joey devilla headshot 900px

I’m a Senior Developer Advocate at Auth0, and I like to work on various technologies. I’ve developed software for all sorts of platforms, from CD-ROM and the PalmPilot to my current area of focus, mobile phones, IoT devices, and AI. When I’m not looking for strange new platforms to write software for, I’m playing a strange old instrument — the accordion!

Senior Developer Advocate

Joey deVilla

A quickly implemented Auth0 Action can enhance security by requiring users to log in from trusted IP addresses or blocks.

Ensure Users Log in from Trusted Networks with Auth0 Actions

arthur-bellore

I’m a tech content creator. I enjoy breaking up seemingly complicated topics into easy-to-understand pieces for people to read. When I’m not in front of a computer, you’ll usually find me reading books.

Cybersec Writer

Arthur Bellore

Transport Layer Security (TLS) is the cryptographic protocol behind pretty much any computer network used today: from web browsing to email, APIs, and VoIP. But how exactly does it work?

## SSL vs. TLS

SSL, or Secure Sockets Layer, is the predecessor to TLS. It was a cryptographic protocol developed by Netscape in 1994, but since it had serious flaws, it was never released to the public. SSL 2.0 was released publicly one year later, in 1995, but it, too, was found to have serious flaws. Finally, SSL 3.0 was rebuilt from the ground up and released in 1996.

Microsoft, who had its own version of the protocol, and Netscape agreed to hand over the project to the Internet Engineering Task Force (IETF) and make it an open standard. As part of the deal, the name was changed to TLS, Transport Layer Security, to signify that it no longer had ties with Netscape.

The first upgrade to SSL 3.0 was published in 1999 in [RFC 2246](https://datatracker.ietf.org/doc/html/rfc2246) as TLS 1.0. Tim Dierks, the editor of RFC 2246, has said [in his blog](https://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html) that TLS 1.0 was really SSL 3.1, but they changed the name “so it wouldn’t look the IETF was just rubberstamping Netscape’s protocol.” Indeed, if you look at RFC 2246, it says:

This document describes TLS Version 1.0, which uses version { 3, 1 }. Version value 3.1 is historical: TLS version 1.0 is a minor modification to the SSL 3.0 protocol, which bears the version value 3.0.

TLS became the standard of encryption and authentication over computer networks, and it’s still being used today. The most recent version of the protocol is TLS 1.3, which was released in August 2018.

### What is the difference between SSL and TLS?

SSL hasn’t been updated since its release in 1996, and it was deprecated in 2015 in [RFC 7568](https://datatracker.ietf.org/doc/html/rfc7568). Most [modern browsers disable it by default](https://en.wikipedia.org/wiki/Version_history_for_TLS/SSL_support_in_web_browsers) or don’t support it outright anymore.

Despite this, because of the association between the two, many people still use the term SSL when they really mean to say TLS. Vendors typically use the same terms their target customers use to facilitate messaging, so their marketing collateral generally contains terms such as “SSL/TLS” or “SSL,” even though SSL is deprecated.

We now know that SSL and TLS are different things, but for the remainder of this article, SSL will be used interchangeably with TLS to match its everyday usage.

## Why SSL/TLS Was Created

For two computers to communicate with each other, they must perform a set of agreed-upon operations in a specific order. A **protocol** is what dictates those operations. The HTTP protocol is the protocol that web servers and clients use to establish a connection and communicate with each other through the Internet.

It works roughly as follows:

1. The server listens for new connections on port 80
2. The client connects to the server, and this starts a chain of operations as set forth by the HTTP protocol
3. The client sends a GET request to the server; the server receives the request, processes it, then sends back a response: headers and index.html, plus other content it might need to serve (CSS files, JavaScript files, cookies, etc.) for the client to render the content correctly.

This works to distribute content between two remote computers, but there is a problem: HTTP was intended to expand the local knowledge management tools throughout the multiple computers at CERN in the late 1980s, so it was designed as a clear text protocol.

Because it’s clear text, a malicious actor could insert themselves between client and server and potentially read sensitive information, such as credit card numbers or passwords, or they could intercept the client’s requests and serve back malicious files pretending to be server.

