parties.

## Leading Use Cases

Let’s start with a quick look at what’s going on behind the scenes when a customer wants to interact with a B2B SaaS API via Client Credentials Flow. As depicted in the figure below:

1. First, the customer application gets an access token; with Machine-to-Machine Access for Organizations, the token request communicates new context through the `organization` parameter, and the token itself includes the corresponding `org_id `and `org_name`
2. Next, the customer application calls your API
3. Your API server validates that the target Organization for the requests matches the `org_id/name` included in the access token

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/7miaBmd81uEVLmiy2jshWR/22cd99d26b516d7f9564438ffb4341f5/01_saas.png)

Straightforward and familiar, right?

Indeed, by design, these are exactly the claims used in existing user-based Organizations login flows, allowing B2B SaaS providers to implement the same authorization logic for their APIs across both user and machine-to-machine access.

Now, let’s look at the two primary use cases that this additional context enables, using our fictitious [Travel0 company](https://auth0.com/docs/manage-users/organizations/organizations-overview#sample-scenario).

### Open up APIs to third-party applications

Using Auth0 Organizations and the Management API, Travel0 offers a self-service portal where customers can create and manage their own organizations.

Travel0 wants to make it easy for customers to build bots to help end users find and purchase adventures. Accordingly, as part of this portal, Travel0 allows customers to register their applications (e.g., the bots) to consume the Travel0 API on their own behalf.

In this use case, cross-organization access must be correctly controlled so that applications belonging to a particular organization can only access that organization’s data.

Machine-to-machine access for Organizations allows Travel0’s self-service portal to configure Client Credentials access for customer applications by associating them with a specific organization for each API.

<img src="https://images.ctfassets.net/23aumh6u8s0i/55EYuibQQxOqdyZTyPa2iZ/a0c8fe244c7529b84557c9630ec6c39f/02_saas.png" alt="SaaStart"  width="500" >

As a result, the applications of Travel0’s customer *Org X* can only access the Travel0 API within the scope of *Org X*.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/52X8GLuhURskYrc7ffrYCr/5189f8c7556abea89d01f86d3aae6de9/03_saas.png)

To accommodate aggregators, Travel0 could also configure access from a single application to several organizations.

### Isolation of organizations for internal applications

Travel0 also has internal processes and CLI tools that need to access the Travel0 API using the Client Credentials Flow. To apply a unified access control strategy on the API, Travel0 wants requests from its own applications to be scoped to a specific organization so that only the right data is accessed in each case.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5iwaR7wLph96ViCMEH3Tz1/bb2dc31d783483e9d7a99f10198fd14b/04_saas.png)

Travel0’s services aren’t bound to an individual customer, and Machine-to-Machine Access for Organizations enables Travel0 to configure an application to access any organization for each API using the Client Credentials Flow.

## How Does It Work?

### Extending Client Grants

You may have noticed that the use cases outlined above rely on knowing which Organizations an application is authorized to access.

To support this, we’ve built on the existing concept of [Client Grants](https://auth0.com/docs/api/management/v2/client-grants/get-client-grants), which represent the APIs an application is authorized to access via the Client Credentials Flow. You can now use the Client Grants (1) to specify whether an application can or cannot access an API in the context of an Organization and (2) to control which Organizations the Application can access, with two options:

1. Allow an application to access one (or several) specific organizations. This is especially relevant for the first use case.
2. Allow an application to access all organizations. This is especially relevant for the second use case.

Let’s take a look at the details!

### Configuring Machine-to-Machine Access for Organizations

To get started, you'll need to create one or multiple APIs and Organizations. After that, the process consists of three steps for each Application:

1. Create an Application and enable it to use the Client Credentials flow. To learn more, read [Create Applications](https://auth0.com/docs/get-started/auth0-overview/create-applications) and [Update Grant Types](https://auth0.com/docs/get-started/applications/update-grant-types).
2. Create and configure one or more Client Grants establishing the APIs that can be accessed by the Application.
3. Associate each Client Grant with one or more Organizations.

To create a Client Grant between the Application and an API, simply enable the toggle that can be found in the `APIs` tab under Application details:

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/7AuaxeC6y2TSIn6kVkiOPi/8b0b71bf6a1b209a9c0715a1fb8afebf/05_saas.png)

The Client Grant will now have two extra properties:

* **Organization Support: **Configures whether the Client Credentials requests will `deny`, `allow`, or `require` the `organization` parameter. When configuring the Client Grant using Management API, this field will be called `organization_usage`.
* **Allow Machine-to-Machine access to any organization:** Configures whether the Client Credentials requests will allow any Organization within the tenant. By default, access will have to be granted organization by organization. When configuring the Client Grant using Management API, this field will be called `allow_any_organization`.

The Client Grant can also be created and configured for Organization support using Management API:

```
curl -X POST --location 'https://{auth0Domain}/api/v2/client-grants' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "client_id": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga",
    "audience": "https://example-api",
    "scope": ["create:posts", "read:posts", "update:posts", "delete:posts"],
    "organization_usage": "require",
    "allow_any_organization": false
}'
```

If `allow_any_organization` has been set to `true`, you’re all set — jump to [Getting a machine-to-machine token in the context of an Organization](#Getting-a-machine-to-machine-token-in-the-context-of-an-Organization) to discover the next steps. On the other hand, if you only want to allow access to specific organizations, please continue reading.

### Granting access to concrete Organizations

Once the Client Grant has been configured, it’s time to authorize it to access a specific Organization. To do so, navigate to the organization you would like to grant access to and go to the new `Machine to Machine Access` tab. Click on the `Add Access` button and follow the steps to select the application and the API to which your Organization will have access. This will create an Organization Client Grant, which enables this permission.

![alt_text](https://images.ctfassets.net/23aumh6u8s0i/5obFwj3Qrm6G1PO3NppmIn/4b095179337103291548d1a275a00aa3/06_saas.png)

The Organization Client Grants can also be created using Management API. Three new scopes control the access to this new resource:

* create: `organization_client_grants`
* read: `organization_client_grants`
* delete: `organization_client_grants`

This is an example request that will grant access to the  `org_Kpu9Q89v57IaZJVK` Organization for the Application and API defined in the `cgr_kapBApAJV3jYdfQq` Client Grant.

```
curl -X POST --location 'https://{auth0Domain}/api/v2/organizations/org_Kpu9Q89v57IaZJVK/client-grants' \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
    "grant_id": "cgr_kapBApAJV3jYdfQq"
}'
```

### Getting a machine-to-machine token in the context of an Organization

Now that everything has been configured, we’re all set to use the feature. Let’s make a Client Credentials request, passing an `organization` parameter:

```
curl --location 'https://{auth0Domain}/oauth/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'client_id=0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga' \
--data-urlencode 'client_secret=••••••' \
--data-urlencode 'audience=https://example-api' \
--data-urlencode 'organization=org_Kpu9Q89v57IaZJVK'
```

The response received from Auth0 is as follows:

```
{
  "access_token": "eyJhbGciOi...XptRHPuRkw",
  "scope": "create:posts read:posts update:posts delete:posts",
  "expires_in": 86400,
  "token_type": "Bearer"
}
```

Let’s decode the `access_token` payload:

```
{
  "iss": "https://{auth0Domain}/",
  "sub": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga@clients",
  "aud": "https://example-api",
  "iat": 1730308095,
  "exp": 1730394495,
  "scope": "create:posts read:posts update:posts delete:posts",
  "org_id": "org_Kpu9Q89v57IaZJVK",
  "gty": "client-credentials",
  "azp": "0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga"
}
```

As you can see, the `access_token` now contains the Organization ID in the `org_id` claim.

### Default Organization

If you have any restrictions preventing you or your customers from sending an `organization` parameter in the Client Credentials request or want to use a standard OAuth library that does not support Auth0 Organizations, you can set a Default Organization in the corresponding Auth0 Application, which will be used in all the subsequent Client Credentials requests:

```
curl --location --request PATCH 'https://{auth0Domain}/api/v2/clients/0aFYaz2svVw7a5wGuNvvmaiW0pa2Fpga \
--header 'Content-Type: application/json' \
--header 'Authorization: ••••••' \
--data '{
  "default_organization": {
    "organization_id": "org_Kpu9Q89v57IaZJVK",
    "flows": ["client_credentials"]
  }
}'
```

## Additional Resources

Ready to use Machine-to-Machine Access for Organizations? Dive into our comprehensive [documentation](https://auth0.com/docs/manage-users/organizations/organizations-for-m2m-applications) for details.

Need a quick refresher on Auth0 Organizations? Watch our [demo video](https://www.okta.com/customer-identity/#organizations) and browse the [documentation](https://auth0.com/docs/manage-users/organizations).

Want a hands-on experience with essential Customer Identity functionalities in B2B SaaS apps? Check out our reference B2B SaaS app [SaaStart](https://auth0.com/blog/speed-up-your-customer-identity-journey-with-auth0-saastart/).

Your B2B SaaS App Just Got Better

jimena-garbarino

Jimena is an experienced result and value-oriented programmer with a strong engineering background. She excels with Ruby on Rails, Java, and Scrum development. She has worked in web development for 10+ years in many industries and has a master's degree in software engineering from Universidad de Buenos Aires.

Spring Cloud Developer

Jimena Garbarino

Deploy a cloud-native Java Spring Boot microservice stack secured with Auth0 on Google GKE using Terraform and Kubernetes.

Deploy Secure Spring Boot Microservices on Google GKE Using Terraform and Kubernetes

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Customer Identity at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community. 

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [Products That Count](https://productsthatcount.com/) and [Aiven.io](http://Aiven.io).

President, Auth0

Shiven Ramji

We’ve leveled up our Free, Essential, and Professional plans.

Auth0’s vision is to free any consumer or SaaS application user to safely use any technology. This means giving developers the products that make building, deploying, and scaling applications easy. In the last few years, we’ve added more capabilities that allow developers to battle malicious attacks and attackers. 

Today, we’re excited to announce the expansion of the [Auth0 free tier and pricing plans](https://auth0.com/pricing). This makes it even easier for developers to defend against increasingly sophisticated attacks on their customers’ identities and build the next generation of applications securely and reliably.

**TL;DR:**

* Our free plan now includes:

    * 25,000 MAUs so you can scale.
    * Unlimited[^1] Okta Connections & Unlimited[^1] Social Connections so users can easily access your app. 
    * A [custom domain](https://auth0.com/docs/customize/custom-domains) so you can fully brand your authentication.
    * [And more](#Here-s-All-the-Changes-on-Our-New-Free-Plan)...
<br><br>
* Our paid plans now include:

    * 10 [Organizations](https://auth0.com/docs/manage-users/organizations) on B2C Plans and Unlimited[^1] on B2B Plans so you can better manage your customers and partners.
    * Increased MFA offerings so you can mitigate the growing threat of AI-based attacks.
    * The ability to get up to 15 Enterprise Connections in B2B Pro via add-ons, so you get more seamless integration across apps.
    * [And more](#We-ve-Also-Got-You-Covered-as-You-Grow-Your-Applications-and-Customers)...

## Here’s All the Changes on Our New Free Plan

On the new Free Plan, we’ve increased the number of MAUs from 7,500 to 25,000. In addition, you now have unlimited[^1] social and Okta connections. You are also now able to add Organizations and Passwordless authentication to your apps, alongside configuring your own domain. With these updates, you can now scale your app to a larger audience with higher MAUs, enhance your brand identity with your own custom domain, and implement even more social features for your users, all while enabling your users' data to remain secure.

![Here’s All the Changes on Our New Free Plan](https://images.ctfassets.net/23aumh6u8s0i/1OpEw7tXFInO8kmgfqLwFh/16d9c3d29fbfb0278072c57c95f10bb5/01_free_plan.jpg)

## We’ve Also Got You Covered as You Grow Your Applications and Customers

Our new Essentials and Professional Plans have also expanded to help you scale and embed security in your app. Organizations are now included in every plan. Unlimited[^1] Okta connections are now included in all B2C and B2B plans. B2B Pro plans include 5 Enterprise Connections, plus you can add up to a total of 15. Both B2B and B2C Essential plans include custom signup/login. We’ve also increased MFA offerings: both Essentials plans now include Pro MFA, and our Pro plans now include [Enterprise MFA](https://auth0.com/docs/secure/multi-factor-authentication). These updates enable you to have robust security, easily integrate applications with the Okta Workforce Identity Cloud, and better manage your users.

Below are the changes to our paid plans:

![B2C Essential](https://images.ctfassets.net/23aumh6u8s0i/15nIH8v8tJu0fxAi9oa6Du/50151607f231ff7d9392cc5e11488bc2/02_b2c_essentials.jpg)

![B2C Essential](https://images.ctfassets.net/23aumh6u8s0i/4fG78P0kTpiiOiZQRdJ1KN/6871f5467f2845c5bfa85ee4208a997e/03_b2c_essentials_2.jpg)

## Bringing It All Back to You

We hope that these changes make it easier to build, deploy, and scale your app at your pace with the tools you need. If you’re an early-stage company, check your eligibility for our [Auth0 for Startups program](https://auth0.com/startups). We are also proud to offer [preferential pricing for nonprofits](https://auth0.com/nonprofits)—making the leading Identity service even more accessible.

Happy building.

Auth0 now; thank yourself later.

## FAQ:

* **When will the new self-service plans be available?**    
    * All plan updates listed here are available as of September 24th, 2024! Start your free trial [here](https://auth0.com/signup) today.

* **Where can I learn more about this?**    
    * Please visit our [pricing page](https://auth0.com/pricing) to learn more about our plan offerings. Our updated Terms of Service can be found [here](https://www.okta.com/auth0-pss-self-service/).

* **As an existing customer, how do I get access to the new features?**    
    * If you're on a free plan, your entitlements will be automatically applied. If you're on an Enterprise contract, please reach out to your Auth0 account team and they will walk you through your changes.

* **What if I have multiple tenants on separate plans?**    
    * Tenants will need to be grouped via [Auth0 Teams](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#access-the-teams-dashboard).

* **What kind of support is available with these plans?**<br>
Don't worry, we've got your back in the same places you've come to expect.
    * Free plan: please reach out for support on the [Auth0 Community](https://community.auth0.com/).
    * Paid plans: please submit a ticket via the [Auth0 Support Center](https://support.auth0.com/).

* **Why do I need to add my credit card details when adding a custom domain on the free plan?**
    * While a credit card is not required to use the free plan, you will have to add one in order to add a custom domain, purely for validation purposes to prove you are human. If you do enter your credit card information to add a custom domain, rest assured you will never be charged.

* **I’m an existing customer, but not on a B2C or B2B plan. How can I take advantage of the new plans?**
    * You will need to change to a new plan under subscriptions settings in your dashboard, whether you choose to move to the Free Plan or one of our Paid Plans.  

[^1]: _subject to system limitations_

Level Up: Auth0 Plans Just Got an Upgrade

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby, Python, and Elixir.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

There are different ways to implement an authorization system and the one you choose depends on your application's needs. Attribute-Based Access Control (ABAC) is just one of them, so let's go ahead and learn how to implement it in a Rails API.

Previously on your access control series \*read with TV show presenter's voice\*... You learned about [Role-Based Access Control (RBAC) and how to integrate it into your Rails API](https://auth0.com/blog/what-is-rbac-and-how-to-implement-it-rails-api/).
In this blog post, you’ll continue learning about different authorization systems, this time about Attribute-Based Access Control and how to migrate the access control of the expense management API from RBAC to ABAC. 

<details>
<summary>Starting from here?</summary>

If you want to start this tutorial from the beginning, [start from this blog post.](https://auth0.com/blog/what-is-rbac-and-how-to-implement-it-rails-api/)

Clone the application repo and check out the `add-rbac` branch:

``` bash  
git clone -b add-rbac https://github.com/auth0-blog/rails-api-authorization 
```

Make the project folder your current directory:

``` bash  
cd rails-api-authorization
```

Then, install the project dependencies:

``` bash  
bundle install
```

Then, setup the database

``` bash
  rails db:setup
```

Finally, create a `.env` hidden file:

``` bash  
touch .env
```

Populate `.env` using the `.env.example` file:

``` bash  
cp .env.example .env
```

Add your Auth0 configuration variables to the .env file and run the project by executing the following command:

``` bash  
rails s
```

</details>

## What Are Attributes in the Context of Access Control?

Let's consider the use case of the expense management API you are using in this tutorial. For RBAC, you created an `admin` role and assigned it to users using Auth0 Actions. Users with the `admin` role can approve and review expenses, and so far, that's so good. 

The following requirement you have is that only certain users can do certain things on specific expense reports: 

- Users can only see a report they own (submitted by them)
- Users can only see a report if they are the approver
- Users who are approvers can only *approve* reports on weekdays (we don't want people working on weekends!)

With the current RBAC implementation, a user with the `admin` role can do all of these things, but unfortunately, not all admin users need to approve reports. So, as a solution, you think adding these guards to your code sounds good, so **you are going to check the attributes of the report** (the user is either the approver or submitter of this report), the date the report is being approved, etc. 

This practice has a name, and it's called Attribute-Based Access Control.

## What Is Attribute-Based Access Control (ABAC)?

[According to NIST, Attribute-Based Access Control (ABAC)](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-162.pdf) is an access control method where a subject's requests to perform operations on objects are granted or denied **based on assigned attributes of the subject, assigned attributes of the object**, environment conditions, and a set of policies that are specified in terms of those attributes and conditions.

In other words, any access decision that your application makes based on attributes of an entity can be considered ABAC and it'll be specific to your application and access control needs. 

ABAC also gives you more control and granularity over your access decisions, making it more flexible than RBAC. 

Regarding the expense management API, RBAC and ABAC can coexist; in fact, checking for a role or permission is also checking for attributes, in this case, attributes assigned to the user, so we can say RBAC is an implementation of ABAC with a limited scope of roles and permissions. So now, let's say it is a requirement that the user also needs to be an admin to perform the approver actions. Why not? 😛 

Let's look at what you'll need to change in your Ruby on Rails API to comply with the new access control requirements and implement ABAC. 

## ABAC Implementation in a Ruby on Rails API

Let's take a look at the requirements you need to implement: 

- Users can only see a report they own (submitted by them)
- Only approvers can see reports submitted by other users
- Only admin users can approve reports
- Users who are approvers can only *approve* reports on weekdays (we don't want people working on weekends!)

Based on this, there are a few changes you could make to the application; most of them are related to the `report` entity. 

Let's think of the scenario where a **user can only see a report they have submitted, or they are the approver**; you could think of this as multiple things like the user needs to have some relationship with the expense report, meaning they are either the submitter or the approver.

There's little we can do with the relationship example now. Still, you can define that if a user is the submitter or approver of a report, they have some **ownership** over it and are allowed to see that report, so let's start there. 

In the API context, you can define this ownership such that **the user making the request is the same user for which we want to see reports.** At the moment, your API doesn't have the context of the user other than an access token, which tells you only that they are authorized to access your API and that they are `admin` because [you added this role as a custom claim in the access token.](https://auth0.com/blog/what-is-rbac-and-how-to-implement-it-rails-api/#Creating-and-Assigning-Roles-with-Auth0)

So, that's great 🫠 how can you get information from the user in your API using Auth0? The answer is by connecting your Auth0 API and your Auth0 Application!

### Connect Your Auth0 API with your Auth0 Application 

If you have a REST API as your backend, chances are you have a frontend application where your users authenticate and manage their data, etc. 

When you use Auth0, your users can authenticate using [Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login). So, you need to create an Auth0 Application for either a SPA or a Regular Web Application and [integrate it with your code using one of the SDKs](https://auth0.com/docs/libraries). For this blog post, let's focus on the example of the regular web application. 

[When you created the expense management API](https://auth0.com/blog/what-is-rbac-and-how-to-implement-it-rails-api/#Building-the-Starter-Application), you created an [Auth0 API](https://auth0.com/docs/get-started/apis) and an Auth0 Regular Web Application for testing purposes, well now you are going to use this Regular Web Application because in a real-life scenario, your users will probably authenticate themselves *somewhere* and once they're authenticated you proceed to do X or Y in your REST API. 

In the Regular Web Application you created in Auth0 for your users to authenticate, you need to implement login, logout, etc., and you can learn how to do so by following [any of the Developer Center Guides on Authentication](https://developer.auth0.com/resources/guides?type=web-app). Still, the general process is almost identical in all of them, and the outcome is that **you will get an access token from Auth0 issued for the authenticated user.** 
 
Then, you need to tell your Regular Web Application that your users will be interacting with your REST API and, therefore, its counterpart in Auth0, so when you request the access token, you need to provide the `audience` as well. An example of how to do this in a [Ruby on Rails Web application](https://developer.auth0.com/resources/guides/web-app/rails/basic-authentication) would be: 

```ruby
Rails.application.config.middleware.use OmniAuth::Builder do
 provider(
 :auth0,
    AUTH0_CONFIG['auth0_client_id'],
    AUTH0_CONFIG['auth0_client_secret'],
    AUTH0_CONFIG['auth0_domain'],
 callback_path: AUTH0_CONFIG['auth0_callback_path'],
 authorize_params: {
 scope: 'openid profile email',
 audience: 'https://rails-api-authorization', # pass the audience ✨
 }
 )
end
```

Once you pass the `audience`, you'll get a JWT token containing the information about the user, as well as any scopes and claims you've added. To learn more about the audience parameter [you can check out this post.](https://community.auth0.com/t/what-is-the-audience)

That's all you need to do for now in Auth0 to make this work, so let's get back to the code!

### Validate Ownership of the User Making the Request

You already added a method to check for the user's role, so similarly, you could do the same to check for the user's *ownership*. In the context of the expense management app, we'll say: 

> A user is allowed to see an expense report of another user if they are the subject of the access token 

At the moment, you do not store any information about the user's data in your database, but you will need the Auth0 user's ID to compare it. 

#### Add the Auth0 ID to the User Model

Let's create a migration to add a new field to the User model using the following command on your terminal: 

```bash
rails g migration AddAuth0IDToUsers auth0_id:string 
```

The command above will generate a new migration file under `db/migrate/YYYYMMDDHHMM_add_auth0_id_to_users.rb` that looks like this:

```ruby
class AddAuth0IdToUsers < ActiveRecord::Migration[7.0]
  def change
 add_column :users, :auth0_id, :string
  end
end
```

Then, execute the migration by running `rails db:migrate` on your terminal. 

Now, let's add a validation to the User model to make sure the `auth0_id` field is always present and unique. Go to `app/models/user.rb` and add the following code: 

```ruby
class User < ApplicationRecord
 has_many :expenses, foreign_key: :submitter_id
 has_many :submitted_reports, class_name: 'Report', foreign_key: 'submitter_id'
 has_many :reports_to_review, class_name: 'Report', foreign_key: 'approver_id'

 validates :email, format: { with: URI::MailTo::EMAIL_REGEXP }, presence: true, uniqueness: true
  # 👇 new code 
 validates :auth0_id, presence: true, uniqueness: true
end
```

You're all set from the model level. Let's move to the controller level. 

#### Add the Ownership Validation to the Controller

Go to the `Secured` concern in `app/controllers/concerns/secured.rb` and add the following code: 

```ruby
# frozen_string_literal: true

module Secured
  extend ActiveSupport::Concern

  REQUIRES_AUTHENTICATION = { message: 'Requires authentication' }.freeze
  BAD_CREDENTIALS = {
 message: 'Bad credentials'
 }.freeze
  MALFORMED_AUTHORIZATION_HEADER = {
 error: 'invalid_request',
 error_description: 'Authorization header value must follow this format: Bearer access-token',
 message: 'Bad credentials'
 }.freeze
  INSUFFICIENT_ROLES = {
 error: 'insufficient_roles',
 error_description: 'The access token does not contain the required roles',
 message: 'Permission denied'
 }.freeze
  # 👇 new code 
  NOT_OWNER = {
 error: 'not_owner',
 error_description: 'The access token does not belong to the current user',
 message: 'Permission denied'
 }.freeze
  # 👆 new code 

  def authorize
 token = token_from_request

 validation_response = Auth0Client.validate_token(token)

    @decoded_token = validation_response.decoded_token

    return unless (error = validation_response.error)

 render json: { message: error.message }, status: error.status
  end

  def validate_roles(roles)
    raise 'validate_roles needs to be called with a block' unless block_given?
    return yield if @decoded_token.validate_roles(roles)

 render json: INSUFFICIENT_ROLES, status: :forbidden
  end

  # 👇 new code 
  def validate_ownership(current_user)
    raise 'validate_ownership needs to be called with a block' unless block_given?
    return yield if @decoded_token.validate_user(current_user)

 render json: NOT_OWNER, status: :forbidden
  end
  # 👆 new code 

  private
  # ... 
end
```

You are adding a new hash called `NOT_OWNER` to specify the error message in case the user is not the owner of the access token being passed. Then, in the `validate_ownership` method, you're checking the access token and returning an error if the user is not the owner. Since you haven't implemented the `validate_user` method yet, let's add it to the token structure. 

Go to your `Auth0Client` class in `app/lib/auth0_client.rb` and add the following code: 

```ruby
# frozen_string_literal: true

require 'jwt'
require 'net/http'

class Auth0Client

  # Class members
  Response = Struct.new(:decoded_token, :error)
  Error = Struct.new(:message, :status)
  Token = Struct.new(:token) do
    def validate_roles(roles)
 required_roles = Set.new roles
 token_roles = Set.new token[0][Rails.configuration.auth0.roles]
 required_roles <= token_roles
    end
    # 👇 new code
    def validate_user(current_user)
 current_user.auth0_id == token[0]["sub"]
    end
    # 👆 new code
  end

  # Helper Functions
  # ...
end
```

The `validate_user` method checks the `current_user` variable (the user from whom you want to check the reports) against the owner of the access token. In the access token, you have information about the user's ID in Auth0 under the `sub` field, so you are comparing that against the `auth0_id` from the local database. 

Next, call the `validate_ownership` method in the `ReportsController`. You want to validate the user's ownership when they request to review or submit a report, so let's add the validation to the corresponding actions. 

Go to `app/controllers/reports_controller.rb` and add the following code: 

```ruby
class ReportsController < ApplicationController
 before_action :set_report, only: %i[ show approve ]
 before_action :set_user
 before_action :authorize

  # GET users/:user_id/reports/submitted
  def submitted
    # 👇 new code
 validate_ownership(@user) do # user is the owner of these reports
      @reports = Report.where(submitter_id: @user.id) # list only reports where user is submitter

 render json: @reports
    end
    # 👆 new code
  end

  # GET users/:user_id/reports/review
  def review
    # 👇 new code
 validate_ownership(@user) do # user is the owner of these reports
      @reports = Report.where(approver_id: @user.id) # list only reports where user is approver

 render json: @reports
    end
    # 👆 new code
  end

  # GET users/:user_id/reports/1/approve
  # ...
end
```

By adding the `validate_ownership` block in the controller together with the condition inside the query, you are implementing a form of ABAC because you're allowing or denying access based on certain attributes of the user or the report. 

### Validate that Only Approver Users can Approve Reports 

Even though this might be a new requirement, you already took care of this scenario when you first added RBAC. If you look at the `approve` action in the `ReportsController`:

```ruby
class ReportsController < ApplicationController
 before_action :set_report, only: %i[ show approve ]
 before_action :set_user
 before_action :authorize

  # GET users/:user_id/reports/submitted
  # ...

  # GET users/:user_id/reports/1/approve
  def approve
 validate_roles [ADMIN] do # if user is admin
      if @report.is_approver?(@user) # if user is the approver for this report
        @report.status = "approved"
        @report.save
 render json: @report
      end
    end
  end

  # GET users/:user_id/reports/1
  #...
end
```

The check for `@report.is_approver?(@user)` already confirms that 
 `@user` is the approver of `@report`. This is interesting because sometimes we mix up different authorization models without even realizing it, and that's okay as long as it fits your business model. s

### Validate that Approvals Only on Weekdays

You only have to add another validation to allow users to approve expense reports on weekdays, and this is possible by adding a new check to the `approve` action in the `ReportsController`. Go to `app/controllers/reports_controller.rb` and add the following code: 

```ruby
class ReportsController < ApplicationController
 before_action :set_report, only: %i[ show approve ]
 before_action :set_user
 before_action :authorize

  # GET users/:user_id/reports/submitted
  #...

  # GET users/:user_id/reports/1/approve
  def approve
 validate_roles [ADMIN] do # if user is admin
      if @report.is_approver?(@user) # if user is the approver for this report
        # 👇 new code 
        if Date.current.on_weekday? # can only approve on weekdays
          @report.status = "approved"
          @report.save
 render json: @report
        else
 render json: {message: "Can only approve on weekdays"}, status: 401
        end
        # 👆 new code 
      end
    end
  end

  # GET users/:user_id/reports/1
  #...
end
```

[The function `Date.current.on_weekday?`](https://api.rubyonrails.org/classes/DateAndTime/Calculations.html#method-i-on_weekday-3F) returns true if it's a weekday (Mon-Fri) and false otherwise. Users who try to approve during the week will get an error.

At this point, you've fulfilled all the requirements you've received so far! 🚀 It's time to go back to the client and discuss the progress you've made. 

> Up until here, all the changes in the code are available in the [`add-abac` branch of the repository.](https://github.com/auth0-blog/rails-api-authorization/tree/add-abac)

## What About Policies?

You're introducing a lot of extra complexity in the application code that needs to be recreated by each environment, such as web, mobile, CLI, etc. Using a policy engine can streamline application decision-making. 

[A policy](https://csrc.nist.gov/glossary/term/access_control_policy) is a set of rules defining a software service's behavior. There are access control systems like [Open Policy Agent (OPA)](https://www.openpolicyagent.org/), a full-featured policy engine that offloads policy decisions from your software so you don't have to implement it from scratch, or [Policy-Based Access Control (PBAC)](https://csrc.nist.gov/glossary/term/policy_based_access_control), where access control decisions are made based on the business roles of users and is combined with policies.

You won't implement PBAC for the sake of this tutorial, but I thought it was interesting for you to know that decision-making engines like these exist.

## Oh, No. What's Next?

You are showing your implementation to the client, and they're satisfied, but as usual, they came back with more requirements 🥲 

- Users who are managers can see the reports of their directs, plus the reports of their directs' directs, and so on 😵‍💫

You think of a way to implement this with your current solution and... recursiveness 🥲 you know this is possible, but you also start exploring what options are out there for these scenarios. You bump into Relationship-Based Access Control, which seems interesting 🤔 because you feel like basing your implementation on the relationships of your users could work, but you need to do more research. 

## Conclusion 

When we talk about attributes, we refer to properties of the entities of your application; in the expense management application example, we are talking about attributes of a user or an expense report. Attribute-Based Access Control is an authorization model that allows you to make decisions based on these attributes. ABAC gives you more granularity than RBAC because you can specify access control on specific resources other than a role that usually includes more than one resource. 

In the next blog post, you'll learn about ReBAC and its implementations. 

How to Implement Attribute-Based Access Control (ABAC) in a Ruby On Rails API?

Passkeys allow you to authenticate securely, and they're easy to integrate using Auth0. But what happens after that? Let's learn how to list and revoke passkeys using Auth0.

Passkeys are the replacement for passwords, and they're here to stay. If you have been learning about this new technology, you know that it's still relatively new, but adoption is growing daily. 

Passkeys are available in Auth0, Google, Apple, Github, and many other places. So, there's a chance you are already using passkeys or are starting to implement them. 

In this blog post, you'll learn to manage your passkeys in Auth0 using the Management API. 

## What is a Passkey?

A passkey is a phishing-resistant cryptographic key pair that users can use for passwordless authentication. More specifically, [passkeys are FIDO credentials](https://fidoalliance.org/faqs/#PasskeysFAQs) that are discoverable by browsers or housed within native applications or security keys for passwordless authentication.

If you haven't already, you can [get started with passkeys using Auth0](https://auth0.com/blog/activate-passkeys-let-users-log-in-without-password/). After getting your free account, all you need to do is navigate to the [**Dashboard > Authentication**](https://manage.auth0.com/#/connections/database/), select your **Database Connection**, and activate passkeys under the **Authentication Methods** tab.

![passkeys prompt](https://images.ctfassets.net/23aumh6u8s0i/2dkPgFFDBt3H2ebmyuy9hF/1c060396c5078842ee312817e0bedccb/Uploaded_from_Using_Passkeys_for_a_Seamless_Login_Experience_in_the_Apple_Vision_Pro)


## The Passkey Lifecycle

Let's dive deep into the passkey's lifecycle. 

### Creation 

It all starts by creating a new passkey, and this can happen at different moments throughout the lifecycle of your user account:

- **Create a passkey during the registration flow:** When a user signs up for the first time to a website, they can create a passkey for their account. 
- **Add new passkey to existing account:** Multiple reasons could trigger this scenario; for example, you are starting to roll out passkeys to your users, and when they log in, you prompt them to create a new passkey. Another example is when a user gets a new security key or loses the old one and wishes to create a new passkey in their new device. 

When you create a new passkey, your browser will call the `navigator.credentials.create()` method from the Web Authentication (WebAuthn) API. Your authenticator will cryptographically sign a challenge generated by the relying party. You can [learn more about the registration process here](https://webauthn.me/introduction). 

Note that in the creation process, both the authenticator and the relying party, in this case, your server, will persist their records related to the newly created passkey.

### Read

When you use your passkey to authenticate yourself, you are "reading" your passkey. Technically speaking, when you use your passkey, the browser calls the `navigator.credentials.get()` method from the Web Authentication API, which is a read endpoint. 

In Auth0, you can do this using the Management API, and that's exactly what you'll learn in the next section. 

### Update

Updating a passkey might be a misleading term; **you can't update a passkey itself**, but rather, your users can update some attributes that can help them identify their passkeys, such as the display name.

Note that as a developer, you can't update the attributes of a passkey in the relying party, but your end-users can change the display name of their passkeys in their authenticators. 

In Auth0, your user's passkeys names might look like something like `passkey|<some_string>`, but this is actually the ID that is also being used as the name. 

![passkeys list in Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/7uxxwd3qtKHfk0sP3t1NUJ/70faad079091a9272e3eb33861ff8655/Screenshot_2024-05-08_at_16.15.31.png)

### Delete

Revoking or deleting a passkey is an action you must execute with extreme care. It's essential that before revoking a passkey, your users have another factor in place to authenticate themselves. Auth0 will still support the password reset flow for this user, which would allow a user to recover access to their account if all their passkeys have been revoked. 

Note that because both the relying party and the authenticator have their own record of your passkey when you delete a passkey from the relying party, your users may also have to delete it from their authenticator. 

<include src= "LearnPasskeysCTA"/>

## List Passkeys with Auth0

You can see the list of passkeys for a given user using the Auth0 Dashboard, but if you want to retrieve the list to use it in your application, you can use the Auth0 Management API. 

> Bear in mind you need to enable the use of the Auth0 Management API for your Auth0 Application. You can do so from the **Auth0 Dashboard > APIs > Auth0 Management API**. Find the **Machine to Machine Applications** and your Auth0 Application name and toggle the switch to **Authorized**. You might also need to [enable Client-Credentials Exchange](https://auth0.com/docs/get-started/authentication-and-authorization-flow/client-credentials-flow).

A passkey in Auth0 is an authentication method, which means you can use the [`GET  /api/v2/users/{id}/authentication-methods` endpoint](https://auth0.com/docs/api/management/v2/users/get-authentication-methods) to retrieve passkeys for a given user account. The response of this endpoint looks like this: 

```json
[
  {
    "id": "passkey|dev_pzg5wcycfdfd1VZ",
    "type": "passkey",
    "confirmed": true,
    "key_id": "foNlEKGDGREYERxDu3OuXu8sD-rhn1Dsy47HHcwxwg",
    "credential_device_type": "single_device",
    "credential_backed_up": false,
    "identity_user_id": "6657689457685295031f19fb",
    "user_agent": "Chrome 123.0.0 / Mac OS X 10.15.7",
    "public_key": "pQECAyYREGREGRwdnUjPZw9cnElZbv0Q8Axe/NgPBSPmoxJ+86IlggFeeypCWw7eRrgrgrgrrfd5DKYFnarkeoCr6L+1ds4=",
    "created_at": "2024-04-08T15:59:50.762Z",
    "last_auth_at": "2024-04-09T11:35:20.911Z"
  },
  {
    "id": "webauthn-roaming|dev_L7lkgrrgrp4d2x",
    "type": "webauthn-roaming",
    "confirmed": true,
    "name": "carla's key",
    "created_at": "2024-04-26T09:47:15.750Z",
    "last_auth_at": "2024-04-26T09:51:24.089Z",
    "key_id": "O2qqpM1EgSgEaC_NFSOvr0igwNtW91hyGjHNjVCsnjCoLiZzvEvGYOIj_h1SrETGGTRTGRWRk0mmIflkYA",
    "public_key": "pQECAyYgASFYIC9btx34m5xI0Xyr7zpViOVfJQaD2gfDFDDGDFGDFyk2QN6AwjHv1h3Odh+704d8nEbUM1pz+Wf5tyNKTcqg=",
    "relying_party_identifier": "your-tenant.eu.auth0.com"
  }
]
```

In this case, this user has one passkey and one security key enrolled as their authentication methods. To filter them, you can use the field `type` and check for the `passkey` value. 

Here's a code snippet in Ruby that showcases how to call the Auth0 Management API using the [`ruby-auth0` gem](https://github.com/auth0/ruby-auth0). You can find a [list of all the Management API SDK Libraries here.](https://auth0.com/docs/libraries#mgmt)

```ruby
# Initialize the Auth0Client
client = Auth0Client.new(client_id: ENV['AUTH0_CLIENT_ID'],
                         client_secret: ENV['AUTH0_CLIENT_SECRET'],
                         domain: ENV['AUTH0_DOMAIN'])

# Call the Get an authentication method by user id endpoint
passkeys = client.user_authentication_methods(auth0_user_id)

# Select only elements that have the type "passkey"
passkeys = passkeys.select { |p| p["type"] == "passkey" }
```

Where `auth_user_id` is the id of the user in Auth0 (i.e., `auth0|6657689457685295031f19fb` and the values for `client_id`, `client_secret`, and `domain` are set as environment variables. 

The value of the `passkeys` variable would then be: 

```ruby
3.2.2 :010 > passkeys
 => 
[{"id"=>"passkey|dev_pzg5wcycfdfd1VZ",
  "type" => "passkey",
  "confirmed" =>true,
  "key_id"=>"foNlEKGDGREYERxDu3OuXu8sD-rhn1Dsy47HHcwxwg",
  "credential_device_type"=>"single_device",
  "credential_backed_up"=>false,
  "identity_user_id"=>"6657689457685295031f19fb",
  "user_agent"=>"Chrome 123.0.0 / Mac OS X 10.15.7",
  "public_key"=>
   "pQECAyYREGREGRwdnUjPZw9cnElZbv0Q8Axe/NgPBSPmoxJ+86IlggFeeypCWw7eRrgrgrgrrfd5DKYFnarkeoCr6L+1ds4=",
  "created_at"=>"2024-04-08T15:59:50.762Z",
  "last_auth_at"=>"2024-04-09T11:35:20.911Z"}] 
3.2.2 :011 > 
```

## Revoke a Passkey in Auth0

Similarly to listing your passkeys, you can use the [`DELETE  /api/v2/users/{id}/authentication-methods/{authentication_method_id}` endpoint](https://auth0.com/docs/api/management/v2/users/delete-authentication-methods-by-authentication-method-id) to revoke a passkey from a user's authentication methods. 

> Note that before revoking a passkey, you should ensure the user has a fallback authentication factor to allow them to log in. In Auth0, the fallback will automatically be the password reset flow, but you can [enable other factors](https://auth0.com/docs/secure/multi-factor-authentication/multi-factor-authentication-factors#factors).

Here's an example of how to delete an authentication method using the `ruby-auth0` gem to interact with the Auth0 Management API:

```ruby
# Instantiate the Auth0Client if it hasn't been instantiated previously
client = Auth0Client.new(client_id: ENV['AUTH0_CLIENT_ID'],
                         client_secret: ENV['AUTH0_CLIENT_SECRET'],
                         domain: ENV['AUTH0_DOMAIN'])

# Call the delete authentication method endpoint 
client.delete_user_authentication_method(auth0_user_id, auth0_passkey_id)
```

Similarly, here you're reading the values for `client_id`, `client_secret`, and `domain` from the environment; the `auth0_user_id` variable is the user's id in Auth0 and the `auth0_passkey_id` is the passkey's id from Auth0 (i.e., `passkey|dev_pzg5wcyjfdhgkfSC01VZ`)

## Summary 

In this blog post, you learned the basics of the passkey's lifecycle and how to list and revoke passkeys using the Auth0 Management API. You also learned that as an end-user, you could create, read, update, and delete passkeys in your authenticators, and as a developer, you can manage the passkey's lifecycle on the relying party's side.

I’ve Got Passkeys Working in My App! But How Do I Manage Them?

Kelly Hansen

At Okta Customer Identity Cloud, Kelly Hansen serves as a Product Manager specializing in the customer journey. Her interests are in creating seamless experiences for customers to meet their unique goals, ultimately leading to better outcomes for their end users. She loves Okta's vision to empower customers to safely use any technology. When she's not at work, she's tending to her beehive.

Readiness Check performs diagnosis on up to 34 configuration statuses to validate your go-live readiness.

Ensuring your settings meet your intended outcomes is key to taking your solution live in a production environment. Whether you’re committing changes or going live for the first time, the improved Readiness Check tool can help. 

## What Does It Do?

Readiness Check is a tool to diagnose key settings and provide feedback on how to configure said settings to meet recommended practices. Depending on the use case, the tool checks the status of up to 34 tenant settings and displays a pass or fail status for each. 

![Readiness Check](https://images.ctfassets.net/23aumh6u8s0i/2HdHXIUnc2moSpgMaR4tLP/e25d698a71744350c63537375319277a/Readiness_Check_01.png)

The tool allows you to review passed, failed and dismissed checks. Within each check, you are prompted to configure that item or learn more via specific documentation related to the check.

![Readiness Check](https://images.ctfassets.net/23aumh6u8s0i/6rhFhsvjgan2AQKPG0yQnO/3f63e0483f65ef134d10651728e324e8/Readiness_Check_02.png)

As you pass more checks, your Readiness Check progress gauge improves. Dismissing checks that aren’t relevant to you removes them from the Readiness Check progress equation.

Keep in mind: Critical tags refer to checks that have security or end-user implications.  

## How Do I Use It?

We recommend running the Readiness Check on your production tenant prior to taking your solution live for the first time and before committing changes when you update your configuration. With the flexibility that Auth0 offers, leveraging the Readiness tool will give clear insight into the consequences of your tenant’s configuration. 

Locate the Readiness Check in the primary dropdown in your tenant’s management dashboard, or run it from the Settings page of your tenant.

![Readiness Check](https://images.ctfassets.net/23aumh6u8s0i/2D8DTEYn2TMSlFZiJtvusx/901d4b5ddf38c1f680a47676a41efbc1/Readiness_Check_03.png)

![Readiness Check](https://images.ctfassets.net/23aumh6u8s0i/6MegjDoe9SZzo2ln6rGg0M/d78c45b0cccfde4400cd3e27b4f876b7/Readiness_Check_04.png)

## What Else Do I Need to Know?

You can read more about the Readiness Check and the pre-deployment checklist in [this documentation](https://auth0.com/docs/deploy-monitor/pre-deployment-checks/how-to-run-production-checks).

Running the Readiness Check is helpful practice, though not a substitute for a professional performing a Health Check. Please engage with our [Professional Services](https://auth0.com/docs/get-started/professional-services) team for individual attention to your use case.


Security Confidence with the Readiness Check Tool

A walk-through of building a microservices architecture with JHipster, Keycloak, Auth0, and Google Kubernetes Engine (GKE) deployment.

Identity in Spring Boot with Kubernetes, Keycloak, and Auth0

There are different ways to implement an authorization system and the one you chose depends on your application's needs. Role-Based Access Control (RBAC) is just one of them, so let's go ahead and learn how to implement it in a Rails API.

How to Implement Role-Based Access Control (RBAC) in a Ruby On Rails API?

MatthewHughes

I'm a Liverpool-based technology writer with a passion for usability and security. When I'm not churning out copy, you'll find me walking my two dogs: Luna and Apollo

Business Content Writer

Matthew Hughes

Queryable encryption, WASM goes mainstream, and a tighter job market

Developers are used to change. No. It’s a job requirement. Being able to adapt is arguably just as important as your ability to produce clean, secure, and well-documented code. 

The software development industry has always existed in a state of flux. Hot new languages and frameworks displace those that have fallen out of favor. New programming paradigms emerge. Regulatory and threat landscapes shift. It’s life. 

2023 promises to be no different. And yet, different. For the first time in over a decade, the tech job market looks precarious, as macroeconomic trends force businesses to tighten their belts and reassess priorities.

We spoke to some of Okta’s leading developers and product experts for their take on the year ahead. And while they acknowledge the bumpy roads before us, they’re also really excited about the maturation of new technologies that promise to change how developers work. 

![WebAssembly](https://images.ctfassets.net/23aumh6u8s0i/280x2sbDIC1LPoqSMtewzd/535ed2be3070e435de09241a7b241513/developer_works_2023_sep1.jpg)

## WebAssembly Will Make Significant Inroads

HTML5 revolutionized the way developers create rich, visual content for the web. It’s hard to overstate its significance. For the first time, developers could use native web technologies to build dynamic browser-based experiences. 

It was a turning point for the Internet. With the legacy albatrosses of Flash and Silverlight discarded, web developers could finally tap its raw potential. The browser could amaze and enthrall. Ever since then, we’ve asked: “How can we do more?”

Enter WebAssembly (WASM). Introduced in 2015 by the World Wide Web Consortium (W3C), this technology allows developers to eke even more performance from their web-based applications, and arguably more importantly, gives them the freedom to develop for the browser using the language of their choice. 

In short, it’s a language-agnostic virtual machine that delivers performance equivalent to other compiled languages. Or, put another way, it’s fast. Really, really fast. 

Developers write code using a language of their choice — with Rust a popular option. The WASM compiler then produces a machine code and human-readable equivalent. The latter is broadly analogous to assembly language, although looks far removed from the x86 code you wrote during your undergraduate years. Squint and you might mistake it for Clojure or Common Lisp. It’s beautifully parenthetical, with instructions structured in a hierarchical indented tree format.

That was the high-level explanation. For the sake of expediency, I glossed over some important nuances. Most importantly, I should make it clear that WASM isn’t just for the Web, although that’s a popular use case. The WebAssembly System Interface (WASI) APIs allow you to use WASM in the places you’d normally use things like Node.js. 

I should also point out that language support remains patchy. Some languages have WASM compilers for the web, but not WASI. Others support WASI, but don’t make it easy to write browser-based code. As with most things, your mileage will vary. 

Caveats notwithstanding, WASM is currently on an upward trajectory, and Joël Franusic, CIAM Specialist at Okta, expects its use to explode in 2023. Growing numbers of businesses and individuals will use WASM in their products and projects. 

“More and more languages can now compile to WASM. Admittedly, support isn’t quite where it should be — but it’s so close you can almost taste it,” he said. 