As the Internet evolved and the number of sensitive information flying around increased exponentially, an encryption layer sitting below HTTP was necessary. However, this is a bit tricky: if a bad actor can “listen in” the conversation between client and server while the connection is unencrypted, how can they exchange encryption keys securely?

One option would be for the two parties to create a public-private key pair and send over the public key pair to the other party, so they can use that to encrypt their packet before sending them over the wire.

The problem with this is that asymmetric (public-key) cryptography is _much slower_ than symmetric cryptography.

The "strength" of asymmetrical cryptography relies on modular arithmetic, mathematical operations that are very hard to do in the opposite direction. The numbers used in these operations need to be big enough to provide the necessary security, but performing arithmetic with very large numbers can be taxing on a CPU.

Symmetric cryptography, on the other hand, works differently and does not suffer from this problem. On top of that, most devices have AES instruction sets integrated into their CPUs to speed up AES operations, making AES encryption have almost zero overhead on modern devices.

The TLS protocol gets around this issue by using asymmetric cryptography to exchange keys at the beginning and then switch to symmetric keys (“sessions keys”) from then on in a process known as the TLS handshake.


## TLS handshakes

The exact steps of the TLS handshake will depend on which TLS version is supported by the client and server, as well as which parameters they are set to use.

Since most modern browsers still support TLS 1.2 and a lot of websites still use TLS 1.2 (according to a [paper published by Syed-Winkler](https://www.grin.com/document/1037281), as of February 2021, TLS 1.3 is supported by 42.9% of surveyed websites, while TLS 1.2 is supported by 99.3%), we will talk about TLS 1.2 first and then discuss how TLS 1.3 differs from 1.2.


### The TLS 1.2 handshake

TLS 1.2 can be configured to use many key exchange algorithms, and among them, the most well-known and widely used is the RSA key exchange algorithm. Let’s go over how the RSA algorithm works in TLS 1.2, then talk about how the process differs in TLS 1.3 with the [Diffie-Hellman](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) (DH) key exchange algorithm.

The RSA key exchange works roughly as follows in TLS 1.2:

1. **Server listens for new connections on port 443.**
2. **Client connects to port 443 and initiates the handshake process with a ClientHello message to the server.** This message contains the TLS versions and cipher suites the client supports and a 32-byte random number known as Client Random.
3. **Server says “hello” back with a ServerHello message.** The server selects a cipher and the TLS version from the list provided by the client, then generates a different 32-byte random number known as Server Random and sends it all back along with the server’s own SSL certificate.
4. **Client uses the SSL certificate to verify the server’s identity.** SSL certificates contain a public key generated by the server and a digital signature signed with the private key of a trusted third party known as a certificate authority (CA). Most web browsers and operating systems come bundled with public keys from trusted CAs, which are used to verify that the CA issued the certificate.
5. **The client verifies the server has the matching private key to the certificate through ClientKeyExchange.** The client generates the pre-master secret (a 48-byte random number) and encrypts it with the server’s public key obtained from the certificate. If the server is the true owner of the certificate, it must be able to decrypt the message and obtain the original pre-master secret.
6. **Server decrypts the pre-master secret.** Now both the server and client have the pre-master secret, the Server Random, and the Client Random. They can use that to derive the master secret using the previously agreed cipher and arrive at the same (symmetric) key, which will become the session key once both parties verify their keys match.
7. **Client sends a ChangeCipherSpec message.** This indicates that the client is ready to create the session key and start communicating through an encrypted tunnel using that key.
8. **Client proves to server it has the correct keys.** The client hashes all handshake records up to that point, encrypts them with the session key, and sends them to the server. If the server generates the correct key, it will be able to decrypt that message and verify the record hashes (which the server can independently generate).
9. **Server proves to the client that it has the correct keys.** The server does the same thing and sends it to the client.
10. **A secure connection is established.** If both keys match, the TLS handshake is complete.

<br>
#### Problems with TLS 1.2

TLS 1.2 left a lot of its configuration parameters up to the users, which often resulted in bad choices (the old security adage of “among too many options, the worst one will be chosen”).