He’s not wrong. Most languages have some degree of WASM support, whether via native tools (like Rust’s wasm-pack) or third-party alternatives, like TinyGo for GoLang. That support is only growing. 


## Businesses Will Invest in Developer Efficiency

Developer productivity is always in vogue. Open Hacker News on any given day and you’ll find a new framework or tool that promises to shorten the time between releases and accelerate the development of new features.

Admittedly, many of the biggest facilitators of improved developer productivity emerged during the most fertile years of the tech industry.

The halcyon post-2010 era, when VC money flowed freely and technology businesses had seemingly-limitless resources. coincided with the mainstreaming of DevOps and CI/CD, the emergence of cross-platform development frameworks like Flutter and React Native, and the growing popularity of microservices-based architectures. And that is, by no means, an exhaustive list.

This push to GSD (get stuff done — you can substitute ‘stuff’ for your preferred curse word’) isn’t new. But 2023 will bring a greater urgency for businesses to adopt technologies that help developers quickly write secure, scalable, and performant code.

As Bhawna Singh, SVP of Engineering at Okta, explains: “Given the economic trends we’re seeing, companies will look to improve their developer productivity so they can do more, while keeping product trust high.”

Businesses will invest in technologies that seamlessly slide into existing developer workflows, and will help engineering teams eliminate release and development friction without compromising security, compliance, or reliability.

“Developers face growing pressure to release features faster, but they’re also expected to write code that’s scalable and secure. The focus for teams will be to make the right integration, automation investments, ” Singh added.

> “Tools supporting low-code/no-code options will be of value in accelerating time to market. as developer efficiency entails not only keeping an existing developer force productive, but also being able to onboard new developers quickly and enabling them to make high quality contributions faster.”

It’s not just tools. Singh believes 2023 will see engineering and security teams become more closely integrated as companies embrace the “shift left” approach to software development.

As explained previously, this approach sees security personnel take an active role in the design and development of applications, as well as the training of engineering staff.

By addressing security issues before they reach production, businesses can release stronger and more robust applications, while simultaneously reducing the monetary cost associated with fixing a vulnerability. 

Given the lean months and years ahead, it’s no surprise the “shift left” approach is about to hit the mainstream.

![Efficiency](https://images.ctfassets.net/23aumh6u8s0i/1rabbt78ePblwoBEDhDXcx/52a6962a11716f8277bb120bff8f5f96/developer_works_2023_sep2.jpg)

## Queryable Encryption Enters the Mainstream

One of the biggest cryptographic advances in recent years is “Queryable Encryption.” It’s exactly what it sounds like. The ability to execute search queries on encrypted data, without first having to decrypt it. 

Queryable encryption had previously languished on the fringes of academia — theoretically possible, but difficult to perform in any practical sense. Not only did it require a high level of understanding in order to execute securely, it also came with a steep computational cost. But that’s beginning to change.

Aïda Diop, Software Engineer, IAM Crypto at Okta, believes that Queryable Encryption is on the cusp of mainstream success. 

The [cryptography expert](https://auth0.com/blog/a-primer-on-cryptography/) highlights the recent launch of MongoDB’s Queryable Encryption feature, which she says will help popularize this feature. 

“The ability to search encrypted data is a major research area in crypto, but it presents a number of challenges. These are mostly due to performance issues, and the difficulties in developing complex search functions on encrypted data,” she said. 

MongoDB’s Queryable Encryption, she said, promises to change that. Diop, who is actively experimenting with the feature, described it as “exciting” with the potential to bring real security and privacy benefits. 

As Queryable Encryption allows businesses to analyze and process encrypted user data, we’ll see an expansion of the things they choose to encrypt. On a basic level, it dramatically expands the list of things that can be secured with end-to-end encryption.

> “One interesting use-case is where users want to look up their data, but they don’t want their service provider or its employees to have access to that data in plaintext,” Diop added. 

## Developers Will Adapt to a Tightening Tech Job Market

After a booming decade for tech jobs, the market is now set for a dramatic contraction, driven by wider macroeconomic turmoil. Already, we’re starting to see the early signs of what promises to be a brutal few years for developers, with Twitter, Facebook, and Salesforce all announcing major layoffs. 

Cassio Sampaio, Senior Vice President of Product at Okta, believes both businesses and individuals will need to adapt in the face of these trying conditions. 

As engineers plan their personal development, they should focus on the skills that can bring value wherever their career takes them. “Reusable skills matter a lot,” said Sampaio. “Developers should brush up on the skills that are more widely needed as teams are reorganized to meet this new reality.” 

Businesses, meanwhile, should seek to improve efficiency by investing in tooling that improves efficiency and productivity. “Every dollar counts,” Sampaio argued. “Your developers should focus on core business needs, rather than trying to build everything under the sun.” 

![Developer-First](https://images.ctfassets.net/23aumh6u8s0i/1xL11M3kvAG33UWVT0dfAK/f65c7984e18dd7a1f7ece98859a6ed48/developer_works_2023_sep3.jpg)

## A “Developer-First” Culture Means Respect and Authority

It’s not all bad news for engineers. Although the pandemic years of 2020 and 2021 were undeniably trying, they were at least accompanied with a booming job market for developers, and workplace changes that allowed for fully-remote teams. 

Developers were always a hot commodity — especially in the competitive tech hubs of Silicon Valley, London, and New York. The shift to remote working gave developers greater choice in who they worked for. They could be more discerning. 

As a result, many companies placed greater emphasis on wooing tech talent. They created “developer-first” cultures. 

Ana Cidre, Developer Advocacy Manager at Okta, expects this trend to continue, even throughout the tightening tech job market. But it’s not just perks that define a “developer-first” culture. It’s also defined by developers being placed in greater positions of decision-making authority. 

And for B2B tech businesses, developers are now a key buying persona. “It’s incredible to see how companies are creating communities and thinking about the developer first. In my opinion, the pandemic drove this trend. Developers aren’t merely more respected, but also more accessible,” she said. 

## The Rise of Rapid Coding 

The 1990s were a simpler time. Software came in big cardboard boxes — or as floppy disks buried within thick manilla envelopes. Patches and bug fixes were calendar events, happening relatively infrequently by today’s standards. And with computers a relatively small part of our lives, the stakes were lower. 

Now software is less of a product and more of a service. It’s something we rely upon, and we expect it to improve from day to day. Few (if any) are prepared to tolerate months-long waits between bug fixes. 

Developers need to be faster than ever. To meet their customers’ need for immediacy, they will have to fundamentally change the way they work. Fortunately, the modern developer apparatus is well-geared towards agility. Businesses can write, test, and deploy a software update in a matter of minutes. 

But there’s more that can be done. Joël Franusic, CIAM Specialist at Okta, is particularly intrigued by the approach taken by Glitch, which was in turn acquired by serverless computing pioneer Fastly earlier this year. 

Glitch and Fastly come from two different worlds, but there are obvious synergies between the two companies. While Fastly started life in the CDN (content delivery network) space, it has since placed greater emphasis on containerization — allowing developers to package their applications as low-footprint, low-dependency units that can rapidly scale and deploy. 

By contrast, Glitch is a playful, web-based developer sandbox. It describes itself as a “yes code” company. Developers can build and execute code directly in the browser and see the effects of their changes in real-time. It offers a level of immediacy that you don’t typically get within traditional developer environments. 

Fastly has promised a hands-off approach to its latest acquisition. It doesn’t want to change the formula that made Glitch popular in the first place. But it does seek to extend Gitch’s technology to a broader audience, particularly those who write code for work — not merely fun. 

Franusic doesn’t just find this prospect enticing — he thinks it has the potential to fundamentally change the ways developers work. 

“When Glitch and Fastly complete their integration, I think we’ll see a growth in rapid development. Glitch makes it ridiculously easy to make the quick changes that comprise most day-to-day software updates, but in a way that’s also highly visible, easy to test, and simple to document,“ he said. 

![Passkeys](https://images.ctfassets.net/23aumh6u8s0i/5rywMgNpd8I4LXCyPWhM1Y/617c949355943892e458e83ed61e1ce8/developer_works_2023_sep4.jpg)

## The Debut Year of Passkeys

Vittorio Bertocci, Principal Architect at Okta, eagerly awaits the mainstreaming of passkeys as a widely-used authentication method for both businesses and consumers. 

“For the past decade or so, every year has been the year we finally get rid of passwords. It’s the identity industry’s equivalent of the ‘Year of the Linux Desktop.’ And while 2023 will be no exception, I do think we’ll make some significant inroads to a glorious passwordless future this year,” he said. 

“Apple, Google, and Microsoft all [delivered (or promised) support for passkeys](https://arstechnica.com/information-technology/2022/10/passkeys-microsoft-apple-and-googles-password-killer-are-finally-here/) — a new take on FIDO2 authentication that makes it possible to use biometric authentication across multiple devices.” 

A major differentiator between passkeys and existing FIDO2 platform authenticators is that they’re backed up in the cloud and aren’t tied to specific devices, allowing them to be used across the various devices the user owns within a given ecosystem (iCloud, Google, etc). This, Bertocci said, is a “game changer.”

“Passkeys have the potential to bring phishing-resistant authentication to the masses. They’re a massive improvement over passwords, but they do present some challenges, particularly in workforce use-cases.” 

“Workers may find themselves using passkeys as consumers, but unable to do the same at work. In some cases, use of personal devices at work will become problematic, as passkeys require cloud sync to function on some platforms, and administrators aren't keen to allow that. This — and many other yet-unidentified challenges — will complicate the rollout of passkeys, but it’s clear we’re going in the right direction,” he said.

How Developers Will Work In 2023

Oliver Wang

A product manager at Auth0 focuses on  Ecosystem and Extensibility.  With an engineering background, Oliver always puts developers' experience first.  He has mixed industrial experience as a Product Manager, Software Engineer and Data Analyst. This diverse profile unites different team members to deliver value to our customers. Besides work, you can catch him up on a ski hill in the Canadian Rockies.

Product Manager, Ecosystem

I am a curious and driven person. Until my early twenties, I was one of the top-ranked Canadian slalom skiers. While still competing, I pursued dual business majors at a Liberal Arts college in Nevada, funded by academic and athletic scholarships. I then joined EY in Montreal, where I worked with all of the four major service lines and earned my CA title. I now work with the Valuations and Business Modelling group and I am pursuing my CBV designation. 
<br>
I am also a self-taught computer programmer. I am comfortable in any number of programming languages. I built a website and steward a community of thousands of people across the world who rely on and benefit from its services every day.

Customers can now add custom prompts or factors in their post-login flow

We are excited to share that our customers that use Actions -  Auth0’s flagship extensibility product - can now add custom prompts or factors in their post-login flow. This enables developers and partners to confidently record the completion of a factor upon returning after a custom redirect. Auth0 delivers more tools, features, and options for developers to give them the support and capabilities they need to customize their customer’s experience through pro-code flexibility.

We have introduced a new method to the API of post-login Actions when continuing the flow after a successful custom redirect. This method allows a customer and/or partner to store the completion of that custom factor right in the user’s session. What is powerful about this is that they can then check whether that customer record is in a user session in each login and skip that prompt if it’s there already. Because it’s stored in the user session itself, it benefits from any current and future session management features within the Auth0 product offering.

## What Is the Problem We Are Solving?

Historically, there was no good way for customers to use Actions to securely implement custom prompts or custom factors in a user-friendly way. They could use user metadata or application metadata, but those objects exist across all user sessions. There was also no good way for customers or partners to see whether a user on a specific device had completed the necessary factors to login. This meant forcing users to re-perform the custom prompt or factor more often than necessary.

As an example, let's say you’re a developer for a banking app that has a special requirement to use a custom multi-factor authentication service, and you want that authentication to be associated with a user's session and or device for added security. That is where the ability to add a custom prompt enables you to build that customer experience and address that need.

## See It in the Real Example!

Let's take a look at a real example! Below is a sample Actions code for a Partner Integration implementing a custom authentication factor.

On the `onExecutePostLogin`, we trigger the custom authentication method by using Actions Redirect to send users to the customer method URL with session token information.

```js
const CUSTOM_METHOD_URL = "https://path.to.prompt";
const PROMPT_TTL = 1000 * 60 * 60 * 24; // 24h

exports.onExecutePostLogin = async (event, api) => {
    if (
        !event.authentication?.methods.some((record) => {
            // Timestamps are rendered as IS08601 strings
            const timestamp = new Date(record.timestamp);

            return (
                record.name === CUSTOM_METHOD_URL &&
                timestamp.value0f() >= Date.now() - PROMPT_TTL
            );
        })
    ){
        const sessionToken = api.redirect.encodeToken({
            payload: {
                user_id: event.user.user_id,
            },
            secret: event.secrets.SESSION_TOKEN_SECRET,
        });

        // Trigger our custom authentication method
        api.redirect.sendUserTo(CUSTOM_METHOD_URL, {
            query: { session token: sessionToken }
        });
    }
};
```

Continue with `onContinuePostLogin`, we validate the session token secret and record the completion of our custom authentication method.


```js
exports.onContinuePostLoqin = async (event, api) => {
    const payload = api.redirect.validateToken({
        secret: event.secrets. SESSION_TOKEN_SECRET,
        tokenParameterName: 'session_token'
    });

    if (!validateSessionToken(payload)) {
        return api.access.deny('Unauthorized');
    }

    // Record the completion of our custom authentication method.
    // THIS NEW API IS ONLY AVAILABLE IN 'onContinuePostLogin'
    api.authentication.recordMethod(CUSTOM_METHOD_URL);
};

function validateSessionToken(payload) {
    // Custom validation logic would go here
    return true;
}
```

Actions is an iterative platform we continually improve upon. [Start creating your Auth0 Actions](https://auth0.com/docs/customize/actions/write-your-first-action) today and customize your logic flow with the seamless low-code integration with Auth0!

New Actions Feature: Build Your Own Custom Factor

500x500

I'm a software engineer, but I prefer to call myself Technology Bishop. Spreading knowledge through writing is my mission.

Antonello Zanini

Learn why you may need custom error responses on 4xx errors, what a good custom format looks like, and how to apply it to your error responses in Express.

How To Implement Custom Error Responses in Express

Uploaded from Data Pipelines on Auth0’s New Private Cloud Platform

Andrew is a Staff Engineer at Auth0 focusing on bytes that move for the new Auth0 platform. He is a startup co-founder with over a decade of experience delivering developer focused products at scale. When not at the computer, you can find him hiking up mountains, watching improv comedy, or spending quality time with his wife and son.

Andrew Hawker

“Data goes in; data goes out. You can’t explain that.”

**TL;DR:** Auth0 has replatformed our private cloud offering onto Kubernetes. As part of this new architecture, we’ve had the opportunity to apply modern practices to the data infrastructure that powers near real-time features and provides the necessary knobs for data governance.

_Hello friends! Before we get started, I recommend that you check out “[A Technical Primer of Auth0’s New Private Cloud Platform](https://auth0.com/blog/a-technical-primer-of-auth0-s-new-private-cloud-platform/)”, “[Architecture of the New Platform](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/)”, and “[Security of the New Platform](https://auth0.com/blog/securing-auth0s-new-private-cloud-platform/)”. These wonderful posts cover foundational aspects of the platform that I will build upon here._

## Introduction

“Data is the new oil,” quipped Clive Humby in 2006, and the industry has been chanting “Drill, baby, drill” ever since. Just like oil, data needs to be refined/processed/transformed to unlock its full value. As the saying goes, “Necessity is the mother of invention,” so the industry has birthed an entire specialization around Data (Science, Engineering, Platform, Warehouse) to extract that value. The analogy remains apt because, just like oil, data is now being respected as a potentially hazardous material. With GDPR, CCPA, and their future brethren, we’ve come to understand the importance of proper packaging and safe keeping of our data assets. No more ziplock bags of data goop in the trunk of my Dodge Neon. Neatly stacked steel crates with big padlocks under 24/7 surveillance that can be crypto shredded at a moment's notice is the future of data management. With this New Platform initiative at Auth0, we’ve had the opportunity to apply some modern practices to our data infrastructure and take another step towards that dystopian data future.

![Introduction](https://images.ctfassets.net/23aumh6u8s0i/5GGILFTY6KNSabp6Ixn2dA/1b6a7923fa10b614f320c94cf436c2b9/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

Taking a page from Leo’s 10k foot view in “[Architecture of the New Platform](https://auth0.com/blog/the-architect-s-view-of-auth0-s-new-private-cloud-platform/)”, we’ll be touching on the highlighted sections of the platform in this post. We’ll start with some introductory context, discuss our guiding principles, dive into the tools we chose, and then exercise them with a few sample scenarios commonly seen at Auth0.

Put down that bag of data goop, and let’s get started!

## What is a Data Pipeline?

_“In a world where SaaS and microservices have taken over...”_ — Movie Voiceover Guy

*Looks around*

“Hey, he’s talking about us!”

Software is on a hockey stick growth curve of complexity. We’ve got an ever-increasing number of disparate systems hoarding data and even higher demand on us to unlock value from it.

1. “Show me the region where credential stuffing attacks are originating from” — A customer dashboard
2. “Let me run custom code in an Auth0 Action immediately after a user is deleted” — A feature request
3. “Show me failed login counts from the past 60 days for all tenants on the Performance tier that have been a paying customer for more than one year” — An upsell opportunity

Before we can begin to actually answer any of those questions, we need the connective tissue to ship data from Point A to Point B enriched with E and transformed by T. That’s the role of the Data Pipeline.

That’s not to say that Data Pipelines just carry simple domain/product events. Application logs, exception stack traces, Stripe purchase orders, Salesforce billing updates, etc., are all events that can be emitted and flow through a pipeline.

_“The Data Pipeline is a series of tubes.”_ — Michael Scott

Eh, close enough.

## Our Guiding Principles

Before jumping into implementation, it’s important to understand that _our_ requirements are not necessarily _your_ requirements. The decisions we’ve made might not be the correct decisions for you! When evaluating solutions and discussing tradeoffs, these are some of the key points that helped guide us.

### Event Durability

Event durability is a supremely important requirement for us; missing and out-of-order events are a non-starter.

If we imagine emitting a simple event, e.g., “UserCreated,” there are a few approaches:

1. Integration/domain event from application code
2. [Outbox Pattern](https://microservices.io/patterns/data/transactional-outbox.html)
3. [Change Data Capture (CDC)](https://en.wikipedia.org/wiki/Change_data_capture)

Discussing tradeoffs between these is a blog post in itself, so I’ll just simply say that they’re complementary and fit different needs, with the main tradeoff being durability vs. coupling.

Events emitted by application code can get lost with failures during dual writes. Outbox Pattern struggles if you don’t have strong transactional guarantees with your database of choice and doubles your write load. Change Data Capture (CDC) is the most durable of the three but “ships” the database table schema in each event, promoting unnecessarily tight coupling and having limited access to only the modified row.

### Data Governance (O Data, Where art thou?)

Data Pipelines come in different shapes and sizes.

* Are messages serialized as Avro, JSON, or Protobuf? XML? _Crickets._
* Are they encrypted or plain text?
* What is the expected throughput? Sustained or burst?
* Streaming or batch processing?
* Do producers retry or drop events during downtime?
* What enrichments/transforms do we need to apply?

Before discussing these technical details of a pipeline, we must first consider what is **_in_** the pipeline.

1. Do messages within the pipeline contain Customer Data?
2. Do messages within the pipeline need to leave the region where they originated?

If you answered “Yes” to one or more of the previous questions, calmly go outside and light your computer on fire. Joking aside, by asking and answering those questions, you can begin to understand the security/compliance posture you must take. This is likely to lead you down the road of even more questions.

* What region is data being shipped to relative to where it’s generated?
* Are we sending aggregated data or individual records?
* How is this data encrypted in transit and at rest?
* What Customer Data (down to each individual field) are we processing?
* Are there treatments that are sufficient for each field to be compliant while still fulfilling the business need? Masking, partial redaction, hashing, encryption, etc.

Remember that data is a valuable resource but can also be a hazardous material and must be handled properly. If you discover cases of processing Customer Data and shipping it across geographic boundaries, find yourself a buddy in the compliance department to help sort it out.

### Inertia

Event streaming technology is an active area of development, with many new companies and products entering the space. This is great because we can stand on the shoulders of giants, but if you’re not careful, it can leave you prone to painful churn, deprecation, incompatibility, or entire products going bust.

While we don’t want to fully jump into the [Boring Technology Club](https://boringtechnology.club/) pool, we _do_ want to build on robust tools that will survive a hype cycle. If a project doesn’t have enough inertia and community buy-in to survive the departure of the original stewards, it might be best to consider an alternative.

### Composition

The only constant in life is changing, especially technological and business requirements. We need to consider how our technology choices can be composed, merged, bent, broken, and smeared together to get the job done. If we choose a solution too rigid, it’ll be re-written often. A solution too flexible is unlikely to be fully understood. We should try and use tools that provide a healthy balance.

## It's Dangerous to Go Alone! Take This

We’re not the only company building on data pipeline technologies, thankfully. We can stand on the shoulders of those before us. Using our guiding principles outlined above, here’s the alphabet soup of open source technologies we chose to plug together to make our data go.

#### Kafka

The original Auth0 platform was built to run only on AWS and heavily leveraged Kinesis, SQS, and RabbitMQ. When evaluating cloud-agnostic solutions for the new platform, it was difficult to say no to [Kafka](https://kafka.apache.org/). With most cloud providers offering a hosted solution (or API-compatible layer), it’s becoming the lingua franca for durable event backends. With relatively sane approaches to implementing encryption at rest or in-flight, it meets most of our needs right out of the gate.

#### Kafka Connect

[Kafka Connect](https://docs.confluent.io/platform/current/connect/index.html) has a solid ecosystem of integrations that is relatively plug-and-play (although schema vs. schema-less can be a pain). The [AWS S3](https://docs.confluent.io/kafka-connect-s3-sink/current/overview.html) sink connector was available to us immediately, and an open-source [Opensearch](https://github.com/aiven/opensearch-connector-for-apache-kafka) connector popped up quickly after the Elasticsearch license fork snafu.

[Single Message Transforms (SMT)](https://docs.confluent.io/platform/current/connect/transforms/overview.html) within a connector are simple mechanisms for stateless transformation/enrichment of all messages. This works well for us to inject static metadata from the new platform like Space, POP, Cloud, current deployment version, etc.

#### Schema Registry

Kafka Connect heavily utilizes the[ Confluent Schema Registry](https://docs.confluent.io/platform/current/schema-registry/index.html) for message serialization and validation. While some connectors support “schemaless” messages, you’ll find yourself, as we have, swimming upstream if you don’t leverage the registry with these tools. We haven’t fully realized our vision here and plan further investment over the next few quarters.

#### Debezium

As I mentioned before, event durability was an extremely important requirement for us, so we started with Change Data Capture (CDC) powered by [Debezium](https://debezium.io/). With their [MongoDB](https://debezium.io/documentation/reference/stable/connectors/mongodb.html) and [Postgres](https://debezium.io/documentation/reference/stable/connectors/postgresql.html) source connectors, we’re immediately plugged into the Kafka Connect ecosystem.

#### Data Shield

When it comes to data policy enforcement for streaming messages, there didn’t seem to be many free/open-source solutions we could take off the shelf. For this, we wrote our own in-house solution in [golang](https://go.dev/).

Data Shield handles data policy enforcement with schemas, data mutation, and topic muxing. With it, we can define events flowing through a topic using an IDL like [protobuf](https://developers.google.com/protocol-buffers). The IDL is not tied to the serialization format in the topic, e.g., we can use a protobuf IDL for JSON events.