Additionally, in the name of backward compatibility, TLS 1.2 also allowed old, insecure ciphers to be used. (TLS 1.2 itself was released in 2008.) As time passed, it became more prone to attacks as vulnerabilities in older cipher or versions of TLS were discovered.

On top of all that, the RSA key exchange has a few weaknesses:

* **The same public-private key pair is used both to authenticate the server and to encrypt the pre-master secret (item #5 above).** If an attacker obtains the private key, they will be able to re-generate the session keys and be to decrypt the entire session.
* **There is no Perfect Forward Secrecy (PFS).** Since the server’s private key doesn’t change, an attacker might record and store encrypted data for years, hoping to decrypt it years down the line if the server’s private key is ever leaked or compromised.
* **Performance.** It’s necessary to make two round trips between the client and server until the session key is established.

To address these problems, the IETF began developing TLS 1.3 in 2013 and finally released it to the public in August 2018.

### What changed in TLS 1.3

In practice, the main differences between TLS 1.3 and 1.2 are:

* Shorter handshake
* Only supports key exchange algorithms with perfect forward secrecy (PFS), such as ephemeral Diffie-Hellman
* Support for 0-RTT (Zero Round Trip Time) resumption

This represents a bit of a paradigm change in TLS 1.3: shifting the focus from user configurability and backward compatibility to security by being more opinionated.

This allowed the designers to create a shorter handshake (by restraining DH as the only key exchange algorithm) but also prevented developers from choosing insecure options by restricting the number of options available in the first place.

For example, while it was technically possible to use DH as the key exchange method in TLS 1.2, the participants were responsible for setting the DH parameters. Picking the right parameters is crucial to make sure the DH exchange is secure, as some parameters can be trivially broken.

In 2015, security researchers [published a paper](https://weakdh.org/) describing how the WeakDH attack, which affected 8.4% of the top 1 million domains at the time, could trick servers into using small (insecure) DH parameters, enabling adversaries to decrypt data transmitted between client and server.

TLS 1.3 makes it impossible to use anything but a set of DH parameters that are believed to be secure.

### The TLS 1.3 handshake

Because there are significantly fewer options for the client and server to agree on, the TLS 1.3 handshake is much simpler:

1. **Server listens for new connections on port 443.**
2. **Client connects to port 443 and initiates the handshake process with a ClientHello message to the server.** Since the list of cipher suites was vastly reduced in TLS 1.3 (from 37 to 5), the client assumes the server is going to use one of the five. It proactively calculates a key pair for each of the cipher suites and sends it to the server along with the protocol version.
3. **Server calculates the key session.** With the client’s key share, the server is able to generate the session key.
4. **Server says “hello” back with a ServerHello message.** The server generates its own key share and sends it over to the client, so it also can generate the session key, along with the server’s encrypted SSL certificate (using the session key created on #3).
5. **Client generates master secret and a secure connection is established.** The client receives the server’s key share and calculates the session key. It decrypts and verifies the server’s certificates, and if everything is good, the handshake is complete.

Note that there are two different public-private key pairs on an ephemeral DH exchange: the first is the ephemeral pair, created every time client and server establish a connection, which guarantees forward secrecy. The second pair, embedded on the SSL certificate, is used for authentication and doesn’t change.

Given that a new key is generated for every session, this feature guarantees PFS. If the encryption keys are compromised at a later date, the leaked key will only be able to decrypt the specific session to which it corresponds; all the prior sessions are still safe. As a result, large-scale storage of data transmitted between server and client is rendered worthless.

## How Auth0 Can Help

The temptation to intercept, undermine, and circumvent encryption has never been stronger. Cybercriminals are working to find ways to get around the issues that strong encryption presents due to the volume of valuable information that is sent between computers today.

While this rarely results in direct assaults against cryptographic algorithms or protocols, it frequently prompts attackers to devise novel methods of intercepting or capturing information. With these threats ever present, it is more crucial than ever to focus on maintaining strong and up-to-date implementations of effective encryption protocols.

Some applications are still running TLS versions older than 1.2, and others are still running the original SSL protocol. If yours is one of them, you should consider upgrading it immediately. Auth0 [supports both TLS 1.2 and TLS 1.3](https://auth0.com/docs/customize/custom-domains/self-managed-certificates/tls-ssl) and can help you keep your applications secure.

The TLS Handshake Explained

kaycie-east

As PR Manager, Kaycie supports public relations and global communications efforts for Auth0 in the AMER region. When not promoting the Auth0 brand, Kaycie can be found hiking, traveling, or searching for the next best bite to eat.

PR Manager, AMER Region

Kaycie East

Value-added distributor to provide Auth0’s identity management solutions for LATAM’s top companies

**BUENOS AIRES, Argentina – June 29, 2021 –** The** **[Auth0 Identity Platform](https://auth0.com/),  a product unit within Okta (NASDAQ: OKTA), today announced a partnership with [CLM](https://clm.com.br/), a value-added distributor that specializes in advanced data center infrastructure and cybersecurity. CLM is Auth0’s first distribution partner in Latin America (LATAM) and extends Auth0’s reach into Brazil, Colombia, Ecuador, and Peru to provide local partners and their customers with an extensible, trusted identity management solution.

CLM operates in LATAM and specializes in creating opportunities across the channel ecosystem by educating their clients on best of breed solutions such as Auth0 to solve their customer identity management needs. The addition of CLM to Auth0’s [Partner Program](https://auth0.com/partners) and Auth0’s growth in LATAM indicates demand for cloud-based identity management solutions that balance security and customer experience. 

The onset of COVID-19 has accelerated the transition to digital globally. Delivering a secure and frictionless customer experience online starts with a [Customer Identity and Access Management (CIAM)](https://auth0.com/resources/whitepapers/ciam-buyers-guide) solution that enables businesses to capture, convert, and retain customers and fuel business growth. A [recent PwC survey](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) found that approximately half of consumers (49%) in LATAM say they will walk away from a brand they love after just one bad experience. 

“Companies cannot predict exactly what their business and customers will need tomorrow, especially in response to today’s rapidly changing digital environment. With identity at the heart of security and any transformation process, an adaptable and modular identity solution that supports the breadth of all identity needs is essential,” said Gabriel Camargo, product director at CLM. “Auth0 is a trusted identity management provider and a natural addition to our best-in-class portfolio of disruptive vendors.”

Together, Auth0 and CLM are supporting major companies in Latin America—including [AK Networks](http://akcela.com.br/) and [XP Inc.](https://www.xpi.com.br/)—to meet their evolving identity management and security goals.

“We are honored to welcome CLM to our Partner Program and join forces to deliver growth opportunities to customers in Brazil and throughout LATAM,” said Ghazi Masood, SVP, Americas at Auth0. “The addition of Auth0 to CLM’s cybersecurity portfolio means partners and their customers now have a set of extensible building blocks to solve for any identity use case without having to compromise between convenience, privacy, or security—allowing them to innovate and launch products and services faster.”

<include src="asides/AboutAuth0" />
### Media Contacts
Auth0 Global Communications<br />
[press@auth0.com](mailto:press@auth0.com)<br />

Grupo Muchnik for Auth0<br />
[auth0@muchnik.co](mailto:auth0@muchnik.co)<br />

Auth0 Expands Global Partner Network in Latin America with CLM

duncan-godfrey

Duncan is a security, engineering, and business leader. His background is in security engineering and, in particular, cloud security.

Sr. Director of Security and Compliance

Duncan Godfrey



The death of the corporate network had long been predicted. You can't rely on your old corporate controls anymore &mdash; firewalls, NIDS, and WAFs don't keep attackers out; "they are a Band-aid," they said. They give you a "false sense of security," they cried. I know you think your hardened perimeter protects you, but eventually, someone will find their way past it. Once there is that single crack, an attacker can rampage around your network's soft center. Building a castle wall around your data won't stop a persistent threat.

The security industry had an answer for that; you started to hear about more and more companies pushing towards a Zero Trust security model. Then you started to read about Google's [BeyondCorp](https://cloud.google.com/beyondcorp#:~:text=BeyondCorp%20began%20as%20an%20internal,authorization%20for%20Google's%20core%20infrastructure.) implementation. And then you visited the vendor floor at a major security conference, and you found a lot of companies willing to sell you that zero trust dream. 