Let’s walk through a quick example. Let’s say we emit events of Company records that have a field for their EIN.

```
message Company {
  string name = 1;
  string address = 2;
  string ein = 3;
  string url = 4;
}
```

Field enforcement is zero-trust by default, so any fields not defined in the IDL are automatically excluded. This is a critical capability for us since we receive many JSON/BSON-based events with loose schemas where fields can easily be added/removed by the upstream producer. This minimizes the blast radius of an upstream service accidentally or intentionally producing new fields with Customer Data on streams that leave the region.

Using the IDL, we annotate fields with policy details like classification and treatment rules. From our Company example, let's assume the **_ein_** field is classified as Personally Identifiable Information (PII). We could model this as:

```
  string ein = 3 [
    json_name = "ein",
    (auth0.proto.options.fields.v1.classification) = {
      classification: PII,
    },
    (auth0.proto.options.fields.v1.transform) = {
      processor: {
        name: OPENSEARCH,
        transforms: [
          { mask: { length: 4, character: "*", reverse: true } }
        ]
      },
      processor: {
        name: FRAUD_DETECTION,
        transforms: []
      },
      processor: {
        name: EU_DATA_LAKE,
        transforms: [
          { drop: { } }
        ]
      },
      }
    }
  ];
```

Each separate data processor of the stream can apply their own independent rules based on their business function. In this case, our Observability stack in Opensearch has the last four characters masked, our Fraud Detection feature receives the value in plain text, and the Data Lake processor in the EU doesn’t receive it at all.

With this IDL definition and some minor service configuration, we can tell Data Shield to enforce the policy on one or more topics. In the simple case, it will take the incoming “dirty” topics and output “clean” topics, one for each data processor with their specific rules applied.

![IDL](https://images.ctfassets.net/23aumh6u8s0i/3ka0jensdx70UoBfYmdnrd/c85e55476cde1771e397710a63058d61/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

This multiplexing increases our storage costs but allows us to leverage different retention policies and Kafka ACLs so consumers can only access data from their assigned topics. While this is a cost we are (currently) willing to pay for strict data isolation, it is an area for future investment with a potential “decryption and schema enforcement on reading” strategy.

As we’ve iterated on the Data Shield concept, we’ve added a few more features to make our lives easier.

* One-to-many topic to IDL schema mapping for topics with heterogeneous message types. This is very helpful for topics that contain app/service logs.
* Schema format conversions, e.g., read JSON, write Avro
* Extend IDL to support field enrichment with generated runtime values
* Golang API for pluggable actions to modify processing pipeline as events flow through
* Rate-based sampling for sinks that can be overwhelmed

## Scenarios

With our guiding principles leading us to those tools, let’s diagram out a few simplified versions of scenarios we run on the new Auth0 platform.

### Application logs for incident response

In this scenario, we’re using [Fluent Bit](https://fluentbit.io/) to consume service logs from all pods within the Space Kubernetes cluster. They’re shipped to Kafka, where Data Shield consumes the raw log messages, applies its enforcement rules, and produces them back to Kafka. They’re consumed by Opensearch connectors, who ship them across the private link to the POP, where they’re accessible to Operations teams for incident response.

![Application logs for incident response](https://images.ctfassets.net/23aumh6u8s0i/5LkE9v6OyZJpJA85G1lJM7/1e3a523222efba8065f4359b47e456c4/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

### Events for autocomplete search

In this scenario, we’re using Debezium to consume MongoDB change streams to emit events for Auth0 Users into Kafka. Data Shield consumes them, applies its enforcement rules, transforms the structure, and produces them back to Kafka. They’re consumed by another service that processes them and writes them into Postgres running in the same region.

![Events for autocomplete search](https://images.ctfassets.net/23aumh6u8s0i/6WCxg7eRdAuOdGm0MslthE/2886847192f02ae1b1c1cdef18514760/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

### Event counts to a data lake

In this scenario, we’re using Debezium to consume the Postgres logical replication protocol to emit events for Auth0 Connections into Kafka. Data Shield consumes them, applies its enforcement rules, and ships them back to Kafka. They’re consumed by S3 connectors that ship them to an S3 bucket running in a different region.

![Event counts to a data lake](https://images.ctfassets.net/23aumh6u8s0i/4BlUDX70CAZfZ0wl1JOU39/5ce6cf28061d37de489e51bede949ea6/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

### User requested backups 

In this scenario, we're emitting product events for Auth0 Tenants into Kafka. Prior to processing by Data Shield, they’re backed up in-region to object storage. The backups are then periodically rolled up and offered as a data download upon user request in a dashboard.

![User requested backups ](https://images.ctfassets.net/23aumh6u8s0i/6PzHrtwKWMgRzKsp7Hun2V/ee40263dbe880df9975304e07d517945/Uploaded_from_Data_Pipelines_on_Auth0_s_New_Private_Cloud_Platform)

## We’re Just Getting Started

Although these sample scenarios aren’t terribly complex, they really show the power of composability. We can mix and match a few Kafka connectors with Data Shield to meet the needs of our customers while providing the data controls we require. With more data-intensive use cases on the horizon needing stream processing and OLAP databases, this composability means our pipelines can easily evolve to support them. More importantly, even with a team experienced in stream processing and OLAP databases, we’ll still plan an R&D phase to make sure our choices once again align with our guiding principles.

Interested in hearing more about streaming joins, windowing, and OLAP databases? Well, you’ll have to wait for my next blog post then! Muahaha.

I would be remiss if I did not tell you that Auth0 (and specifically my team) are [hiring](https://auth0.com/careers)! Join me in building the next Auth0 data platform solving real problems for real people. Interested in solving problems for fake people instead? Visit the social network nearest you.

Data Pipelines on Auth0’s New Private Cloud Platform

Salman Ladha

As a Product Marketing Manager, I’m responsible for communicating the value of identity for SaaS application builders and our public sector vertical. I’m particularly passionate about the role identity plays in accelerating business growth, promoting product adoption, and establishing trust. Outside of work, you can catch me reading, working out, or watching the latest Marvel movie.

Senior Product Marketing Manager

Auth0 Public Sector Identity Index shows government leaders in the United States are clear on their priorities but could use some help improving citizen security.

Over the past two years, all levels of government in the United States (US) have made massive strides in their ability to deliver digital citizen services. Whether filing for unemployment benefits or renewing a driver's license, the COVID-19 pandemic accelerated digital government initiatives by [years](https://home.kpmg/us/en/home/insights/2020/09/digital-acceleration.html), enabling citizens to access critical services online rather than in-line. 

As these services continue to be deployed digitally, a key area of focus amongst all US government officials is managing the constantly evolving cybersecurity landscape. [Executive orders](https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/) from President Joe Biden and the [1.2 trillion dollars](https://www.whitehouse.gov/briefing-room/statements-releases/2021/11/06/fact-sheet-the-bipartisan-infrastructure-deal/) bipartisan infrastructure bill are both examples of steps taken to improve the nation's cybersecurity posture. 

Data from our own [Public Sector Identity Index](https://auth0.com/resources/whitepapers/us-public-sector-identity-index-report-2022), a primary research report with insights into the identity maturity of public sector organizations around the world, further supports how Federal, State, and Local government leaders prioritize security when delivering government-to-citizen (G2C) applications. In our survey, the top three priorities cited by respondents when launching online services for citizens were: 

1. Abiding by data security regulations
2. Securing citizen services 
3. Ensuring citizen trust in digital services 

Despite the intense focus on protecting citizen data, the results show there's still room for improvement. Only 19% of government leaders were highly confident in the security of their current authentication solutions, and 86% of governments rely on custom username and password credentials as a citizen's primary means of authenticating into applications, despite their [well-documented security risks](https://auth0.com/blog/what-is-credential-stuffing/). 

Fortunately, Customer Identity and Access Management (CIAM) solutions can help governments improve their applications' security without compromising the citizen experience.

## Billions of Dollars Lost to Fraud 

Over the past decade, data breaches in the US have [doubled](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/), and governments have been a primary target for bad actors amidst the pandemic. This shouldn't come as a surprise due to the highly sensitive data they store, legacy technology infrastructure, and the pace at which citizen services were launched; governments were and continue to be a perfect target for [hackers](https://www.govtech.com/sponsored/why-government-institutions-are-the-perfect-target-for-hackers).

Notably, levels of fraud have significantly increased amidst the pandemic as bad actors take advantage of the dire circumstances in which citizens required relief and governments scrambled to set up systems to deliver it. The Federal Trade Commission (FTC) reported a [3,000%](https://www.forbes.com/advisor/personal-finance/identity-theft-unemployment-benefits-fraud/) increase in fraudulent applications for government benefits in 2020. Data from the department of labor estimates that 36 billion of the 360 billion from the Cares Act was [lost to fraud](https://www.cnbc.com/2021/01/05/scammers-have-taken-36-billion-in-fraudulent-unemployment-payments-.html). 

Some sources are even citing 2020 as the year the world experienced a health care crisis and a [cyber pandemic](https://www.govtech.com/blogs/lohrmann-on-cybersecurity/2020-the-year-the-covid-19-crisis-brought-a-cyber-pandemic.html) due to the radical shift in online life. 

## A Void of Security Talent  

Despite rampant cyberattacks, citizen adoption of digital applications in both the public and private sectors continues to accelerate. [Data from McKinsey](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/how-covid-19-has-pushed-companies-over-the-technology-tipping-point-and-transformed-business-forever) shows that in the United States, the adoption of digital consumer interactions was pulled forward by three years. 

As citizens—who have the dual identity of also being consumers—continue to shift to an online world, authentication becomes increasingly important as it's the front door to any service. 

Unfortunately, the onus is on service providers to ensure their authentication methods are secure. [Most people](https://www.darkreading.com/informationweek-home/password-reuse-abounds-new-survey-shows/d/d-id/1331689) know password reuse is unsafe but choose to use the same password on multiple sites because they have roughly [100 passwords](https://tech.co/news/average-person-100-passwords) to remember. 

This poses a natural challenge for government agencies because finding, acquiring, and retaining cybersecurity talent to build and maintain security infrastructure is increasingly challenging. State CIOs have been quite [vocal about this](https://www.govtech.com/workforce/texas-cio-tackles-digital-services-workforce-challenges?utm_campaign=Newsletter%20-%20GT%20-%20GovTech%20Today&utm_medium=email&_hsmi=195931325&_hsenc=p2ANqtz-88YI7vDYWmct12A7bOeNFeYSw69onWa0MuOvfUAOKzukIH--YsPBMwI5ufQLqehSrlxgHaeqaH_khrQFZy3YoMvN-yJA&utm_content=195931325&utm_source=hs_email). Concerningly, it's not just a problem limited to the public sector. The International Information System Security Certification Consortium ([ISC]<sup>2</sup>) recently conducted a study that found [60% of security leaders globally worry the cybersecurity staffing shortage is placing their organizations at risk](https://www.isc2.org/-/media/F829F79ADBDC4F6391432B7D122DA32E.ashx).

## Protecting Citizens with Identity-as-a-Service 

Commercial off-the-shelf identity solutions like Auth0 are one option governments can rely on to improve the security of their citizen-facing applications with limited internal resources. 

Auth0's platform is built using open standards such as OpenID Connect,  OAuth2, Security Assertion Markup Language (SAML), and Fast Identity Online Alliance (FIDO) so that when new threats emerge, they can be quickly identified, understood, and neutralized by a community of experts. 

Attack protection capabilities are also available out of the box to help governments ensure end-user security through features like Adaptive MFA, Brute Force Protection, and Breached Password Protection. 

Additionally, with capabilities like WebAuthn Passwordless authentication, governments can introduce login experiences that improve the citizen experience while enhancing the security of their services. 

To learn more about the state of identity and access management in the public sector, download our latest [whitepaper](https://auth0.com/resources/whitepapers/us-public-sector-ciam). In the report, we highlight key trends observed across both Federal and State/Local governments pertaining to digital citizen services, highlight areas of opportunity, and shed light on how identity can improve the nation's cybersecurity posture. For a quicker read, you can also check out an infographic we published, calling out key findings [here](https://auth0.com/resources/ebooks/us-public-sector-ciam-infographic).

Improving the Nation's Security, Starting with Identity

asehmi

I work with a few tech start-ups providing technical strategy and product development advice and seed investment. I've rediscovered the joys of hands-on software development and actively engage with various developer communities to learn myself and educate sharing what I know. Previously, I was CIO at Oxford Economics for 10 years bringing 25 years’ prior experience in capital markets and high-technology software industries, enterprise software architecture and solutions development. Before that I spent eight years at Microsoft as a global business manager and award-winning software architect and technical evangelist. <br>
Earlier in my career, I was CTO at a start-up building advanced social media analytics products followed by a couple of years as an executive coach and mentor, and IT change management and strategy consulting to a number of small and medium sized businesses.

Startups Strategy Advisor

Arvindra Sehmi

This article will show you how to build Streamlit apps and custom Streamlit Components, with the end goal of implementing Auth0 authentication of Streamlit apps using Streamlit Components

Introduction to Streamlit and Streamlit Components

andrea-chiarelli

I have over 20 years of experience as a software engineer and technical author. Throughout my career, I've used several programming languages and technologies for the projects I was involved in, ranging from C# to JavaScript, ASP.NET to Node.js, Angular to React, SOAP to REST APIs, etc.

In the last few years, I've been focusing on simplifying the developer experience with Identity and related topics, especially in the .NET ecosystem.

Principal Developer Advocate

Andrea Chiarelli

Encoding, Encryption, and Hashing have different goals and shouldn't be confused. Learn the differences.

Sometimes people use the terms encryption and encoding interchangeably. Also, often hashing is called into play as an encryption mechanism. Confusing these concepts may lead to misunderstandings in the way security is implemented.

Let's take a high-level overview of these concepts and clarify the differences.

If you prefer watching videos, here is a video version of this article:

<AmpContent>
<amp-youtube
    data-videoid="-bAnBzvMLig"
    layout="responsive"
    width="480" height="270">
</amp-youtube>
</AmpContent>

<NonAmpContent>
<div
  class='embed-container'
  style="position: relative; padding-bottom: 56.25%; height: 0; overflow: hidden; max-width: 100%;margin-bottom:40px;">
    <iframe
      style="position: absolute; top: 0; left: 0; width: 100%; height: 100%;"
      src='https://www.youtube.com/embed/-bAnBzvMLig'
      frameborder='0' allowfullscreen>
    </iframe>
</div>
</NonAmpContent>

## What Is Encoding?

Let's start with encoding. You can define it as **a technique to transform data from one format to another so that it can be understood and consumed by different systems**.

Basically, encoding has to do with information representation. When you have some information, say the [name of the mineral that weakens Superman](https://en.wikipedia.org/wiki/Kryptonite), you can represent it through letters, as in *kryptonite*. This is a handy representation for humans but not so easy for being manipulated by computers. What usually happens, in this case, is the transformation of this sequence of characters into a sequence of bits like this:

```
01101011 01110010 01111001 01110000 01110100
01101111 01101110 01101001 01110100 01100101
```

You have two representations for the same information. The letter-based representation is usually understood by *human systems*; the bit-based representation is more suitable for computer systems. Commonly, you say that the sequence of letters has been *encoded* into a sequence of bits.

So, encoding is just a transformation from one data representation to another, keeping the same information. Usually, it involves a conversion table, such as an [ASCII table](https://en.wikipedia.org/wiki/ASCII) in our example, that maps a representation item in one system to the corresponding representation item in the other system.

You can find several encoding mechanisms out there. To mention just a few in the character encoding space, apart from the dear old ASCII, you have:

- [Unicode](https://en.wikipedia.org/wiki/Unicode), which allows you to represent more complex items than letters, such as emoji and other symbols.
- [Base64](https://en.wikipedia.org/wiki/Base64), which lets you represent binary data, such as an image, through text.
- [URL encoding](https://en.wikipedia.org/wiki/Percent-encoding), useful to represent arbitrary data in an URL, where some characters are reserved or cannot be used (think of spaces or colons, for example).

Consider [JSON Web Tokens (JWT)](https://jwt.io/introduction), for example. The three parts that compose a token are encoded using [Base64-URL](https://www.rfc-editor.org/rfc/rfc4648#section-5), a variant of Base64 encoding combined with URL encoding. The following is an example of encoded JWT:

```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vbXktZG9tYWluLmF1dGgwLmNvbSIsInN1YiI6ImF1dGgwfDEyMzQ1NiIsImF1ZCI6IjEyMzRhYmNkZWYiLCJleHAiOjEzMTEyODE5NzAsImlhdCI6MTMxMTI4MDk3MCwibmFtZSI6IkphbmUgRG9lIiwiZ2l2ZW5fbmFtZSI6IkphbmUiLCJmYW1pbHlfbmFtZSI6IkRvZSJ9.bql-jxlG9B_bielkqOnjTY9Di9FillFb6IMQINXoYsw
```

You can see the decoded version of this JWT using the [jwt.io](https://jwt.io/?id_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwOi8vbXktZG9tYWluLmF1dGgwLmNvbSIsInN1YiI6ImF1dGgwfDEyMzQ1NiIsImF1ZCI6IjEyMzRhYmNkZWYiLCJleHAiOjEzMTEyODE5NzAsImlhdCI6MTMxMTI4MDk3MCwibmFtZSI6IkphbmUgRG9lIiwiZ2l2ZW5fbmFtZSI6IkphbmUiLCJmYW1pbHlfbmFtZSI6IkRvZSJ9.bql-jxlG9B_bielkqOnjTY9Di9FillFb6IMQINXoYsw) debugger.

This encoding mechanism allows the token to be easily passed in HTML and HTTP environments without fear of clashes with reserved or unrepresentable characters. If you want to learn more about JWTs, you can download [the JWT Handbook](https://auth0.com/resources/ebooks/jwt-handbook).

Encoding ensures **interoperability** between systems. It allows systems that use different data representations to share information.

Encoding has **no security purpose**. Anyone who knows the conversion algorithm can encode and decode data. The conversion algorithm is not kept secret. On the contrary, it is public in order to facilitate interoperability between systems.

Finally, encoding is a **reversible process**. You can transform a piece of data from one representation to another and then go back to the original representation without information loss.

<include src="BigQuote" quoteText="Every decoding is another encoding.." quoteAuthor="David Lodge" />

## What Is Encryption?

Encryption is **a technique that makes your data unreadable and hard to decode for an unauthorized user**.

So, basically, encryption is a mechanism that transforms data into a different representation so that prying eyes cannot understand it. Wait! Isn't this transformation the same as encoding after all? 🤔

How can a human being understand that the following sequence of bits represents the word *kryptonite*?

```
01101011 01110010 01111001 01110000 01110100
01101111 01101110 01101001 01110100 01100101
```

In fact, the question is not far-fetched. In a way, encryption is a form of encoding. It transforms data from one representation to another. For this reason, sometimes, people use the terms encryption and encoding interchangeably. However, the purpose of encryption is different from the encoding's one.

Look at the definition above. The encryption technique aims at making data **unreadable and hard to decode**. If you think about it for a moment, it is the opposite reason of pure encoding: encoding aims at making data as much understandable as possible across systems while encryption tries to make it undecipherable, unless you are authorized.

The main goal of encryption is to ensure **data confidentiality**, i.e., protecting data from being accessed by unauthorized parties.

So, while encoding makes its conversion algorithms as public as possible, encryption should keep such algorithms private. Actually, it's not really like that. Relying on secret algorithms is not the best choice to protect data in the long run. Better solutions rely on well-known algorithms whose data transformation is based on sequences of numbers or letters called *keys*.

> Do not create your own encryption algorithm unless you are a Math expert with a long experience in the cryptography field.

The best mechanisms to encrypt data are based on mathematical algorithms that can be solved only with the possession of a key or with advanced computational power. Two families of key-based encryption algorithms exist:

- **Symmetric-key algorithms**: these algorithms use the same key to encrypt and decrypt data. The [Advanced Encryption Standard](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) (AES) algorithm is an example of this family's algorithms.
- **Asymmetric-key algorithms**: these algorithms use different keys to encrypt and decrypt data. The two keys are bound by a complex mathematical relationship. [RSA](https://en.wikipedia.org/wiki/RSA_(cryptosystem%29) is an example of an algorithm in this family. Check out [this blog post for a gentle introduction to asymmetric-key algorithms](https://auth0.com/blog/how-to-explain-public-key-cryptography-digital-signatures-to-anyone/).

Like pure encoding, encryption is a **reversible process** as well, although just for authorized people. Authorized people are the ones in possession of a decryption key.

The challenge of authorized versus unauthorized people is to make data decryption without the key as hard as possible. This leads to applying a mix of cautions such as complex mathematical relationships between the keys, keeping them secret, changing them frequently, and so on.

<include src="BigQuote" quoteText="Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break." quoteAuthor="Bruce Schneier" />

## What Is Hashing?

Let's take a look at hashing now. Basically, it's **a technique to generate a unique fixed-length string (hash) strictly depending on the specific input data**.

Since the generated hash depends on the specific input data, any small change to the input data generates a different hash. So, having the hash of a given piece of data, you can verify if that data has been altered by calculating its hash and comparing it with the one you already have. In other words, hashing **ensures data integrity**.

Suppose you like [Lex Luthor](https://en.wikipedia.org/wiki/Lex_Luthor)'s sarcastic line, *That's Kryptonite, Superman. Little souvenir from the old home town*. You like it so much that you want it to always be quoted in exactly this way. No character changed.

You calculate its hash string as follows:

```
7633bbb5bd637575809f0ccbc7db45240255d9637eac38b69d60f0d3d5c4a465
```

> By the way, I used [SHA-256](https://en.wikipedia.org/wiki/SHA-2) as the algorithm to calculate that hash string. But don't mind about this. I'll spend a few words on algorithms in a moment.

Assume someone writes that quote slightly different, such as, *That's kryptonite, Superman. Little souvenir from the old home town*. The following is the hash of this second version:

```
75ae6980bdb589ad7b555548159837a447ece0fc21348a53afc1ecdf62687153
```

You can see that the two hashes are different just by looking at the first characters. This tells you that the two sentences are not written the same way. Did you notice the difference between the two sentences? The second version has a lower-case k instead of the capital K in *kryptonite*.

You may say: why do you compare the two hash strings when you could compare the two sentences? Good point! Imagine that you have a document of thousands of words or a high-quality picture instead of a sentence. In that case, comparing the hash strings is more effective than comparing the whole media.

So, how can you get a hash? A hashing algorithm must have the following features:

1. The resulting hash has a fixed length.
2. The same input always produces the same output.
3. Multiple different inputs *should not* produce the same output.
4. It must not be possible to obtain the input from the output data.
5. Any change to the input data implies a different resulting hash.

As you can see, point 4 implies that hashing is **not a reversible process**, unlike encoding and encryption. Also, point 3 seems to say that, while you should get different hashes for distinct input data, it can't be guaranteed. Actually, this point makes the difference between hashing algorithms. For example, [MD5](https://en.wikipedia.org/wiki/MD5) has been a very common hashing algorithm in the past, but [in 2008 it was deprecated](https://www.kb.cert.org/vuls/id/836068) due to [collision detection](https://en.wikipedia.org/wiki/Collision_resistance). The same happened to some early algorithms of the [Secure Hashing Algorithms (SHA) family](https://en.wikipedia.org/wiki/Secure_Hash_Algorithms). 

<include src="SignupCTA" text="Try out the most powerful authentication platform for free." linkText="Get started →" />

## The Right Tool for the Right Goal

As you've seen, encoding, hashing, and encryption have their specific purposes and features. Confusing their capabilities and roles in your system may lead to disastrous consequences.