It all made total sense. Why should you trust a device just because it's inside your perimeter? Why do you even need a perimeter?! Do I even know what my perimeter is?!

Then, on Monday morning, you returned to your headquarters and were confronted with your reality. Most people were still in your office. They came in every day and left again. Maybe they did some work here and there outside of the building, a flex-day to work around an appointment or a school sports day. The corporate applications that kept your Business running mostly still lived in your data center, within your building, and accessed from the local network. Your perimeter was pretty hard; it was the walls of your buildings that wrapped around your employees. Adding external access outside of your corporate VPN introduced its own set of problems and risks. Then, before you could start decoupling them, they were still heavily integrated with an old legacy IAM system, which was also sitting in your data center. 

What you had was mostly fine. It's hard to get investment in the [digital transformation](https://auth0.com/blog/what-digital-transformation-is-and-what-it-isnt/) when things are static and mostly the same.

Then it wasn't the same. 

Overnight your workforce moved out of the office, off your network to their homes. And, your corporate network was no more. The process now was remote.

I've repeatedly heard this story from many Security and IT leaders. Their world has suddenly changed overnight. A scramble began to build or upgrade the infrastructure needed to move their employees into a remote environment: they quickly spun up a VPN, or in some cases, they just open applications up to the Internet. They allowed users to roam beyond their castle walls and allowed access to data in ways that would have terrified them previously.

## There Never Was a Castle Wall Around Your Data

I was having some fun in the intro, but most security professionals have had the realization that their networks were not fortresses. Unless you are able to disconnect your users from the Internet, then you were only ever one firewall rule change, misconfigured wireless access point, or a secret operations maintenance backdoor away from having unexpected and unmonitored remote access. If you issued Laptops, then unless you had locked in a mandatory full tunnel VPN, then your users were likely taking them home to work on the weekends, and you lost visibility into their activity "off-net."

The reality of [Shadow IT](https://en.wikipedia.org/wiki/Shadow_IT) in Enterprise environments is not new. People expect to move quickly, and if your infrastructure was static and restrictive, then likely your users had silently adopted a new cloud tool. This means that your data was being moved to unknown and unmonitored locations. Finding and curbing this has always been ongoing risk mitigation for IT and Security teams.

## Remote Is Here to Stay So Make It Your Strength, Not Your Weakness

In the early months of this pandemic, we thought a lot of this new infrastructure would be temporary. But we already see a changing landscape for remote work. Twitter's [announcement](https://techcrunch.com/2020/05/12/twitter-says-staff-can-continue-working-from-home-permanently/) they would permanently move to a remote model received a lot of headlines, and they were quickly joined by a number of large [companies](https://github.com/arjunmadgavkar/Newly-Remote-Companies/blob/master/List.md), including [Atlassian](https://www.smartcompany.com.au/startupsmart/news/atlassian-remote-work-permanent/), that have made it clear that this will be their new normal.

This has always been our normal at Auth0, and, in fact, we viewed our remote workforce as a competitive advantage. We could find talent anywhere in the world, offer candidates real mobility and flexibility, and attract top talent who wanted to escape expensive tech centers. Employees had been identifying remote work as a key differentiating job perk before it became a necessity.

So, your security controls need to catch-up with this new reality. Remember, being nimble with your infrastructure and policy means you can now move at the speed of the Business. You can give them what they want!

## A Remote Workforce Doesn’t Have to Reduce Your Security Posture, in Fact, the Opposite Is True as Long as You Put the Right Building Blocks in Place

This new environment changes your [Threat Model](https://en.wikipedia.org/wiki/Threat_model#:~:text=Threat%20modeling%20is%20a%20process,and%20mitigations%20can%20be%20prioritized.) and your risk. For example, a fundamental principle for our environment has always been that our employee laptops are never on a "safe" network. Sometimes, people are in the office, but likely they are at home or traveling. With this in mind, you harden them accordingly - making sure they are resistant to a colocated attacker and that you have deep visibility into their behavior.