For example, you may think that encrypting passwords is the best security option. Actually, it's a very bad idea. That's what [the Adobe engineers learned in a data breach in 2013](https://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/). The attackers who got access to their user database could break the encryption algorithm. Remember that encryption is a reversible process. Even if they don't have the decryption key, they may have enough time to guess it. Adobe reset users' passwords as a countermeasure, but you know users use the same password for multiple services. So, even if access to Adobe services may be safe, access to other websites was potentially compromised.

They should have used hashing instead of encryption to store users passwords securely. You know that hashing is not a reversible process. Attackers can't determine the password from which the hash was generated. But also, simply relying on hashing is not the best option, as [the LinkedIn breach](https://www.computerworld.com/article/2504078/hackers-crack-more-than-60--of-breached-linkedin-passwords.html) teaches us.

I know, it's a hard world! 🙄

If you want, you can learn more about [storing passwords using hashing](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/) and [how to use salt to store them properly](https://auth0.com/blog/adding-salt-to-hashing-a-better-way-to-store-passwords/). Also, for a more [technical comparison of encoding, encryption, and hashing, read this article](https://auth0.com/blog/how-secure-are-encryption-hashing-encoding-and-obfuscation/).

## Summary

Now you know the difference between encoding, encryption, and hashing. To briefly recap what you learned throughout this article, take a look at the following cheat sheet:

![Encoding, encryption, and hashing comparison](https://images.ctfassets.net/23aumh6u8s0i/32RHwyEORRBB8sbu5EZgdz/e706f821fe5e309fc410d7a56acee7d3/encoding-encryption-hasing-cheat-sheet.png)


Encoding, Encryption, and Hashing

dean-scontras

Dean Scontras has spent the last two decades in public sector sales roles at high-growth cybersecurity and technology companies, including Duo Security, MobileIron, and Hewlett-Packard. Currently, Dean sits on the advisory board of Advanced Technology Academic Research Center (ATARC) and DiversifyIT. Prior to joining Auth0, he served as the vice president of U.S. Public Sector at Duo Security (acquired by Cisco), leading federal, state, local, and education sales initiatives, alongside securing the company’s successful FedRAMP certification.

VP, State and Local Government and Education, Okta and Auth0

Dean Scontras

Consumers expect seamless, high-value digital experiences, including with the public sector.

What does it mean to build digital services that citizens both use and trust? From the local to the national, generating effective digital transformation and [getting citizens onboard with digital public services](https://www.sciencedirect.com/science/article/pii/S0740624X18304131) has been a challenge. The promise of digital government has often been muddled by institutional inertia and perceptions of government as slow-moving and bureaucratic. At the same time, positive initiatives, such as the [Tallinn Declaration on eGovernment](https://ec.europa.eu/newsroom/document.cfm?doc_id=47559), which embrace objectives as wide-ranging as improved service delivery, greater efficiency, increased transparency, interoperability, and citizen satisfaction, have begun to remove entrenched ambivalence about e-government. Modern GovTech is where these barriers collide, creating the opportunity to address newly accelerated consumer demand in the face of private-sector conveniences and the [consequences of the Covid-19 pandemic](https://www2.deloitte.com/us/en/insights/industry/public-sector/government-digital-transformation-strategy.html). 

GovTech, according to public sector entities such as [the World Bank](https://www.worldbank.org/en/programs/govtech), is a technology-based “government approach to public sector modernization.” The same definition emphasizes three core areas for modernization: universal accessibility, citizen-centric services, the delivery of efficient and transparent government systems, and finally, digital transformation, all of which rely on overcoming long-cited barriers to adoption and success, such as [citizens’ willingness to use and trust services](https://doi.org/10.1145/2096140.2096142).

GovTechs, an umbrella term for technology-based solutions (and the companies behind them) that power the technical aspects of digital transformation, can be a bridge between use and trust and learning to [see citizens as customers](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/building-the-tech-enabled-government-of-the-future-a-day-1-list-of-common-pitfalls).


## Changing User Expectations 

In a pure consumer context, choice and convenience rule: you can easily go online and search, comparison shop, and buy a desired product in a few clicks without thinking about any of the complexity of the transaction. Consumers naturally transfer their positive consumer expectations to all of their digital experiences,[ according to McKinsey, raising the bar for government entities](https://www.mckinsey.com/industries/public-and-social-sector/our-insights/digital-public-services-how-to-achieve-fast-transformation-at-scale). 

But how many consumers have enjoyed the convenience of one-click (or similarly easy) citizen services, such as reviewing and paying utility bills, filing income taxes, or having a streamlined, one-stop car-and-driver licensing experience? Or, for example, registering for unemployment benefits digitally, making the physical queue at the unemployment office shorter and more efficient for those going through the process in person? 

Rapid change has led to the expectation that public sector services offer private-sector-rivaling availability, choice, and convenience, which overrides previous consumer doubts about public sector readiness. 

Driving GovTech strategy in complex public sector environments demands a delicate balance between overarching strategic questions and the nitty-gritty of implementation. For example, this balance could be examining the[ underpinnings of transformation](https://www.accenture.com/_acnmedia/pdf-90/accenture-govtech-pov.pdf) strategically, such as public expectations, financial considerations, accessibility, demographics, and sustainability, against the competing operational demands of introducing new technology into hierarchical, political, and often change-resistant environments. Practically, such implementations involve extensive political and stakeholder management and support, consideration of legacy investments and programs, and a well-defined plan for rolling out proposed changes and the downstream effects these may have, whether positive or negative. 

Ultimately, the strategy for selecting and implementing GovTech solutions and providers rests with public sector employees who are responsible for the strategic and tactical approaches described and for meeting consumers’ increasingly private-sector-style expectations. This is redefining how governments interact with citizens. 

Three core considerations highlight how uniquely demanding delivering on these expectations can be for government agencies:

### 1. Deliver on citizens’ demands and expectations. 
Government digital transformation is different from its private-sector counterpart. Historically,[how consumers perceive and use public and private sector services has differed](http://dx.doi.org/10.4018/IJIDE.2019010102). However, societal changes stemming from the Covid-19 pandemic and the attendant shift to living life almost 100% online have resulted in heightened citizen expectations for public services to be available digitally in the same way as online shopping and food delivery. As a result, old barriers against citizens' willingness and ability to use e-gov services have declined significantly. 

### 2. Balance privacy and user experience. 
More fundamentally, the private sector is driven by consumer demand and choice, incentivized by increasing profit and reducing cost. While the public sector shares these concerns, because citizens often do not have a choice in deciding whether to interact with the government, the government’s primary aim is to provide services to citizens efficiently while building trust, safeguarding citizens’ data privacy, and ensuring compliance with regulations, mandates, and standards to which government agencies are tied. Trust remains an important issue for consumer-citizens, who[ perceive a level of risk in exposing their private data to public entities in ways they don’t when dealing with private entities](https://www.ey.com/en_no/government-public-sector/how-can-digital-government-connect-citizens-without-leaving-the-disconnected-behind). For public sector agencies, privacy concerns have historically taken precedence over user experience, but they need to prioritize privacy and security over user experience and convenience is beginning to change as GovTechs offer secure solutions leveraging modern infrastructure and economies of scale that facilitate both outcomes at a lower overall cost.

### 3. Make public services accessible to all citizens. 
The rapid digitization of society champions convenience above all, but digital-only approaches can create [accessibility blindspots](https://www.openaccessgovernment.org/accessibility-making-government-work-better/55530/) and [exacerbate the digital divide](https://www.ey.com/en_au/government-public-sector/how-can-clever-governments-choose-to-close-the-digital-divide). Government agencies must serve _all_ citizens, which means designing for everyone or else disenfranchise citizens who do not have access to digital services, devices, or connectivity. 

## How Can GovTech Enable These Citizen Experiences? 

Government agencies want to deliver on these citizen expectations because the agency benefits by achieving its mission, improving efficiency, and reaching all of its citizens — ultimately benefiting citizens. 

“A valuable function of government is providing all constituents with equal opportunity to access different services. By enhancing government with modern technologies, citizens are presented with multiple paths to the same services. These paths can now be both digital and in-person avenues, allowing the government to be more efficient in providing the right access to the right group of people,” Auth0’s Jeet Shah, Identity Architect, and Senior Solutions Engineer explains. “GovTechs introduce options for how citizens are served, allowing governments to dedicate resources more effectively. Citizens who prefer interacting with their governments online allow in-person services to be more accessible and can ultimately improve the quality. GovTech vendors and what they provide to governments ultimately leads to better services for all constituents.” 

GovTech grows from two branches: the first is the services governments offer to their citizens, the second is the vendors that enable those services. Governments furnish services in line with citizen expectations, which brings together these two branches.

### Government services to citizens: Focus on usability and trust

At the heart of delivering efficient public services is the ability to unify disparate, siloed departments and functions under a single sign-in. Forcing citizens to keep track of and maintain access to multiple portals and sites creates friction and disincentivizes use while also introducing the greater potential for security vulnerabilities and data privacy breaches. 

At the same time, maintaining this fractured setup is less efficient, potentially open to fraud, and forfeits opportunities for fostering citizen trust and personalizing user experiences. For example, imagine being able to offer all citizen services through a centralized digital portal or app with a single sign-on experience. From license renewal to viewing existing permits to paying bills, governments can leverage GovTech that enable these features and gather user analytics simultaneously to feedback into personalization efforts and a deeper understanding of citizen needs and wants.

## Identity Jumpstarts GovTech Services

[Various barriers have slowed technology-driven public sector transformation](https://doi.org/10.1007/978-3-030-57599-1_4) over the past two decades. Many of these barriers, such as embedded organizational and cultural issues, existing processes, and legacy structures and infrastructure, persist regardless of technology. The impetus to accelerate the pace of change, however, has positioned GovTech to play a key role in helping to overcome some of these barriers. 

Identity enables all levels of government to bring their services to more citizens via the channels they prefer and already have access to. If the barrier faced is the difficulty of use, unified identity simplifies usability for both the government agency and the citizen user. If the barrier is trust, secure and transparent identity technologies can breakthrough. 

### Vendor service enablers: Auth0 for unifying identity

Auth0 is a GovTech vendor that, in this case, acts as an umbrella, freeing government agencies from service and platform fragmentation by bringing them together under a single, flexible sign-on solution. By reducing infrastructural complexity and providing options government agencies can use to offer services across multiple vectors, Auth0 helps public sector entities to expand the base of citizens who can access their services. 

By doing the heavy lifting of the platform and digital identity consolidation, Auth0 enables governments to reorganize and reprioritize resource allocation for more efficient processes – dedicating resources to digitizing what is possible and improving those that cannot be digitized.

If you’d like to learn more about how identity can accelerate digital change and invite citizens along for the journey, please get in touch with the [team at Auth0](https://auth0.com/contact-us).

What is GovTech?

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New global report highlights how identity is foundational in helping governments improve existing services, and launch new ones faster and more securely

**BELLEVUE, Wash.** **– January 12, 2022** –[ Auth0](https://auth0.com/), a product unit within[ Okta](https://www.okta.com/) (NASDAQ: OKTA), today released the findings of its first [Public Sector Identity Index](https://www.auth0.com/public-sector/identity-index-report), a global research report that provides government technology leaders with insight into the identity maturity of public sector organizations around the world. The report highlights the importance of a centralized identity strategy in putting safe and accessible services into the hands of citizens faster.

Over the past two years, many public sector organizations were prompted by the immediate need to deploy digital infrastructure to maintain continuity of their services amid the COVID-19 pandemic — such as offering citizens license renewals online and virtual education — and are now grappling with the impacts on cybersecurity and user experience. From the Executive Order on ‘Improving the Nation’s Cybersecurity’ in the U.S., to digital identity and Single Sign-On (SSO) initiatives in the UK and Australia, enabling employees, citizens, and other government entities to access all of these applications easily and securely has become a demand around the world. 

The 2022 Public Sector Identity Index, conducted by Auth0 and [Market Connections](https://www.marketconnectionsinc.com/), captures the perceptions of 850 IT and line of business decision-makers within national and state/local government organizations across the U.S., UK, and ANZ (Australia and New Zealand) with regard to their [Identity and Access Management (IAM)](https://auth0.com/resources/whitepapers/how-identity-forms-a-foundation-for-digital-govenrment) strategy.

The report’s key findings include:

* Only one in five are extremely confident in either the security (17%) or ease of use (19%) of their current authentication solution.
* Username and password is the most frequently used authentication method by citizens (86%), compared to very little usage of biometric or passwordless authentication (16%).
* Four in ten are currently building their own IAM solution in-house (41%), and cite speed to implementation (83%) and using internal staff to manage IAM internally (82%) as two of the biggest pain points in doing so.
* Most governments are looking to expand their digital services in the next two years (75%) and rank protecting citizen’s privacy and data as most important when thinking about citizen services (73%).

<br>

Regional analysis shows U.S. respondents rank ensuring citizens’ trust in digital services as an area of high importance (71%), but have less confidence in their organization’s ability to deliver this (56%). Similar discrepancies in importance versus confidence in delivery include speed in adding new services in the UK (66% importance vs. 48% confidence), and improving the user experience in ANZ (72% importance vs. 60% confidence).

Dean Scontras, Vice President of State and Local Government and Education (SLED) at Okta, said: “Digitization is likely to continue in light of Zero Trust mandates and mounting consumer expectations. Public sector organizations greatly benefit from bringing their identity management strategy in line with their digital goals. While there is a strong focus on securing citizen data, the vast majority of applications are still protected by a username and password, despite their well-documented security risks.”

According to Forrester Research, the public sector has a massive influence on the entire economy making up 30% of the global GDP and 33% of the global workforce, and the global research firm predicts that more governments will adopt Zero Trust frameworks to revive public trust in digital services.[^1]

An [Identity-First approach](https://www.youtube.com/watch?v=g7ZzOJQwRsE) puts identity at the center of government digital transformation, while also laying the foundation for a Zero Trust security model. Key to this approach are modern login technologies that replace traditional passwords, and introduce friction only when suspicious behavior is detected. By making the shift to Identity-First, organizations like [Larimer County](https://auth0.com/case-studies/larimer-county/) provide easy and seamless access for legitimate users, while decreasing the risk of security and compliance breaches.

Jessica Figueras, a cybercrime and digital identity advisor to governments and Okta consultant, said: “In the face of increasing digitization, skills shortages, and online harms, governments are taking a hard look at the technologies they can bring onboard to help them reach their digital goals. The research suggests that identity is one such technology that can help the public sector do more with less.”

To learn more and download the full report, please visit: [2022 Auth0 Public Sector Identity Index](https://www.auth0.com/public-sector/identity-index-report).

## Methodology

Auth0 engaged Market Connections to design an online survey of 850 IT and line of business decision-makers within national and state/local governments in the U.S. (200 federal, 200 state & local), UK (100 federal, 100 state & local), and ANZ (Australia and New Zealand) (155 federal/national, 95 state & local), fielded in September-October 2021.

<include src="asides/AboutAuth0" />

## About Okta

Okta is the leading independent identity provider. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With more than 7,000 pre-built integrations to applications and infrastructure providers, Okta provides simple and secure access to people and organizations everywhere, giving them the confidence to reach their full potential. More than 14,000 organizations, including JetBlue, Nordstrom, Siemens, Slack, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.

### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Okta<br />
[press@okta.com](mailto:press@okta.com) <br />

### Investor Contact:
Investor Relations <br />
[investor@okta.com](mailto:investor@okta.com) <br />

**Disclaimer:**
Research reports and related summaries referenced herein are provided for informational purposes only, and consist of the opinions of the organizations publishing such research and should not be construed as statements of fact. Okta and Auth0 make no representations, warranties, or other assurances with respect to such research.

[^1]: Public Sector Predictions 2022, Forrester Research, Inc., November 3, 2021. 

Auth0 Public Sector Index Shows Governments Struggle to Provide Trustworthy Online Citizen Services

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

The software’s latest features will help users bolster their data security.



If you happened to catch Apple’s initial June 4, 2018 announcement of iOS 12, you might have noticed that it was lacking the “big splash” that we’ve seen from other iOS announcements. That’s partially because Apple was so busy focusing on new iOS 12 data security features.

Though more is to be unveiled at the September 12, 2018 Apple Keynote event, many of the features of iOS 12 that have been revealed likely won’t catch the average consumer’s attention. That’s intentional. Good data security features are relatively unnoticeable to most users. If anything, those features in Apple’s newest mobile OS will make life a little bit easier for the average iPhone user.

But, if you happen to be an IT or security pro, the new iOS 12 probably piqued your interest.

This emphasis on personal data privacy and security from Apple prompts one question: is iOS 12 the most secure operating system Apple has ever released?

In a word, yes. Let’s dig into what makes it so secure.

## Better Anti-Hacking Technology for Data Privacy

One of the biggest changes Apple is making to the new iOS’s security is the introduction of USB Restricted Mode. 

On iOS 11 and earlier iOS versions, USB-based communications stay active for up to seven days after the phone is locked. This means that if an iPhone is stolen, the would-be hackers have seven days to plug a brute force device, such as GrayKey, into the phone and force it to unlock.

_[The New York Times](https://www.nytimes.com/2018/06/13/technology/apple-iphone-police.html)_ calls this seven-day window a massive security vulnerability in iOS 11.

The good news is that Apple is closing this window. With USB Restricted Mode on iOS 12, Apple is reducing the time for USB-based communications to just one hour after the phone is locked. 

That makes a brute force attack on iOS 12 nearly impossible. According to one app developer we talked to, “USB Restricted Mode essentially turns the phone into a battery-powered brick after one hour.” Unless the phone is unlocked by an authorized user in that hour timeframe, it’s useless to would-be hackers.

To illustrate this further, if an employee at your company has their iPhone stolen with iOS 11 on it, there’s a very good chance the thief will be able to gain access to the phone within seven days. However if iOS 12 is installed, the thief will only have one hour to attempt a brute force attack. The chances of that being accomplished in an hour are very unlikely. 

This data privacy feature is automatically turned on in the new OS, but Apple does give you the option of disabling it:

![Turn USB Restricted Mode Off in iOS 12](https://images.ctfassets.net/23aumh6u8s0i/43Cy7OyrsRaEn2felz1YVf/dce0db81be1260e1be29ba15fad941c2/ios12-usb-restricted-mode-off)

_[Image Source](https://www.macrumors.com/how-to/access-controls-usb-restricted-mode-ios-12/)_

We're excited by both the strength and flexibility of this for greater personal data security.

## Password Reuse Auditing

As is the case with any data security system, humans are the weakest link. If you develop the best tools in the world but the actual human operators aren’t using it, then it’s worthless.

That’s why Apple is trying to make password management as simple as possible in iOS 12. One of the features that makes this easier is Password Reuse Auditing. This feature monitors the passwords that iPhone owners use for different services. When it catches someone [using the same password on different websites](https://www.godaddy.com/garage/10-best-practices-for-creating-and-securing-stronger-passwords/), it flags the duplicate, offers a more secure password, and then saves it to the iCloud Keychain.

![iOS 12 Password Autofill - Password Reuse Auditing flag present on online service](https://images.ctfassets.net/23aumh6u8s0i/4xFwJwR593h6HlGI5SjAo/59a1d22b1766872c1ecc233dcf3a8cac/ios-12-password-reuse-auditing-flag-present-on-online-service)

_[Image Source](https://www.macrumors.com/how-to/automatic-passwords-and-auditing-in-ios-12/)_

The issues with using one password across different websites are well documented. Security experts have been trying to get around these issues for years and Apple is doing their best to help. Auth0 offers secure authentication using [token-based, passwordless authentication](https://auth0.com/passwordless) that features a brute-force protection system.

### iCloud: The Elephant in the Room

At first glance, this iOS 12 security feature seems slightly less secure. For this feature to work, Apple has to record your current passwords and be able to crawl them for matches. While at the same time, Apple stores everything in the iCloud. 

That concern caused Apple to make this system as secure as possible. This feature uses a highly secure 256-bit AES for encryption. 256-bit AES is nearly impossible to crack. It’s actually the same encryption standard that the US government uses to transmit top secret data. It seems that Apple is pretty serious about security. 

In addition to using the uncrackable 256-bit AES, Apple also recommends users enable two-factor authentication for their iCloud Keychain. That combination makes it extremely unlikely that some nefarious individual would be able to compromise the iCloud. 

Speaking of two-factor authentication…

## Making Two-Factor Authentication Easier

_[Two-Factor Authentication](https://auth0.com/learn/two-factor-authentication/)_ (2FA) is the next big security feature in iOS 12. 

For years, data privacy experts have been begging and pleading with website users to set up 2FA. It's one of the best ways to [protect individuals and small teams from cyber attacks](http://blog.idonethis.com/security-ringcaptcha/). Adoption has still been relatively low because 2FA adds an extra step for users.

The most common type of Two-Factor Authentication is SMS text message 2FA. This authentication protocol sends users a text with a passcode before they are granted access to a system.

The problem is, it requires a lot of switching back and forth between apps to get the code, memorize the code, and then plug it into the app. And, if the user mistypes or misremembers the code, then it's back to square one.

Luckily, Apple is coming to the rescue. With iOS 12, SMS security codes will autofill without the user having to switch from app to app. No memorization, either. It does this by making specific API calls to the messaging app. When iOS 12 recognizes an SMS 2FA security code, it will automatically pull it into autofill for the user. 

![iOS 12 SMS 2FA security code and autofill example](https://images.ctfassets.net/23aumh6u8s0i/5fZy2u7OvyQocoyZ7jLsLh/225753ebf85204d06fa4e6ddc2ad7feb/ios-12-recognizes-an-sms-2fa-code-and-autofills-it-for-user)

There is one downside here. It has been well established that SMS 2FA can be compromised. We recently mentioned this _[in a post about a Reddit data breach](https://auth0.com/blog/what-companies-can-learn-from-the-reddit-data-breach/)_. Even still, any 2FA is better than no 2FA. With Apple including this feature in iOS 12’s security, they’ve made users significantly less prone to hacking.

## What Else is New in Data Security for iOS 12?

There are a few other security features worth mentioning in iOS 12. First up is group video chat. What makes this a security feature? Facetime is fully encrypted and extremely secure. Adding group chat to Facetime simply means that Apple is now supporting fully encrypted group chats. 

Apple also introduced a new Face ID feature. The tech company is giving iPhone owners the ability to add a “second face.” This allows two different users to unlock an iPhone using Face ID. We’ve covered the _[security of Face ID](https://auth0.com/blog/is-faceid-really-secure/)_ is another blog post. It’s good to see Apple improving upon this feature.

## Final Thoughts iOS 12 Release

We’re really impressed with Apple’s new iOS 12 security features. Not only are they making the operating system more secure, they’re making security easier to use. That combination is one that security experts are always after. Be looking for "A new iOS update is now available" as iOS 12 will be released soon.

<include src="asides/AboutAuth0" />


Apple iOS 12: Is it the Most Secure iOS Ever?

joyce-echessa

Joyce Echessa

Learn about the different APIs available in Google's ML Kit (mobile machine learning SDK). You will also learn how to create an application that uses one of its APIs.

A Look at Android ML Kit - the Machine Learning SDK

auziros:mckenzie-mayer

Customer Identity (CIAM) Product Comms lead, driving collective storytelling across Okta and Auth0. Making technology accessible for everyone.

Customer Identity Product Comms Lead at Okta

McKenzie Mayer

Auth0 recognized among Britain’s five best places to work in technology, and one of 20 “most engaged” employers

**LONDON – 2 November 2021** – The [Auth0 Identity Platform](https://auth0.com/), a product unit within [Okta, Inc.](https://www.okta.com/) (NASDAQ: OKTA), today announced it has been named among Britain’s five best places to work in technology, and one of the top 20 “most engaged” employers in the [WorkL Workplace Awards 2021](https://www.telegraph.co.uk/business/2021/10/26/winners-workl-workplace-awards-2021-revealed/).

Conducted in partnership with The Telegraph, the awards recognize UK employers across 26 industries that score highest on a staff satisfaction survey. The five companies with the highest scores in each category are awarded gold status for the most engaged workforce. Of the 20,000 companies that entered, a select few are also recognized as the most inclusive, best in well-being, and having the most engaged employees – including Auth0.

“I’m pleased to congratulate Auth0 on its gold medal. After such a difficult 18 months in business, I’m pleased that our awards are celebrating organizations that are leading the way, creating happy and engaged employees,” said Lord Mark Price, founder of WorkL, and former UK Trade Minister and ex-managing director of British supermarket brand, Waitrose & Partners.

Employer scores, called the “Workplace Happiness Score,” are calculated based on employee feedback about reward and recognition, information sharing, empowerment, well-being, and other elements of job satisfaction over the past year. The awards are the latest in a series of accolades recognizing Auth0’s remote working DNA and culture, including the [UK’s Best Companies to Work For List](https://auth0.com/blog/auth0-named-one-of-the-10-best-mid-sized-companies-to-work-for-in-london/) and [Best Companies Accreditation](https://auth0.com/blog/auth0-awarded-highest-accreditation-by-best-companies-uk/).

“We owe a tremendous debt of gratitude to our employees who responded to the survey, and all who continue to make Auth0 a great place to work,” said Steven Rees-Pullman, SVP International at Auth0. “From Auth0's inception, our founders instilled values of transparency, collaboration, and experimentation into the business. Those values are exemplified by all of our employees and create this award-winning culture. Many congratulations to all!”

Auth0 is now part of Okta, the leading independent identity provider, with a vision to provide secure access to any technology. Learn more about what it’s like to work here, and apply to join our growing team on the [Auth0 Careers Page](https://auth0.com/careers).

<include src="asides/AboutAuth0" />

### Media Contacts
Auth0 Global Communications <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Auth0 Wins Gold at WorkL Workplace Awards 2021

liam-hampton

Liam is the Lead Developer Advocate within the IBM Hybrid Cloud Build Team UKI. He uses his wealth of technical knowledge to create fun and engaging developer content, blogs, workshops, events and speaking engagements. He has professional experience as a Software Developer working on and contributing to open source projects and language performance analysis. Liam now focuses his work on microservices, specialising in containerisation, serverless computing and DevOps.

IBM Lead Developer Advocate UKI

Liam Hampton

A beginners guide into the world of IoT with TinyGo.

**TL;DR:** The concept of coding for IoT devices, CLIs and WebAssembly is not a new concept. However, what if I told you that it is possible to use Golang for all three. [TinyGo](https://tinygo.org/) is a specialized project specifically designed and used for development in small places. This article explains the benefits of TinyGo, what it is, and how you can use it. It also provides you with a Golang IoT code example for you to see TinyGo in action.

## What Is TinyGo?

TinyGo is Golang's baby brother. It is a compiler that allows a user to write the Golang code they are familiar with and run it in places people wouldn't have thought were possible. What this means is that the barriers to entry into some tech spaces are being gradually lowered. I say this because I am writing through experience.

## How Is TinyGo Different from Golang?

Out of the box, Golang is a feature-rich, highly-performant, compiled language, which means that Golang is compiled to machine-readable code (those funky `1` 's and `0` 's everyone talks about).

In turn, being compiled to machine code allows it to run directly on the hardware &mdash; all that CPU/RAM power! Another really cool feature of Golang is that when building a binary of the written program, it includes extensive cross-compatibility for a wide from of different system architectures.

Once a binary has been built, it can be run on any compatible distribution/architecture, providing it has been specified during the build process. To find the list of supported architectures (after installing Go on your machine), run this command into your terminal: `go tool dist list`.

The output will look something like this:

```bash
aix/ppc64
android/386
android/amd64
android/arm
android/arm64
darwin/amd64
darwin/arm64
dragonfly/amd64
freebsd/386
...
```

So, how is TinyGo different? Well, it's the same Golang you know and love, but TinyGo is a smaller compiler based on [LLVM](https://llvm.org/) technologies. It has essentially cherry-picked a number of important and available libraries and trimmed a lot of the fat from the core language.

By doing that, TinyGo becomes an even more powerful and efficient language that you can run in unexpected places. As an example of fat that's been trimmed, the library `html/template` cannot be imported by TinyGo as it relies upon other dependencies, which in turn are not able to be imported.

> To read up on the packages supported by TinyGo, visit the [documentation pages](https://tinygo.org/docs/reference/lang-support/stdlib/).

## Where Can You Use TinyGo?

### Use TinyGo with WebAssembly

#### What is WebAssembly?

Web development might usually be associated with JavaScript, but this isn't always the case. WebAssembly is an official W3C standard and allows people to develop applications for the web without using JavaScript.

I first must stress, WebAssembly is not a replacement for JavaScript but can be an excellent complement. The two technologies can work well together to deliver web content. In one small sentence, WebAssembly is a format for writing code for the web. WebAssembly is designed to be highly performant, which is why a language with a small overhead is preferable.

WebAssembly allows developers to write code in a familiar language and run it through a web browser for end-users. Through this method, near-native performance is achieved, and the required support is already in your modern browser.

In essence, you can write your code in TinyGo and pass it through the WASM compiler, which turns that Golang code into machine-readable code. Then, you can run the application through a web browser easily.

![WebAssembly diagram](https://images.ctfassets.net/23aumh6u8s0i/A4oW5u3cr5j5St4Z1bA0o/7714e2411c109a2e74347557be305cc1/01_tiny.png)

### Use TinyGo to build a CLI

#### What is a CLI?

A Command Line Interface (CLI) is a standardized way for a user to interact textually with a system or application. The first primary use cases of CLIs were back in the 1960's where users could use a terminal to interact with the operating system. This was a continuous trend throughout the following decades which enabled systems to become more complex and give users more freedom on the computer they are using.

#### Why does a CLI need to be small?

Some CLIs interact with the operating system directly, which in turn means they will need some low-level permissions and a secure library set. Initially, people might think of a C language or Python to accomplish that task. They are established, low-level languages that have been used in some high-profile CLIs in the past.

*Golang enters the room*.

However, for those that don't know, Go is derived from C. In fact, it's so close that you can call C code from within a Go program &mdash; it's called Cgo.

In recent years, Go has been the go-to language to create CLIs. Some of the most popular and most used CLIs are written in Go: Docker CLI, Kubernetes CLI (`kubectl`), GitHub CLI, just to name a few. This has been made possible by the creation of third-party libraries and imports that take care of the complex tasks developers would otherwise have to take care of themselves. 

Second to this is the power hidden under the hood of the language. Go has concurrency in the form of go-routines making asynchronous programming simplistic and a garbage collector helping with memory management. All of these features (and more) help reduce the size and space taken up by an integral program, all working towards keeping programs as performant as possible.

However, if a small project needs a CLI to be written for it or the CLI is only performing some basic tasks, sometimes these large libraries and imports can be overkill. Unless the end goal is to write a complex, multi-functional CLI like the ones mentioned before, a great number of the available libraries may not even be used, resulting in overhead the project could do without. To keep a CLI small and precise, reducing waste is a top priority. This makes TinyGo a great choice for small CLIs.

### TinyGo can power microcontrollers

#### What is a microcontroller?

A microcontroller is usually a single chip on a small circuit board that allows input and output (I/O). A common and well-known example is an Arduino, which is fantastic for home automation and other smaller projects around the house.

With the IoT boom in recent years, Arduinos have also seen a rise in popularity. The trouble with this is that Arduinos are usually coded in C++. To some, this can be seen as a barrier to entry as it is a complex language, and not everyone wants to learn or use it when alternatives are available.

When I began to play with IoT, I purchased a bunch of Arduinos, thinking I could do some cool projects. Then I was personally struck with the C++ barrier. Most of my work is either in Node.js or Golang. With this being the case, I took a seat and thought about how I could write the code I know and love to create these cool projects I had in mind. This is where I came across TinyGo.

#### How many boards does TinyGo support?

TinyGo is a growing project. At the time of writing, TinyGo supports over 60 microcontroller boards. These range from [Espressif boards (ESP's)](https://www.espressif.com/) to [Adafruits](https://www.adafruit.com/category/851) and as previously mentioned, Arduinos, opening so many doors for people to begin their journey into IoT whilst coding in a familiar language.

> Check the [documentation for each microcontroller board supported by TinyGo](https://tinygo.org/docs/reference/microcontrollers/) for more details.

## Why Is TinyGo a Great Alternative to C++ and MicroPython?

I am not going to the language bash. C, Python, and Go are all great languages in their own way. With that being said, there is plenty of room for this project to grow and come to fruition with the right support.

Golang has significantly grown in popularity over the past few years. It is quickly becoming the de facto choice of language for cloud-native development due to its "first-class" support. In the [Stack Overflow Developer Survey 2017 for Most popular technologies]( https://insights.stackoverflow.com/survey/2017#most-popular-technologies), Go entered the list for the first time and only scored 4.4%. In contrast to 2020, only 3 years later, it scored [8.8%](https://insights.stackoverflow.com/survey/2020#technology-programming-scripting-and-markup-languages-all-respondents). Let's the couple that with Golang being associated with some of the most sought-after skills and top paying salaries worldwide. It is only right to assume this growth will continue.

In addition, looking at the IoT market, we can see yet another upwards trend. In 2017, Garner forecasted 8.4 billion IoT devices to be connected. Fast-track to 2025, and there is a prediction of up to 30 billion devices being connected. This is a huge leap! The growth of Golang and its baby sibling, TinyGo, can help fuel the IoT fire.

## TinyGo in Action

Let's look at how Golang IoT shapes up with some code!

For this blog post, I have created a small program for you to create that turns 4 LEDs on when a phototransistor detects no light. This is essentially how outdoor night lights work.

To do this, I have used:

- Visual Studio Code + TinyGo plugin
- TinyGo version `0.18.0 darwin/amd64` (using Golang version `1.16` and LLVM version `11.0.0`)
- 1 x Arduino Uno R3
- 1 x  Breadboard
- 8 x Male-Male wires
- 5 x Resistors (1 x 10kΩ / 4 x 220Ω)
- 1 x Phototransistor
- 4 LEDs

### Step 1:

If you haven't already, [install Go]( https://golang.org/doc/install) and then download and [install TinyGo]( https://tinygo.org/getting-started/install/) on your machine.

To check if Go is installed, run the following command:

```bash
go version
```

To check if TinyGo is installed, run the following command:

```bash
tinygo version
```

Next, install the TinyGo Visual Studio Code Plugin.

![install tinygo vscode editor plugin](https://images.ctfassets.net/23aumh6u8s0i/TPJESp0S9pdn3L8uAvDKn/820fe16c173b0ba789be43ad7a7be94c/02_tiny.png)

### Step 2:

Plugin the board with a USB cable (in this example, I am using an Arduino R3) and target it with the editor. Once targeted, the editor will prompt a reload of the window.

![tinygo select the target board](https://images.ctfassets.net/23aumh6u8s0i/3fruuXSiUdJFWW9F3vvqAh/149c1725df6a52ae2e91546e74cc1b18/03_tiny.png)

![reload the vscode editor](https://images.ctfassets.net/23aumh6u8s0i/6QR634B8bipgZAIBUJvdoT/8e89bc62d7c9a858b1995ad732e78e58/04_tiny.png)

> **🚨 Warning 🚨:** The editor might prompt you to update the `go dev` tools within the editor. If you execute the update, you may get an error due to a known bug. Until this is fixed, it is advised to not update the tools.

![vscode update tools notification](https://images.ctfassets.net/23aumh6u8s0i/UgrMtLf7UmXwLxhenjy6X/a6e66e3910ca85f98752fe33234b8c5b/05_tiny.png)


### Step 3:

1. Create a project in the directory `$HOME/go/src/github.com/tinygo`

```bash
$ mkdir light-sensor
```

2. Change into the newly created project directory

```bash
$ cd light-sensor
```

3. Create a new `.go` file for the application within the project directory

```bash
$ touch light-sensor.go
```

4. Create a go mod file if you are using go modules

```bash
$ go mod init
```

5. Finally, open the project in Visual Studio Code


### Step 4:

First, read the code and comments below, and then secondly, write it out. Don't copy and paste!

```go
package main

import (
    "machine"
    "time"
)

func main() {

    // Initialise Analog pins
    machine.InitADC()

    // Set the light sensor to Analog pin 0
    lightSensor := machine.ADC{Pin: machine.ADC0}
    lightSensor.Configure(machine.ADCConfig{})
    // Set the LEDs to the corresponding pins
    leds := []machine.Pin{
        machine.D7,
        machine.D8,
        machine.D9,
        machine.D10,
    }

    // Configure each LED as an output
    for _, led := range leds {
        led.Configure(machine.PinConfig{Mode: machine.PinOutput})
    }

    // Constantly loop to get the light sensor reading every 0.1 seconds
    for {
        // 30000 is the lighting threshold for my environment
        if lightSensor.Get() > 30000 {
            // Turn the LEDs off
            for _, led := range leds {
                led.Set(false)
            }
        } else {
            // Turn the LEDs on
            for _, led := range leds {
                led.Set(true)
            }
        }

        // Time to wait before next light sensor reading is collected
        time.Sleep(time.Millisecond * 100)
    }
}
```

### Step 5:

Connect the components, so they resemble the circuit board shown below.

![circuit board diagram](https://images.ctfassets.net/23aumh6u8s0i/2DfJWFFXVvp38jclNPNH0m/21c2eae0341fc09b98f8daff298063ed/06_tiny.png)


![circuit board](https://images.ctfassets.net/23aumh6u8s0i/5CWIRVVG7BAMXeryu8d1EU/1be865f5accd679cd8ba55ca33576d12/07_tiny_pic.jpg)


### Step 6:

Next, find what port the connected device is running on. To do that, enter the following command into a terminal or navigate to the device manager.

**Mac:**

```bash
$ ls /dev/cu*
```

**Linux:**

```bash
$ ls /dev/tty*
```

**Windows:**

Open Device Manager and expand the Ports (COM & LPT) list. Find your connected device and make a note of the port number. You will need this to flash the device in the next step.

Alternatively, visit [MathWorks]( https://www.mathworks.com/help/supportpkg/arduinoio/ug/find-arduino-port-on-windows-mac-and-linux.html ) website for more information on how to find the port number of your connected device.

### Step 7:

Now you have the port number, the device is connected and targeted through the editor, and you have written the code. The next step is to flash the board. To do this, enter the command below into a terminal.

```bash
tinygo flash -target=<board-you-are-targeting> -port=<device-port-from-step-6> <name-of-file>
```

Example command:

```bash
tinygo flash -target=Arduino -port=/dev/cu.usbmodem143201 light-sensor.go
```

Once you have completed the device flash, it should look like this:


<AmpContent>
<amp-img width="245" height="300" src="https://imgur.com/srh5UM1.gif" alt="an animation" attribution=""></amp-img>
</AmpContent>

<NonAmpContent>
<p align="center"><IMG SRC="https://imgur.com/srh5UM1.gif"></p>
</NonAmpContent>

## Takeaways

1. TinyGo is an excellent alternative for embedded systems and WebAssembly development.
2. Being a smaller compiler for the Go language, existing Go developers can enter the IoT space with their current skills.
3. Adoption is continuously growing, and TinyGo is supported by the most common microcontroller boards already, reducing the barriers to entry for newcomers and hobbyists.

TinyGo is still a very experimental project which has come on leaps and bounds over a short period of time. With Go's impact in the software world continuing to grow, TinyGo could be a project to keep an eye on. Having multiple lightweight alternatives to the main language is needed for IoT and edge computing since there is often limited compute power available and overall needs exploding. TinyGo is just another example of a great slimmed-down alternative to the dominant languages for microcontrollers. I, for one, will certainly be keeping an eye out for a linear adoption pattern and continue to monitor and research exciting projects like this.

TinyGo: Good Things Come in Small Packages

jameeka_aron

Jameeka has over 20 years of Information Technology and Cyber Security experience. She is a versatile leader, successfully leading teams as both a CISO and CIO across various industries including; Aerospace & Defense, Apparel, Retail, and Manufacturing at both Fortune 100 and privately held companies and many spaces in between. <br>
She is highly skilled in Business Engagement (International and U.S. based) Audit, Compliance, Vulnerability, Risk and Identity Management, Digital Transformation, Mergers, Acquisitions, Divestitures, and leading Cross-Functional and Matrixed teams.

CISO

Jameeka Aaron

Go fast but not alone — our leaders are here to help secure your workforce and app privacy.

Accelerating digital road maps by seven to 10 years likely left you with some things to review from a security perspective. Please check out the [first post in this series](https://auth0.com/blog/accelerated-your-road-map-go-fix-workforce-and-app-security) for what you might need to review to securely support your remote or hybrid workforce, as well as a checklist for consumer-facing apps.

Security isn’t the only thing that can get overlooked when we go fast.  As well as implementing technical protections — we also need to understand what and how the data and how impacts the humans that use technology. This is where privacy comes in. Privacy is having a critical global impact on software development because consumers, businesses, and governments are demanding that technology operates in a way that complies with legislation like GDPR (General Data Privacy Regulation), CPRA (California Public Records Act), APPI (Act on the Protection of Personal Information), and LGPD (Lei Geral de Proteção de Dados Pessoais). This is an opportunity to rethink exactly what and how much data is collected, how it’s used, and who gets to see it. It’s a turning point where individuals are no longer blithely accepting that massive amounts of data about them are being created, shared, and used.

At Auth0, I regularly collaborate with our vice president of privacy, Lucy McGrath, and she is a part of my organization. For this series, I asked Lucy for her perspective on data privacy mistakes companies can make when they move fast.

An integrated approach is essential for security and privacy. There’s a saying if you want to go fast, go alone, but if you want to go far, go together. This is changing — you can’t protect privacy alone. If you go alone, you won’t go anywhere. “Ultimately, data privacy is about trust,” says Lucy. “And it’s a collaborative effort. You can’t think about security or data governance, or privacy in isolation. You need to work across departments within your organization and also listen to your staff and your consumers/users. From a practical standpoint, you need to work with others even beyond your immediate business — data privacy regulations are changing rapidly —technical solutions are essential in order to scale privacy compliant technology. If you don’t collaborate, you’ll be left behind.”

Lucy’s insights on remote/hybrid workforces and consumer-facing apps can improve your workplace culture and improve your relationships with your customers — and keep you focused on your business rather than dealing with regulators and potentially incurring large fines.

## Put Your Focus on the Human

“Probably the most important thing to remember when thinking through data privacy is that you’re delivering a service that impacts humans,” says Lucy. “We can get dazzled by what technology can do, but the technology is really there to help the humans accomplish something. Centering on the human who needs to use or benefit from the technology helps you to focus.  — and align with existing and emerging data privacy regulations.”

As always, this information is shared from the perspective of business impact and planning. For how data privacy regulations apply to your specific business situation, please reach out to your legal counsel.


> Auth0 recommends you always consult legal counsel for specific advice about compliance with legal requirements.

**The workforce mix: remote, hybrid, in office**

If your company relies on a globally dispersed workforce (or acquired one during the pandemic), you’re likely dealing with a mix of employees who welcome some office quietly, some still struggling with lockdown requirements, and others who may not expect to see vaccines become available until fall. “As you look at creating or reviewing policies, it’s especially important to remember that there’s a human on the other side of the Zoom screen”, says Lucy. “This is a good time for your HR team to check back in with staff. Circumstances and perspectives have changed for many people as a result of the pandemic. One size definitely will not fit all.”

Understanding that worker privacy rights vary globally, here are some areas to review:

### 1. How you measure productivity

For organizations used to seeing people in chairs, the shift to Zoom screens caused some anxiety. Interestingly, [75% of 12,000 workers surveyed by BCG](https://www.bcg.com/publications/2020/valuable-productivity-gains-covid-19) in the United States, Germany, and India felt they were able to maintain or increase productivity on individual tasks during the pandemic. 

Some of that may have been accomplished by blurring the lines between home and work, says Lucy. 

Surveillance technologies like keyloggers, video monitoring, and attention tracking via biometrics have been rising in adoption even before the pandemic. We’re hearing this often says, Lucy: “I like my boss — a lot —  but I would find it a bit creepy if she was tracking every word I write, tracking when I popped off to the loo and listening to my family conversations. And it would make it harder to do my job because I would feel unnecessarily surveilled. It’s really important to assess the correct way to protect data and maintain trust with your employees as humans. Especially with workers working from home in potentially cramped situations, you could be gathering data you don’t need and shouldn’t have.

“Workers generally know that emails are subject to company oversight nearly everywhere, but it’s essential to be transparent about monitoring activities across all applications and devices. Transparency also encourages trust and increases the likelihood that individuals will report issues/mistakes they encounter. Tell them about how long you retain the data, and why and be sure to check local rules about internal and external data sharing — they can vary by region and even by state in the United States. It’s important to only keep what you really need to perform a task,” says Lucy.

### 2. How do you encourage collaboration?

Nearly everyone became Zoom-literate in 2020. Many people were introduced to Slack or other collaboration tools, and some folks also mixed in personal texts. “As great as these technologies are — and I am speaking as someone who enjoys working with a globally distributed workforce — they’re not going to replicate the physical space. From a privacy perspective, some small changes can mean a lot to employees,” says Lucy.

“Some people enjoy having dogs and kids flow in and out of their workplace. Others prefer to keep things separated. Over the last several months, I’ve noticed some colleagues making different choices.”

Things like Zoom backgrounds can protect employee privacy, but only if they know how to use the tools. If you’re using a collaboration tool like Zoom or Slack, document expected uses, alternatives on offer (as applicable) and make sure employees know how to use tools like Zoom backgrounds. 

### 3. Onboarding can protect against data breaches

Normally, we bring our new employees to our Bellevue, Wash. offices for onboarding. This in-person connection brings all kinds of benefits, including protecting data. “Onboarding may seem like an odd place to bring up data privacy, but people are more likely to feel comfortable reporting potential problems or even breaches when they have formed a connection to their colleagues,” says Lucy.

Establishing connections may mean creating social events (likely on Zoom) or connecting employees for non-work meetings. We have an app that randomly pairs employees for casual chat sessions we call “donuts.” It’s a surprisingly effective way to establish connection and get to know about the day-to-day work life of far-flung colleagues.

### 4. Security and Privacy of Customers is Key

“We’ve had workers who used to be home by themselves all day, suddenly have teenaged children pass through meetings on the way to the fridge,” says Lucy. “It’s charming, but it also means that family members might see things they’re not meant to see. You need to recognize that not everyone has the luxury of a room with a door and a lock. Protecting customer security and privacy is key.”

To your security protocols, Lucy would also suggest adding:

* Headphones so you can control what can be overheard (and coaching that awareness with your teams)
* Privacy screens for monitors
* Printed material (and the printer) needs to be kept in a space that remains locked when not in use

## Data Privacy Checklist for Consumer-Facing Apps

COVID has brought populations that are used to trust in physical environments online, says Lucy. This is part of why in the UK we’re seeing [increase in delivery text phishing scams](https://www.theguardian.com/money/2021/may/18/delivery-text-scams-the-nasty-new-wave-sweeping-the-uk) where additional funds are requested for delivery. Many of these ploys play on user trust and the expectation that information is being shared securely. We’ll get deeper into how consumers are demanding a secure and contextual private experience in the final post. As preparation, here is a data privacy checklist. Please follow up with your legal counsel on your specifics.