The Zero Trust concept is itself maturing, and with NIST's publication of their [Draft ZT Paper](https://csrc.nist.gov/News/2019/zero-trust-architecture-draft-sp-800-207), an agreed definition of a Zero Trust Architecture (ZTA) is forming. This also clears the way for the Federal Government and risk-averse Enterprises to consider this approach. The security industry rallying around a standard approach is good for our users as we are all working together. And, to tie it back to our threat model, what this approach does is recognize that a lot of attacks are successful because that attacker is able to steal a credential and leverage it. So that an "outsider" immediately looks like an insider and is therefore trusted. 

This puts authentication at the forefront of your security controls and further drives home that Identity is the perimeter. And, at a minimum, this means the building blocks of:
	
1. Strong [authentication](https://auth0.com/blog/what-is-an-authentication-server/), are you using [multifactor authentication](https://auth0.com/learn/get-started-with-mfa/) everywhere in your Enterprise? Preferably use a hardware token.
2. Maintain an agile IAM solution that provides centralized SSO for all these new apps to be monitored and controlled.

2020 has forced some quick and reactive changes upon us. As we move forward, there should also be space for some positive security wins to come out of a terrible situation. This is the new normal, but we do have the building blocks to secure it, especially if you begin building with Identity at the heart of your Security Architecture.


The Death of the Corporate Network

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Streaming companies must adapt to unprecedented network strain



Everyone is coping with the Coronavirus pandemic in their own ways, yet people around the world seem to share a few rituals: washing our hands, wearing masks, and of course, catching up on our Netflix queue. 

With much of the world’s population stuck at home under social distancing, quarantine, and mandatory lockdowns, consumer spending on streaming has increased [anywhere from 20% to 50%](https://www.nytimes.com/interactive/2020/04/11/business/economy/coronavirus-us-economy-spending.html) depending on the channel. Given this unprecedented surge in demand, it’s not hyperbolic to say the internet is going through the most intense stress test in its history.

The global desire for entertainment and escapism is [creating a windfall for streaming services](https://www.cnn.com/2020/03/02/investing/coronavirus-stay-at-home-stocks/index.html). Netflix, for example, [more than doubled](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown) its projected number of new subscribers since the pandemic began, and [Disney+ added](https://www.theguardian.com/media/2020/apr/09/disney-netflix-rival-doubles-subscriptions-in-virus-lockdown) 22 million subscribers as well. However, a combination of network slowdowns (and failures) and streaming models that don’t monetize increased traffic means that the situation for streaming media companies is more complicated than it first appears.

Media companies are facing new challenges and new opportunities and working to develop technological solutions that help them weather this historic moment.

## Quarantined Nations Increase Their Streaming Time

We can see the effects of COVID-19 on streaming services by watching how currently quarantined countries (those hits hardest by the virus) have been behaving. Even without a full-blown quarantine, the rise of voluntary social distancing and enforced isolation creates at least a comparable situation.

Though China [is showing signs of recovery](https://www.cnn.com/2020/03/19/asia/coronavirus-covid-19-update-china-intl-hnk/index.html), they implemented mass quarantine first and can give us useful data on streaming behavior. Chinese Nielsen [data shows a significant rise](https://mp.weixin.qq.com/s/vxKFJOFeXLWuasuvtu7kBw) in TV viewing, but people are also streaming less conventional content. Quarantined Chinese citizens are getting creative with streaming entertainment, [streaming concerts](https://www.nytimes.com/2020/03/04/arts/music/arts-coronavirus.html), and [setting up digital clubbing and digital gyms](https://www.bbc.com/news/world-asia-china-51628693) in their living rooms.

Italy, still in quarantine, has seen a similar rise in streaming content, with an average viewing-time increase of [11% nationally with highs of 17%](https://www.corriere.it/spettacoli/20_febbraio_29/effetto-coronavirus-volano-ascolti-telegiornali-talk-9399464c-5afe-11ea-8b1a-b76251361796.shtml?refresh_ce-cp) in the Lombardy region. During the nationwide quarantine, the Italian telecoms giant Telecom Italian SpA has reported an overall [70% increase in internet traffic](https://www.bloomberg.com/news/articles/2020-03-12/housebound-italian-kids-strain-network-with-fortnite-marathon) from work-from-home traffic and daytime online gaming.