1. **Review what you’ve got and why you’ve got it and how you’re getting it.** It’s not uncommon for apps to gather more information than is necessary to do the job. You need to know what data you have and why you’re collecting it as well how it’s stored to comply with regulations — and to know how to safeguard your customers’ data. **This includes third-party vendors and your marketing teams.**
2. **Make sure your code only collects data you really need**. The days of data gluttony are coming to an end. Individuals are rightly fed up with the attitude of “just because you can collect as much data as possible, you do. Ask yourself: do you use all the data you collect? Don’t be afraid to reduce the amount of data you collect when you update your app or add new products. Look for opportunities to innovate by using privacy-enhancing technologies to mask or anonymize, or de-identify data. And safely delete the information you don’t use.
3. **Know where your customers are and check out the regulations.** While the EU’s General Data Privacy Regulation (GDPR) has become the benchmark for data privacy, not every regulation is GDPR. There are differences. Children also often have extra protections. Once you’ve identified where and who your customers are, work closely with your legal counsel to design the right approach.
4. **Securely delete info and keep a record.** Maybe you’re deleting information due to a verified request or because you have data you actually don’t need; either way, you need to keep a record.
5. **Make sure you have someone responsible for privacy who respects the humans interacting with your app.** This stuff is not simple. You need someone who looks after it.
6. **Look out for service departments or social media complaints.** Complaints can show you how the public perceives their data is being used — and identify areas that need your attention.
7. **Communicate clearly with your users.** Users often need to know how to unsubscribe and other rights as part of data privacy regulations.
8. **Do as you would be done by.** Think through how you’d like your data to be treated. That’s a good guideline. But also think about the specific customer base - what’s their perspective and might they require additional protections (e.g., if they are a vulnerable group).
9. **Consult your legal counsel.** Data privacy is a rapidly evolving field. Lawyers really are your friends! Please check in with your legal counsel regularly, and especially if you’re thinking of expanding into a new region.

## Learn More about Identity’s Role in Your Data Privacy Strategy

As Lucy says, you can have security without privacy, but you can’t have privacy without security if you’d like to learn more about how a robust identity solution can support your data privacy and security strategies, [please reach out to the team at Auth0](https://auth0.com/contact-us).

In the final post in the Acceleration Response Series, we’ll look at how creating a long-term plan for security and privacy can help you meet consumers’ demands.

<include src="asides/AboutAuth0" />

Workforce and App Privacy Have Changed, So Should You

Rapid change introduces workforce and app risks. Auth0 Security team’s advice on what to fix now.

Fast response allowed many organizations to survive and thrive in 2020. Orgs went remote overnight; businesses launched consumer-facing apps, and [consumers shifted buying patterns online](https://auth0.com/blog/how-brick-and-mortar-approaches-improve-digital-experiences/).

Going fast gets products to market, it gives consumers choices, and it helps companies scale. But when you jump ahead seven to 10 years in your digital road map, you risk leaving a few security and data privacy concerns behind. I reached out to key members of my security team, as well as our data privacy team, to put together this three-part series based on our industry experience and observations.

Each post will focus on protecting and securing two critical areas: your workforce and your consumer-facing apps. The first post will focus on security details to check and mitigate now. The second will focus on immediate data privacy concerns with the help of Auth0 Vice President, Privacy Lucy McGrath. And the third post will help you put together a plan for the future that will make it easier the next time you want to turn on the speed — and to remain current in an ever-changing security landscape.

The thing is that security is a global team sport.  As more of us shift to working and living online, everything is more connected — and that can be a good thing. Securing your personal identity, your business identity, and helping increase security at your business can actually make an impact. Here’s what you can do to help make the internet safer for everyone.

## Why Remote Work Forced a Change in Security Thinking

Before the world started working remotely, a lot of companies used a castle-and-moat approach to security. They relied on a combination of physical security and internal networks to ensure that employees and outsiders only accessed necessary information. They might even have relied on SaaS companies to provide some of their protections, but the thinking was still pretty much “protect the castle.”

Suddenly workers were working anywhere in the world, maybe on their own devices. Without remote experience, your security team might not have had time to think through all of the security issues inherent with having remote endpoints. For example, to ensure that they properly protect these assets against current threats like ransomware and malware, it would be appropriate to install leading next-gen antivirus on these machines.

Role-based privileges and policies also abruptly needed to follow the user. I know I work for an identity company, but it was identity and policy [federation](https://auth0.com/blog/why-identity-federation-matters/) that anticipated this need and allowed for a rapid response.

[Now some companies are making work from home a permanent](https://www.businessinsider.com/companies-asking-employees-to-work-from-home-due-to-coronavirus-2020) part of their employee offering. Since Auth0 was built as a remote-friendly, globally dispersed company, we’ve had some time to think through the security concerns. Here’s what you need to consider to protect your customers, your business, and your employees:

1. **Secure the endpoints.** Services like CarbonBlack or CrowdStrike can help prevent malware or breaches occurring from endpoints.
2. **Update bring your own device policies.** Rethink how and where employees are accessing business and customer data. Do you need to restrict access in public spaces? Adjust policies?
3. **Update action policies**. What do your employees do if a work computer is stolen? What steps do they need to take if the information is exposed at home? A [1Password survey](https://www.darkreading.com/51--of-wfh-parents-say-children-have-accessed-work-accounts/d/d-id/1339754) found that 51% of work from home (WFH) parents surveyed said their children had accessed their work accounts, sometimes accidentally deleting necessary files.  How can you support your employees??
4. **Human risk is increased.** Have a look at the next section.

## The Human Element

This is the critical part of this series — **the human element is the most important aspect of security and data privacy.**

> Security awareness training needs to happen at every single level of your organization.

A malicious actor is going to use everything you need to do business — email address patterns, information on your website, social media posts, and items gleaned from news articles all to try to gain entry to your system. While the attacks will vary, they usually follow this pattern: **human factor** + inject something into the code + lack of input validation + insufficient logging and monitoring.

If something looks like it’s coming from your CEO or payroll, an employee might fall for it and supply a way into your system. And once a bad actor is in, there’s lots they can do.

But if you train your entire team to watch out for phishing attacks, you can stop them at the first step. [This post is a good place to start.](https://auth0.com/blog/protecting-against-phishing-attacks/)

Attacks evolve, so even though security awareness is something you should pause and do now, it’s something you’re going to need to do regularly. Developing a security culture throughout your org provides great protection. To do business with some industries like finance or healthcare, the training will be required to cover specific areas and will need to be documented. The training you provide can also help protect your employees in their personal lives.

## Top 7 Things to Do Now to Check Your App’s Security

This can seem like a lot if you don’t have an in-house security team (and maybe if you do). One principle of security is encouraging diversity of thought not only because it’s the right thing to do but because studies show it makes teams more productive. In security, [diversity of thought](https://www.mckinsey.com/business-functions/strategy-and-corporate-finance/our-insights/innovation-in-a-crisis-why-it-is-more-critical-than-ever) makes it easier to spot potential threats. This is part of why even large teams rely on external testing vendors and may even need to provide proof of outside testing for certifications like [CSA Star](https://auth0.com/blog/the-csa-star-program-a-business-guide-to-certification/) and [PCI](https://auth0.com/blog/what-is-pci-a-business-guide-to-compliance/).

1. **Get an external third-party pen test — and implement the recommendations**. A penetration test is where you hire a verified third party to attempt to find your app’s vulnerabilities. They will sign a non-disclosure agreement (NDA) and provide a detailed report outlining their findings and usually with recommended fixes cataloged by severity. Discovering vulnerabilities can be scary, and there is the temptation to use fear to drive organizational change, but we’ve found that partnering and collaborating with other teams and leadership can often get changes implemented faster. 
2. **Review best practices for your cloud-based services.** When people go really fast, they may not take the time to fully understand the technology and security controls. This is a great time to go back and pay really close attention to the docs provided by your third-party vendors.

> “Many common AWS security issues, for example, happen as a result of not following AWS security best practice guidelines when setting up the infrastructure. This can lead to open and accessible EC2 security groups, public S3 buckets, unprotected EMR clusters, and more,” says Auth0 Detection and Response Security Engineer Troy Wegner (formerly of AWS and Amazon.com).

3. **[Perform static](https://www.overops.com/blog/static-vs-dynamic-code-analysis-how-to-choose-between-them/) and [dynamic code analysis](https://www.overops.com/blog/static-vs-dynamic-code-analysis-how-to-choose-between-them/)**. Static analysis reviews the code as it exists. Dynamic analysis looks for vulnerabilities while the code is being executed and for unexpected outcomes. Ideally, you want to move towards baking both into your Software Development Lifecycle (SDLC). Devs may not always enjoy adding this to part of their process—more on how to add this analysis to your long-term software development plans in the final post.
4. **Think through vulnerability management and updates**. Since humans are fallible and it’s humans who make code, it’s inevitable that you’re going to run into vulnerabilities. If you don’t have a plan for pushing updates, now’s the time to make one so you don’t hear about something BIG like the [Heartbleed Bug](https://www.vox.com/2014/6/19/18076318/heartbleed) and find yourself painfully updating ad-hoc.

> In general, you’re going to need to test every time your devs update something and whenever your tech stack libraries or any of the main operating systems updates. Services like Chef, Puppet and Terraform can make this easier by pushing updates from a central server to connected servers. In the final post, we’ll get into longer-term strategies for updates, like maintaining a Golden Amazon Machine Image (AMI) if you’re on AWS. For now, just document how and when you’re going to update and test.

5. **Threat model**. A lot of security is determining risks. Ideally, you’ve threat modeled before building your app, but in some ways, it’s easier to model after it’s live. Yes, you can hire a trusted third party to do this for you. To give you a sense of the thought process, I asked Troy to threat model this restaurant scenario. Security engineers often diagram vulnerabilities, so we also include Troy’s whiteboard as a reference.

Let’s say you’re a local restaurant who responded to COVID by offering the ingredients to make your tastiest dishes and recipes to your customers via curbside pickup. You hired someone to put the app together quickly, but now your region is opening up, and you’ve decided this channel of operations should continue contributing to your bottom line. 

![Whiteboard](https://images.ctfassets.net/23aumh6u8s0i/3qWEruezG4YZw2AwS2w4Nf/ccb3121e94d794c8baa0ec470e4b084d/diagram.jpg)
**Figure 1:** _Auth0 Senior Security Engineer - Detection and Response Troy Wegner’s whiteboard of our restaurant scenario._

* Start with authentication because you know customers need to authenticate in order to interact with your app. How are they authenticating? Are they only using a username and password? If they are only using a username and password for authentication, then you have just hit on your first major risk (user compromise/phishing/user impersonation). 
* As a way to address the first risk identified, you have chosen to go with two-factor authentication for your users. But here is where things get interesting; which 2-factor options do you want to support? There are authenticator apps, FIDO U2F, Push-based 2FA, and SMS (the weakest available option). Each option has its own pros and cons to consider.
* Since this is a restaurant, you’re also somehow connecting the app to the food supply. How are you measuring and validating your existing ingredients inventory to ensure you do not oversell based on your total ingredients available? Are you using a database to store this information? If so, where does this database live, is it protected or hardened information security wise, and if so, how is it hardened? How do you authenticate to the database, is it updated regularly, do you perform backups, etc. 
* If your service has gotten really popular, too many people might try to order at once, and that could overwhelm the app’s limits. The app could go down due to resource constraints based on how it is architected. This is basically the risk a DOS/DDOS would present in bringing your app down and making it no longer available to your customers. In order to mitigate a DDOS risk, you might have a plan to make your app more fault tolerant and highly available by using load balancing, increasing back-end servers to handle the load, or using a front-end CDN to help distribute load across various edge locations.
* Most likely, your app is taking payment and processing it in order to fulfill orders; how are customer payment and other sensitive information being handled/stored? If you accept credit cards or debit cards, PCI compliance is a concern you should address.
* Here is where you would now want to think through and fully diagram out the rest of how the app works and uncover any other risks or bottlenecks that currently exist with your app, place a severity on those risks, and determine by severity which risks you want to fix, and which ones you are ok accepting.


6. **Turn on your logs — and make sure they’re monitored**. Turning on logs can seem like common sense, but because there’s often an expense attached to logging and getting the data analyzed, the logs might not always be turned on. It’s really hard to know what to fix after a malware outbreak or other issues occur, especially if your logs aren’t turned on and are being actively analyzed. 

So this is where we tell you to turn on the logs for all the services you’re using. You should also make sure that a trusted third-party vendor or trained security engineer is watching your logs and building actionable detections based on those log sources to look for suspicious or anomalous activity.

7. **Take action**. Logs, vulnerability assessments, pen tests — these things can help you identify what needs to be fixed, but you still need to fix it. Breaches and ransomware are the obvious security problems you want to avoid. How your security challenges impact consumer behavior might not be as clear. Lost conversions, abandoned shopping carts, and low time on site are all indications that your target audience may not feel comfortable sharing their data with you. Our customers tell us that an app or site that feels secure (think smooth login, logical and smooth payment process) supports their business goals.

## If You Need More Help

Authentication is often a critical part of securing an app or workplace. If you’d like to understand how Auth0’s solutions might help make your app more secure, please reach out to the [team at Auth0](https://auth0.com/contact-us).

My next post will focus on immediate data privacy concerns with the help of Auth0 Vice President of Privacy Lucy McGrath.

<include src="asides/AboutAuth0" />

Accelerated Your Road Map? Go Fix Workforce and App Security

apoorv-tyagi-author

I write about algorithmic solutions for software engineering problems, interesting programming tips, tricks & resources. May also include machine learning, NLP & Blockchain.

Apoorv Tyagi

A reply-to-mention Twitter bot that can reply to every tweet where it got mentioned with a specific keyword with an auto-generated image.

How to Make a Twitter Bot in Python using Tweepy

Learn how to address the risks that today’s top mobile security threats pose to your organization.

Mobile initiatives are a top priority for many organizations these days because research shows that increases in mobility help enterprises [improve operations](https://cdn2.hubspot.net/hubfs/1789978/Content%20Offers/enterprise-mobility-trends-report-2020.pdf) and [productivity](https://insights.samsung.com/2016/08/03/employees-say-smartphones-boost-productivity-by-34-percent-frost-sullivan-research/).

However, increases in organizational mobility typically result in an increase in the number of mobile devices that are accessing your systems from a remote location. And for your security teams, this means a growing variety of endpoints and threats they need to secure in order to protect your organization from a data breach.

As in the past, the most common threats to mobile security include mobile malware. However, as Verizon’s [2020 Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf) shows, there are new threats organizations need to consider as well in order to ensure they’re protected.

Below are the most common and critical mobile security threats that organizations face in 2021.

## 4 Different Types of Mobile Security Threats

Mobile security threats are commonly thought of as a single, all-encompassing threat. But the truth is, there are four different types of mobile security threats that organizations need to take steps to protect themselves from:

* **Mobile Application Security Threats.** Application-based threats happen when people download apps that look legitimate but actually skim data from their device. Examples are spyware and malware that steal personal and business information without people realizing it’s happening.
* **Web-Based Mobile Security Threats.** Web-based threats are subtle and tend to go unnoticed. They happen when people visit affected sites that seem fine on the front-end but, in reality, automatically download malicious content onto devices.
* **Mobile Network Security Threats.** Network-based threats are especially common and risky because cybercriminals can steal unencrypted data while people use public WiFi networks.
* **Mobile Device Security Threats.** Physical threats to mobile devices most commonly refer to the loss or theft of a device. Because hackers have direct access to the hardware where private data is stored, this threat is especially dangerous to enterprises.

Below are the most common examples of these threats, as well as steps organizations can take to protect themselves from them.

## 1. Social Engineering

Social engineering attacks are when bad actors send fake emails (phishing attacks) or text messages (smishing attacks) to your employees in an effort to trick them into handing over private information like their passwords or downloading malware onto their devices.

Reports by cybersecurity firm [Lookout](https://www.lookout.com/phishing-spotlight-report-lp) and [Verizon](https://enterprise.verizon.com/resources/reports/dbir/2020/results-and-analysis/) show a 37% increase in enterprise mobile phishing attacks and that phishing attacks were the top cause of data breaches globally in 2020.

![Social Engineering](https://images.ctfassets.net/23aumh6u8s0i/1wPMqUJN6nHgmQTVo4poQz/8b4fea1cb9600bcb1bc5b93f8881d49b/image1.jpg)
<p align="center"><i><a href="https://www.cybersecurityintelligence.com/blog/it-governance-cyber-security-phishing-awareness-course-180.html">Source</a></i></p>

<p align="left"></p>
### Phishing Attack Countermeasures
The best defense for phishing and other social engineering attacks is to teach employees how to spot phishing emails and SMS messages that look suspicious and avoid falling prey to them altogether. Reducing the number of people who have access to sensitive data or systems can also help protect your organization against social engineering attacks because it reduces the number of access points attackers have to gain access to critical systems or information.

## 2. Data Leakage via Malicious Apps

As Dave Jevans, CEO and CTO of Marble Security, [explains](https://www.esecurityplanet.com/mobile-security/10-trickiest-mobile-security-threats.html), “Enterprises face a far greater threat from the millions of generally available apps on their employees’ devices than from mobile malware.”

That’s because 85% of mobile apps today are largely unsecured. Tom Tovar, CEO of Appdome, [says](https://technologyadvice.com/blog/information-technology/cybersecurity-trends-2020-byod-mobile/), “Today, hackers can easily find an unprotected mobile app and use that unprotected app to design larger attacks or steal data, digital wallets, backend details, and other juicy bits directly from the app.”

For example, when your employees visit Google Play or the App Store to download apps that look innocent enough, the apps ask for a list of permissions before people are allowed to download them. These permissions generally require some kind of access to files or folders on the mobile device, and most people just glance at the list of permissions and agree without reviewing them in great detail.

However, this lack of scrutiny can leave devices and enterprises vulnerable. Even if the app works the way it’s supposed to, it still has the potential to mine corporate data and send it to a third party, like a competitor, and expose sensitive product or business information.

### How to Protect Against Data Leakage

The best way to protect your organization against data leakage through malicious or unsecured applications is by using mobile application management (MAM) tools. These tools allow IT admins to manage corporate apps (wipe or control access permissions) on their employees’ devices without disrupting employees’ personal apps or data.

## 3. Unsecured Public WiFi

Public WiFi networks are generally [less secure](https://www.wired.com/story/public-wifi-safety-tips/) than private networks because there’s no way to know who set the network up, how (or if) it’s secured with encryption, or who is currently accessing it or monitoring it. And as more companies offer remote work options, the public WiFi networks your employees use to access your servers (e.g., from coffee shops or cafes) could present a risk to your organization.

For example, cybercriminals often set up WiFi networks that look authentic but are actually a front to capture data that passes through their system (a “man in the middle” attack). Here's what that looks like:

![Unsecured Public WiFi](https://images.ctfassets.net/23aumh6u8s0i/3Zdz3P9nnZTNTMNPi2UMPZ/af3eb9262d8440b0fc875da00b0e1eaf/image2.png)
<p align="center"><i><a href="https://www.consumer.ftc.gov/blog/2014/03/how-secure-mobile-app"> Source </a></i></p>

If this seems far-fetched, it isn’t. Creating fake WiFi hotspots in public spaces with network names that look completely legit is incredibly simple, and people are very willing to connect, as shown by [experiments](https://hbr.org/2017/05/why-you-really-need-to-stop-using-public-wi-fi) run at the Democratic and Republican conventions in 2016 and by [an experiment](https://hackernoon.com/a-hacker-intercepted-your-wifi-traffic-stole-your-contacts-passwords-financial-data-heres-how-4fc0df9ff152) run by a researcher in 2019 from [Magic](https://magic.co/).

### How to Reduce Risks Posed By Unsecured Public WiFi

The best way for you to protect your organization against threats over public WiFi networks is by requiring employees to use a VPN to access company systems or files. This will ensure that their session stays private and secure, even if they use a public network to access your systems.

## 4. End-to-End Encryption Gaps
<p align="left"></p>
An encryption gap is like a water pipe with a hole in it. While the point where the water enters (your users’ mobile devices) and the point where the water exits the pipe (your systems) might be secure, the hole in the middle lets bad actors access the water flow in between.

![End-to-End Encryption Gaps](https://images.ctfassets.net/23aumh6u8s0i/75ICJ2SUKqSGKvX7OQoXxF/423b5c480a4c09939e62d411ba716b1b/image3.png)
<p align="center"><i><a href="https://heimdalsecurity.com/blog/the-best-encrypted-messaging-apps/"> Source </a></i></p>

Unencrypted public WiFi networks are one of the most common examples of an encryption gap (and it’s why they’re a huge risk to organizations). Since the network isn’t secured, it leaves an opening in the connection for cybercriminals to access the information your employees are sharing between their devices and your systems.

However, WiFi networks aren’t the only thing that poses a threat—any application or service that’s unencrypted could potentially provide cybercriminals with access to sensitive company information. For example, any unencrypted mobile messaging apps your employees use to discuss work information could present an access point for a bad actor.

### Solution: Ensure Everything is Encrypted

For any sensitive work information, end-to-end encryption is a must. This includes ensuring any service providers you work with encrypt their services to prevent unauthorized access, as well as ensuring your users’ devices and your systems are encrypted as well.

## 5. Internet of Things (IoT) Devices

The types of mobile devices that access your organization’s systems are branching out from mobile phones and tablets to include wearable tech (like the Apple Watch) and physical devices (like Google Home or Alexa). And since many of the latest IoT mobile devices have IP addresses, it means bad actors can use them to gain access to your organizations’ network over the internet if those devices are connected to your systems.

> Statistically, there are probably more IoT devices connected to your networks than you realize. For example, 78% of IT leaders from four different countries reported in [a study by Infoblox](https://www.infoblox.com/company/news-events/press-releases/shadow-iot-devices-a-major-concern-for-corporate-networks-infoblox-research-finds/) that over 1,000 shadow IoT devices accessed their networks each day.

### How to Combat Shadow IoT Threats
<p align="left"></p>
Mobile device management (MDM) tools can help you combat shadow IoT threats, as well as identity and access management (IAM) tools like Auth0. However, IoT/Machine-to-Machine (M2M) security [is still in a bit of a “wild west” phase](https://www.crn.com/news/internet-of-things/as-5g-nears-iot-connectivity-remains-a-wild-west-) at the moment. So it’s up to each organization to put the appropriate technical and policy regulations in place to ensure their systems are secure.

## 6. Spyware

Spyware is used to survey or collect data and is most commonly installed on a mobile device when users click on a malicious advertisement (“malvertisement”) or through scams that trick users into downloading it unintentionally.

Whether your employees have an iOS or Android device, their devices are targets ripe for data mining with spyware—which could include your private corporate data if that device is connected to your systems.

### How to Protect Against Spyware

Dedicated mobile security apps (like Google’s [Play Protect](https://developers.google.com/android/play-protect)) can help your employees detect and eliminate spyware that might be installed on their devices and be used to access company data. Ensuring your employees keep their device operating systems (and applications) up to date also helps ensure that their devices and your data are protected against the latest spyware threats.

## 7. Poor Password Habits

A [2020 study](https://www.balbix.com/resources/state-of-password-use-report-2020/) by Balbix found that 99% of the people surveyed reused their passwords between work accounts or between work and personal accounts. Unfortunately, the passwords that employees are reusing are often weak as well.

For example, a 2019 study by Google found that 59% of the people they surveyed used a name or a birthday in their password, and 24% admitted to using a password like one of these below:

![Poor Password Habits](https://images.ctfassets.net/23aumh6u8s0i/3f3dzG9WlC6gNqYnCyB9V3/00d5e8990be0124d4b140764ff769ec1/image4.jpg)
<p align="center"><i><a href="http://www.netimperative.com/2016/01/worst-25-passwords-prove-were-all-idiots/"> Source </a></i></p>

These bad password habits present a threat to organizations whose employees use their personal devices to access company systems. Since both personal and work accounts are accessible from the same device with the same password, it simplifies the work a bad actor has to do in order to breach your systems.