**The spread of the novel coronavirus is also forcing studios and streaming services to rethink how they create and distribute content**, jumping release dates forward, skipping the box office, and closing down production. This will all lead to greater strain on streaming services and the larger internet.

The outbreak is closing theaters [across the United States and across the world](https://www.npr.org/2020/03/17/817136846/as-coronavirus-shuts-down-theaters-universal-shifts-some-films-to-on-demand), which has been linked to a [13% rise in streaming in the US that could rise up to 60%](https://time.com/5806060/coronavirus-movie-theaters-streaming/) based on prior crises. Production companies are fighting this by streaming [first-run movies straight to home services](https://www.vulture.com/2020/03/coronavirus-is-pushing-movies-online-faster-than-ever-before.html): Universal released _Emma_ and other new movies to streaming services, the new Pixar movie _Onward_ is going right to Disney+, and huge films like _Frozen 2_, _Birds of Prey_, and _The Invisible Man_ are coming much sooner than their prior release date.

While these first-run movies popping up on streaming services does create a large viewership base at home, it may not lead to the massive streaming profits being predicted.

<include src="TweetQuote" quoteText="Consumer spending on streaming media is up 20-50%. What streaming media companies can do to make sure they can withstand the quarantine-driven stress test."/>

## Streaming Services Are Doing Better Than Expected

It seems like a simple, logical equation: more time at home equals more streaming, which means greater profits for streaming services. But many streaming services, like Netflix, aren’t modeled to reap more profits from an increase in individual streaming time - which is why some were predicting that Netflix might not see a huge boost in profits.

  “If you have to decide between food and your Netflix subscription, it seems to me like you disconnect your Netflix. You’re probably not going to add another $13 a month if you don’t know when your next paycheck’s going to come in.” — Laura Martin, the senior entertainment analyst at Needham & Company, [told the Guardian](https://www.theguardian.com/film/2020/mar/12/coronavirus-binge-watching-netflix-streamers-viral).

**Netflix doesn’t monetize volume**. They make their money [from subscriptions](https://www.vox.com/2019/12/17/21025154/netflix-global-growth-numbers-sec-streaming-investors) ([and some product placement](https://www.cnbc.com/2017/07/27/bill-gates-ben-does-product-placement-in-netflix-and-amazon-shows.html)). The stock market reflects this uncertainty — Netflix has seen [less than a quarter of a percent of growth](https://www.cnbc.com/quotes/?symbol=NFLX) in the last month.

However, despite a [majority of consumers being aware of Netflix](https://morningconsult.com/2019/09/19/in-tvs-content-war-netflixs-shows-capture-biggest-share-of-viewer-awareness/) before lockdown and quarantine conditions, Netflix has seen a surprising surge in subscriptions. In fact, they’ve doubled their estimates: from an estimated 7 million new subscribers [to 15.77 million new subscribers](https://www.theguardian.com/media/2020/apr/21/netflix-new-subscribers-covid-19-lockdown). 

This may be a temporary situation however: considering the shutdown of television and movie production across the board, time will tell if new subscribers will stick around for old content.

**A la carte streaming services like Amazon Prime may see a boost in revenue**. An Amazon Prime subscription [nets users a variety of shows and movies](https://www.businessinsider.com/amazon-prime-benefits-what-is-included) for “free,” like Netflix, but the newest releases must be rented or purchased.

Then again, despite the [rush of online ordering](https://blog.aboutamazon.com/company-news/amazons-actions-to-help-employees-communities-and-customers-affected-by-covid-19) and their strong grip on streaming media, [Amazon stock isn’t seeing much of a surge either](https://www.cnbc.com/quotes/?symbol=AMZN). Though the entire stock market has taken a hit, [early predictions that streaming company stock would be safe refuges](https://nypost.com/2020/02/28/how-coronavirus-benefits-netflix-and-other-in-home-services/) may have been premature.