However, these behaviors also provide opportunities for credential-based brute force cyberattacks like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) or password spraying because cybercriminals can use weak or stolen credentials to access sensitive data through company mobile apps.

### How to Reduce or Eliminate Mobile Password Threats

The [NIST Password Guidelines](https://auth0.com/blog/dont-pass-on-the-new-nist-password-guidelines/) are widely regarded as the international standard for password best practices. Following these guidelines—and insisting your employees do the same—will help protect you against threats from weak or stolen passwords. Password managers can simplify the work required for your employees to follow these guidelines.

Requiring your employees to use more than one authentication factor (multi-factor authentication or MFA) to access mobile company applications will also help reduce the risk that a bad actor could gain access to your systems since they’d need to verify their identity with additional authentication factors in order to log in.

Finally, implementing [passwordless authentication](https://auth0.com/passwordless/) will help you eliminate password risks altogether. For example, in the event that a mobile device is stolen or accessed illegally, requiring a facial scan as a primary (or secondary) authentication factor could still prevent unauthorized access.

## 8. Lost or Stolen Mobile Devices

Lost and stolen devices aren’t a new threat for organizations. But with more people [working remotely](https://www.businesswire.com/news/home/20201215005287/en/Upwork-Study-Finds-22-of-American-Workforce-Will-Be-Remote-by-2025) in public places like cafes or coffee shops and accessing your systems with a wider range of devices, lost and stolen devices pose a growing risk to your organization.

### How to Protect Against Lost or Stolen Device Threats

First and foremost, you’ll want to ensure employees know what steps to take if they lose their device. Since most devices come with remote access to delete or transfer information, that should include asking employees to make sure those services are activated.

![How to Protect Against Lost or Stolen Device Threats](https://images.ctfassets.net/23aumh6u8s0i/44UaWTSZk2OlrI587JXGw1/1276e73d18bae71b074472dfb1ebd2db/image5.jpg)
<p align="center"><i><a href="http://www.idownloadblog.com/2014/08/08/how-to-activate-lost-mode-iphone-ipad/"> Source </a></i></p>

[Mobile device management](https://auth0.com/blog/what-is-enterprise-mobile-management/) (MDM) tools can also help you secure, encrypt, or wipe sensitive company information from a device that’s lost or stolen, so long as those tools were installed before the device went missing.

## 9. Out of Date Operating Systems

Like other [data security](https://auth0.com/blog/what-is-data-security/) initiatives, mobile security requires continuous work to find and patch vulnerabilities that bad actors use to gain unauthorized access to your systems and data.

> Companies like Apple and Google address a lot of these vulnerabilities with operating system updates. For example, in 2016, Apple realized it had three [zero-day vulnerabilities](https://us.norton.com/internetsecurity-emerging-threats-how-do-zero-day-vulnerabilities-work-30sectech.html) that left its devices open for spyware attacks and released a patch to protect users against these vulnerabilities.

<p align="left"></p>
However, these patches only protect your organization if your employees keep their devices up to date at all times. And according to Verizon’s [Mobile Security Index Report](https://enterprise.verizon.com/resources/reports/2020-msi-report.pdf), operating system updates on 79% of the mobile devices used by enterprises are left in the hands of employees.

### How To Keep Mobile Operating Systems Up To Date

Google and Apple both allow organizations to push updates to managed Android and iOS devices. Third-party MDM tools (for example,[ Jamf](https://www.jamf.com/)) often provide this functionality as well.

## IAM Tools Can Help Secure Company Mobile Applications

Identity and Access Management (IAM) tools can help organizations secure the apps and data that users access from their mobile devices, including:

* **Restricting which devices and users can access enterprise applications and data,** as well as which parts of those applications they’re allowed to access.
* **Tracking user behavior** and securing access in the event that something looks suspicious with security features like [multi-factor authentication](https://auth0.com/blog/multifactor-authentication-mfa/) (MFA),[brute force attack protection](https://auth0.com/docs/attack-protection), and more.

Auth0 simplifies the work required to implement secure authentication for mobile enterprise applications—learn more about Auth0’s IDaaS platform [here](https://auth0.com/resources/videos/platform-introduction-video-2020).

<include src="asides/AboutAuth0" />

The 9 Most Common Security Threats to Mobile Devices in 2021

IAM starts at the login box but impacts security, analytics, and user experience

Identity and Access Management (IAM) is the branch of IT concerned with verifying users' identity and controlling their access to digital resources. Or, as [Gartner defines it](https://www.gartner.com/en/information-technology/glossary/identity-and-access-management-iam): "IAM is the discipline that enables the right individuals to access the right resources at the right times for the right reasons."

<iframe width="560" height="315" src="https://www.youtube.com/embed/IKxigcbhsGk" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

## IAM Key Concepts: Authentication vs. Authorization

As the name indicates, IAM concerns both verifying users' identity (authentication) and granting them access to data based on that identity (authorization). These concepts are interrelated but not interchangeable, and understanding each is critical to grasp the larger meaning of IAM.

**Authentication refers to the methods you use to determine that someone is who they claim to be.** The classic authentication method is the username-password combination. However, using passwords alone for authentication is increasingly regarded as insecure since passwords are easy for hackers to guess or steal via [credential stuffing attacks](https://auth0.com/blog/what-is-credential-stuffing/).

Today's gold standard for verifying identity is [multi-factor authentication (MFA)](https://auth0.com/multifactor-authentication), which supplements passwords with authentication methods that are harder to fake, such as a biometric scan or a code sent to a user's personal device.

![MFA](https://images.ctfassets.net/23aumh6u8s0i/7ujWt3YR4Lc2D6MlbcibdZ/a5a02d1d95abd9014ab6d30d86dc5bb9/mfa-iam)

For a real-world metaphor, imagine going to a nightclub where you're on the list. The bouncer checks your ID to make sure you're really you (authentication). Then the bouncer lets you in and tells you that there's an asterisk next to your name, which means you're allowed into the VIP section (authorization).

**Authorization is the allocation or delegation of permissions to a particular individual or type of user.** For example, in the nightclub, a regular patron has access to the dance floor, a VIP is allowed behind the velvet ropes, but only the owner can get into the back office with the safe.

A modern IAM platform lets admins control authorization from a central user dashboard and via APIs, saving time and preventing security incidents. For instance, you could log into your IAM dashboard and grant a specific freelancer the ability to edit their own pieces. Likewise, if an administrator leaves the company, you can revoke access, so they don't walk away with valuable intellectual property.

![Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7BQhEA3AimOi3dxgnAJv2h/2b4b1d707578bbb9f4fbf6e3160f610d/dashboard-iam)

## Types of IAM

Most organizations have multiple classes of users with different identity needs: their workforce, their business partners, and their customers. Even if you're using the same IAM platform for all three, you'll need to take a different approach for each.

### Workforce identity

The average business makes use of a wide variety of applications. Say you buy and provision to your employees (like Slack or WordPress) and some you build in-house. In either case, you need a [workforce IAM approach](https://auth0.com/b2e-identity-management-for-employees/) that integrates with all these disparate apps. As in our earlier example of the library, you use this to allocate permissions based on roles or individual identities.

### Customer Identity (CIAM)

[Customer identity and access management (CIAM)](https://auth0.com/b2c-customer-identity-management/) is its own branch of IAM and is used to control access to your external applications. You're most likely to use social logins here and generally focus on reducing friction (while still implementing appropriate security). [CIAM](https://auth0.com/blog/what-is-ciam/) is rapidly expanding as people log in on more devices, like smart TVs and wearables. 

A CIAM platform is concerned not just with the end user's login experience, but with gathering information about them into a data-rich identity profile. The greater your understanding of your users, the greater your ability to provide value for them. 

With this valuable data comes a huge responsibility: of obeying data privacy laws regarding data collection and storage, and sensitive data against breaches. Given that, a major (though often invisible) element of CIAM is controlling access to customer data by your own employees and third parties.

### B2B identity

IAM for enterprise customers might be the most specialized branch of identity management. It's also one of the most complex since large enterprises operate on different back-end technology stacks. 

Custom-made identity solutions often falter here and struggle to scale when onboarding multiple large customers. That's why startups often switch to third-party IAM platforms when they begin to move upmarket, so they can quickly federate identity using any provider and on any technology stack.

## IAM Tools

An old-fashioned approach to IAM might be as simple as a login box and some basic, role-based permissions. For instance, a public library with a digital card catalog just needs to let patrons log in and ensure they can't access functions reserved for the librarians.

But that limited understanding of IAM is ill-suited to a post-digitization world. These days, most organizations utilize a vast number of applications, and personal data can be both a valuable asset and a dangerous legal liability. If that same public library wants to let patrons log into all nearby branches with the same credentials, interface with local school software to connect students with books, and simultaneously protect those students' data, they'll need a much broader set of tools than a simple login box.

Today, most IAM platforms provide some combination of the following tools and features, albeit with varying levels of customizability and extensibility.

### Single Sign-On (SSO)

[SSO](https://auth0.com/docs/sso/current) is an IAM tool that enables a user to log into one of an organization's properties and automatically be logged into a designated set of other properties. For example, when you log into Google, you're automatically logged into your Gmail and YouTube accounts. For users, SSO reduces friction since they don't have to keep track of different credentials for every application. For organizations, SSO helps in collecting valuable insights about user behavior and preferences since it tracks them as they move from one application to another, connected by a single login.

### Federated Identity

While SSO lets users log into different properties or brands owned by a single organization, federated identity does the same thing across multiple organizations.

Most people are familiar with federated identity through [social login](https://auth0.com/learn/social-login/), in which you can use your Google, Facebook, or Apple ID to log into a wide range of apps. Federation is built on trust, so when you order from a food delivery app with your Apple ID, you're not ordering from Apple but indicating that the app trusts Apple enough to take their word that you are who you claim to be.

For [B2B federation](https://auth0.com/blog/why-auth0-b2b-federation-is-your-secret-weapon-for-enterprise/), there are a different set of enterprise connections, such as Active Directory, Azure, SAML, LDAP, and ADFS.

![B2B Federation](https://images.ctfassets.net/23aumh6u8s0i/6HTuHDmDrVhGoM64N5W5VT/fbf838da10673560329d5dfcd92070f3/why-federation-is-your-secret-weapon-for-enterprise_auth0-enterprise-connections)

B2B federation is often a challenge because different organizations use different technology stacks and enterprise connections. But a robust IAM solution such as Auth0 integrates across numerous providers, saving companies from having to code complex workarounds to make different back ends communicate with one another.

### Multi-factor authentication (MFA)

As we mentioned earlier, implementing MFA is crucial to protect your organization's data from malicious intrusions, and virtually every IAM platform offers some form of MFA. However, it's equally crucial to customize MFA with the appropriate level of security. IN B2C contexts, you need to consider UX and try not to create unnecessary friction for users who don't want to be subjected to heightened scrutiny every time they log in. For workforce IAM, you may want more stringent MFA, since the consequences of an unauthorized party gaining access to your private network can be so devastating.

A modern IAM solution will allow you to implement MFA only when it's needed. This can be accomplished through [step-up authentication or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/) in which users only trigger MFA if they're trying to access sensitive data or their behavior is flagged as risky.

### Anomaly detection

In the past few years, identity has become the preferred gateway for hackers to break into systems. Brute force attacks, credential stuffing attacks, and even highly targeted phishing campaigns are all attempts by hackers to break in through a company's front door: the login box. 

These attacks [can be devastating](https://auth0.com/blog/11-of-the-worst-data-breaches-in-media/), leading to stolen data, legal fallout, and huge spikes in traffic that crash applications. A cutting-edge IAM solution is designed to get in front of those issues through anomaly detection.

There are multiple ways IAM systems can help detect and mitigate malicious attacks. IAM solutions detect attacks by monitoring signals such as the velocity of traffic, detection of login patterns that differ from a user's routine (such as location and browser), use of a breached password, or use of devices and IP addresses with a poor reputation.

In Auth0's case, we use two primary tools for anomaly detection: [brute-force protection and breached password detection](https://auth0.com/docs/anomaly-detection).

Brute-force protection stops users from logging in from the same IP address after a certain number of failed attempts, preventing botnet attacks from causing outages.

Breached password protection is designed to monitor data breaches in which credentials have been compromised and warn both companies and individuals. Auth0's breached password protection lets users customize how they respond to such an event. Customers can notify users when their passwords have been stolen, and if they choose, prevent users from logging in until they change passwords.

## The Benefits of Third-Party IAM

For users, the most visible element of IAM is the login box, but IAM's relationship to security and data management goes far beyond just usernames and passwords. Because of this, developers and IT teams are faced with a choice: build IAM functions in-house or outsource to third-party IAM platforms. 

While there are advantages to each approach, a sophisticated IAM platform links identity across applications, guards against data breaches, and is a valuable source of analytics. Think of it like the circulatory system for all of an organization's digital resources &mdash; just beneath the surface, interwoven through every application.

Many companies chose to build their IAM solution in-house in years past, but these days, more and more are outsourcing their identity and access management needs to third parties. A [2020 Auth0 survey](https://auth0.com/resources/whitepapers/state-app-assembly-2020) of IT professionals found that 58% currently outsource authentication when building applications. This trend has given rise to a new subset of Software as a Service (SaaS), known as [Identity as a Service (IDaaS)](https://auth0.com/blog/what-is-idaas/).

The reasons organizations increasingly choose to buy an IAM platform, rather than attempt to build it, are complex and vary depending on a company's size and needs.

### Cost and time savings

Building and maintaining an in-house identity solution is a challenge for companies of any size and particularly for startups with limited resources. Auth0 customers frequently report that custom IAM solutions can quickly become full-time jobs for multiple developers, representing a fundamental distraction from their core business proposition.

### Adaptability and extensibility

Large enterprises often transition to an external IAM provider because their in-house solution is riddled with legacy code and doesn't integrate with a wide range of applications. In-house solutions are static and closed to outsiders, and repairing one may be more of a headache than it's worth. Instead, enterprises may find more value outsourcing to a platform designed to interface with other systems and add new capabilities.

This confers major business advantages. For instance, an extensible IAM solution is crucial in [post-merger integration](https://auth0.com/resources/whitepapers/Managing-Identitity-10-steps-PMI), helping migrate user identities from multiple sources into a single directory.

### Security and legal compliance

In the past few years, personal data has become a hot-button issue, with numerous high-profile data breaches and the passage of data privacy regulations around the world. Laws like [GDPR and CCPA](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA) demand that businesses exercise greater control over who can access their user data and also require businesses to share that data with users upon request.

There are high costs for failing to comply with data privacy laws, and as more laws are passed, adjusting an IAM solution for each one can easily be costly. Proprietary systems often have hidden vulnerabilities and may not conform to an industry's security best practices. Outsourcing to a trusted third-party IAM platform can offload some of the burdens of compliance and ensure that security measures evolve in keeping with current best practices.

## IAM: Central to Your Business, Crucial to Your Future

As you've seen, IAM is an umbrella term that encompasses multiple tools, functions, and even philosophies about how organizations manage access and identity within their systems. Many executives who aren't used to devoting much thought to IAM are surprised to learn how closely it's tied to security, user experience, and business outcomes. However, even as IAM evolves to be more important and complex, the technology for managing it is evolving to be more comprehensive and intuitive. 

If you're interested in learning more about how Auth0's IAM platform can serve your identity needs, please [reach out to our dedicated team](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


What is IAM?

kerry-ok

Kerry is a marketer that loves to partner with the sales organization. As our SVP for Marketing, she is focused on sharing the Auth0 narrative across the globe. Before Auth0, Kerry spent many years working in B2B Tech at Skytap and F5 Networks. She spends her spare time with her family, dog, working in the yard, and enjoying fantasy football.

Chief Marketing Officer

Kerry Ok

Time to get your login box looking good for summer.

Blame Netflix or Spotify.

In fact, take your pick of any of the digital brands that have made seamless and beautiful UX a staple part of daily life. From one-click checkouts on Amazon to Single Sign-On across all of Google’s services, consumers have never had it better for digital experiences….and they are now expecting it everywhere they go online. 

<include src="TweetQuote" quoteText="Login boxes are the first thing many people engage with on a website. Yet, the importance of them can sometimes be relegated to “as long as it works, it works.”" />
Login boxes are the first thing many people engage with on a website. Yet, the importance of them can sometimes be relegated to “as long as it works, it works.”

The challenge is consumers don’t just want things that work; they want things that work so well they never even notice it. 

And so here are five ways in which your login box is turning your customers away from your brand. 

## 1. Punishing Customers for Forgetting Passwords

Look, we get annoyed by remembering passwords as well. In an ideal world, everyone would have a [1Password account](https://1password.com/?utm_source=google&utm_medium=cpc&utm_campaign=10693428709&utm_content=452812976624&utm_term=1password&gclid=Cj0KCQjw9YWDBhDyARIsADt6sGYRUvg01kNV7O2ZUgZA75169H75u8mbj2ORDrBXdQDN---8eVkYdz4aAuE3EALw_wcB&gclsrc=aw.ds). But we live in a world where people forget things. Making it difficult to reset a password doesn’t help anyone. It won’t make your customers think they should turn over a new leaf; it just makes them annoyed. So make it simple to get a reset and get them into your site.

![Punishing Customers for Forgetting Passwords](https://images.ctfassets.net/23aumh6u8s0i/1mWRLfONXI3jnbGeXJwDfq/4e4437df17ef660bf318af426cf24742/5_ways_your_login_box_02.jpg)

## 2. Not Offering Special Characters for Usernames

People often like to use their real names for usernames. That’s not an unreasonable thing, but some global apps don’t support usernames with special characters, like “ñ” for Spanish names. There’s no worse way to start off with a new customer than to deny them the chance to spell their name properly. Remedy this by building in a more diverse character set.

![Not Offering Special Characters for Usernames](https://images.ctfassets.net/23aumh6u8s0i/7LOPHYGPGCawvU2bUkAe3c/2188ec577b6c6f167a7f95f056a89f36/5_ways_your_login_box_03.jpg)

## 3. Not Giving the Option to See the Password

Phones are getting smaller + hands not = lots of mistyped passwords. We have all had that moment when after typing in the ten-digit password, we find out it’s invalid because the second letter was wrong. So build in a simple toggle that lets users choose whether to make their text input visible before they start typing.

![Not Giving the Option to See the Password](https://images.ctfassets.net/23aumh6u8s0i/4x97XbBe8yb2R36S96DQiD/9d8dc027dbd71b1609d73f804d3da630/5_ways_your_login_box_05.jpg)

## 4. Hiding Your Login Box

Your customer might enjoy playing ‘Where’s Wally’ in their spare time. They probably don’t want to do it when they just want to visit your site. It’s such an obvious one, but making it difficult to find a login box on your site means less time your customer is doing what you want on your site. Put the login box or link clearly where your users can see it.

![Hiding Your Login Box](https://images.ctfassets.net/23aumh6u8s0i/4Qg8CU2b5G4v0ktIWzm9Sv/2ba871cb0bf2201d1da1d1ea613d6099/5_ways_your_login_box_04.jpg)

## 5. Not Offering Social Login

Sometimes people just want to jump straight into buying/streaming/browsing when they visit a site. They don’t want to fill in a registration form, so being able to just one click with their existing social accounts is ideal. This is becoming more and more popular, so when a login box doesn’t have this feature, it stands out. Make things easier by giving the option of using Facebook, Google, or Apple on your login page.

![Not Offering Social Login](https://images.ctfassets.net/23aumh6u8s0i/01wCCtAver8FuaoUGiqELw/59084759856ffb1a83c371e7611f78c3/5_ways_your_login_box_06.jpg)

Taking a little bit of time to enact the above, and your login box — and customers — will thank you for it.

You can find out more about features such as MFA, magic links, SSO, and other ways you can make your login box awesome at [auth0.com ](https://auth0.com/)

<include src="asides/AboutAuth0" />

5 Ways Your Login Box Is Not Living Its Best Life

Vittorio

Vittorio Bertocci is a Principal Architect for Auth0. Before Auth0, he had a lengthy career with Microsoft, where Vittorio worked with Fortune 100 and Global 100 companies, including working on Microsoft’s Azure Active Directory team as principal program manager focusing on the developer experience. He contributed to the inception and launch of Microsoft's claims-based platform components (Windows Identity Foundation and ADFS, ADAL and MSAL SDKs, ASP.NET middleware). Vittorio is a well known speaker, educator and published author.

Principal Architect

Vittorio Bertocci

Identity protocols for internet browsers with Sam Goto (Google Chrome) and George Fletcher (Verizon)

## The Overview

In this episode of _Identity, Unlocked_, principal architect at Auth0 and podcast host Vittorio Bertocci speaks with Sam Goto, software engineer working on Google Chrome, and George Fletcher, Identity Standards architect at Verizon, on the ever-changing world of identity protocols for internet browsers.

Sam focuses on working with browsers to create better functionality in their foundation protocol by determining the good and bad uses of low-level primitives, such as third-party cookies, iFrames, and pop-ups. In particular, Sam highlights how such primitives are being used by trackers and ad services to track users, often without their knowledge or consent- and how that is prompting browser vendors to put new limits to prevent abuses. There is a precedent for this: Sam gives the example of how over time, web apps increasingly abused low-level primitives such as pop-ups- and how browsers eventually put restrictions on them to give a better user experience. Browser vendors are now attempting to do the same to prevent unwanted tracking; however, those interventions are disrupting legitimate scenarios too- identity protocols being one of the most important ones, and the very reason we are having this conversation on Identity, Unlocked. Sam then talks about how browsers are looking to fix these problems by building higher level primitives to replace the low-level ones, but that even these high-level primitives face challenges.

George explains the many problems the modifications to browsers can cause for Identity and OpenID Connect. George also goes into detail about the protocols being implemented between browsers, relying on parties and IdPs for what happens if an IdP goes down, as well as the RP classification and decentralized identity.

Vittorio, Sam, and George go in depth on the state of browser changes and identity protocol today and what’s in store for their futures.

## Key Takeaways

Distinguishing between good and bad motives of low level primitives:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/da8f4e71"></iframe>

What’s happening to identity protocols as browser authentication changes:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/7a5f49ee"></iframe>

Sam talks about the potential for other browsers to integrate Web ID and the new challenges that would come about:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/38619c76"></iframe>

George points out key problems to solving the RP classification problem:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/3445437a"></iframe>

George’s Call to Action:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/6baaec0f"></iframe>

Sam’s Call to Action:
<iframe width="100%" height="230px" scrolling="no" style="border: none" src="https://identityunlocked.auth0.com/player/4a98766b"></iframe>


### Links/Resources:

- Connect with Sam Goto on [LinkedIn](https://www.linkedin.com/in/samuelgoto/)
- Connect with Sam Goto on [Twitter](https://twitter.com/samuelgoto)
- Connect with George Fletcher on [LinkedIn](https://www.linkedin.com/in/gffletch/)
- Connect with George Fletcher on [Twitter](https://twitter.com/gffletch)

<br>

- Connect with Vittorio Bertocci on [LinkedIn](https://www.linkedin.com/in/vittoriobertocci/)
- Connect with Vittorio Bertocci on [Twitter](http://www.twitter.com/vibronet)

<br>

- Learn more about [Identity, Unlocked](https://identityunlocked.auth0.com/public/49/Identity%2C-Unlocked.--bed7fada/episodes)
- Learn more about [Auth0](https://auth0.com/)
- Learn more about the sponsor for this season, the [OpenID Foundation](https://openid.net/foundation/)

<include src="asides/IdentityUnlocked" />

<include src="asides/AboutAuth0" />

"go"