Meanwhile, Twitch — the [most popular streaming service](https://www.nytimes.com/2019/12/15/business/tech-video-game-streaming-twitch.html) for gaming videos and livestreams — [has seen a 10% growth](https://www.theverge.com/2020/3/18/21185114/twitch-youtube-livestreaming-streamelements-coronavirus-quarantine-viewership-numbers) in viewership as of March 18. Unlike Netflix or Amazon Prime, Twitch monetizes through ads and will likely see a commensurate rise in revenue.

But differing monetization methods don’t tell the whole story. These potential revenue boosts or profit stagnation trends are dependent on network architecture surviving the sudden swell of usage, which may not be a guarantee.

## Strained Network Architecture Will Need Relief

Social distancing and quarantine [are closing schools](https://www.npr.org/sections/health-shots/2020/03/16/816428320/coronavirus-u-s-enters-quarantine-life-as-many-schools-and-businesses-close) and [workplaces](https://www.washingtonpost.com/national/coronavirus-outbreak-shutdown-america/2020/03/13/d8589434-6550-11ea-acca-80c22bbee96f_story.html), which means a glut of people at home streaming media for entertainment, work, and educational purposes placing unprecedented strain on the internet. Some websites are [even taking bets](https://www.sportsbettingdime.com/news/odds-global-netflix-outage-playstation-network-xbox-live-crash/) on which streaming or web service will go down next.

[Microsoft Teams crashed](https://www.independent.co.uk/life-style/gadgets-and-tech/news/microsoft-teams-service-status-crashes-outage-issues-today-work-home-down-a9404771.html) under the increased load of remote video conferences, and YouTube and Netflix have started [throttling quality on their videos](https://edition.cnn.com/2020/03/19/tech/netflix-internet-overload-eu/index.html) in order to reduce bandwidth in the face of the surge. Hulu [users reported a widespread outage](https://www.cnet.com/news/hulu-is-down-as-users-complain-of-videos-not-loading/) on March 20, one that seemed to affect multiple devices:

![hulu-activity-03-20-2020](https://images.ctfassets.net/23aumh6u8s0i/6Gp4ntk7M1cxNGwTHZxD3k/049ae9a357782e60896684ff437b7297/hulu-activity-march-20-2020)
[DownDetector.com](http://DownDetector.com) - Hulu - March 20, 2020

Many companies [suspended their data caps](https://www.cnet.com/news/carriers-are-suspending-internet-data-caps-during-coronavirus/) and [increased streaming limits](https://www.pcgamer.com/discord-ups-streaming-viewer-limit-while-coronavirus-keeps-people-at-home/) in order to help people stay entertained and in contact during isolation and quarantine. However, these acts of generosity may increase the amount of simultaneous traffic online.

Streaming services may need to try new network solutions to stay ahead of this bloom of potentially network-crashing traffic.

## Private Cloud Boosts Streaming Infrastructure

In the face of this inflating audience and inflating screen time, streaming services using a public cloud may want to consider other options to bolster their network architecture.

There’s nothing wrong with choosing a public cloud; it’s a perfectly reasonable option for a smaller streaming service. Larger streaming services, however, can increase their bandwidth and reduce their downtime and slowdowns with a private cloud solution.

A private cloud service like Auth0 offers scalability and can provide a [greater request-per-second](https://auth0.com/blog/how-finservs-can-reduce-risk-increase-innovation-with-private-cloud/) (rps) baseline — one that can add capacity as needed. It also has enhanced uptime over a public cloud, with a guaranteed 99.99% uptime.

<include src="TweetQuote" quoteText="How private cloud can help streaming companies withstand quarantine streaming pressures."/>

A private cloud doesn’t share resources or bandwidth with other companies, which is where a public cloud can sometimes struggle. Public cloud services like AWS do create server instances as needed, but they’re doing that for every business or individual using the service.  COVID-19 isolation causes internet traffic to increase through every channel — streaming media, [communication](https://www.voicesage.com/blog/communication-best-practices-for-organisations-working-to-contain-covid-19/), [education](https://nypost.com/2020/03/17/coronavirus-in-ny-teachers-prepare-for-unprecedented-challenges-of-remote-learning/), and more — public cloud services are going to be hit from multiple angles at increasing speeds.

A private cloud can help streaming companies with servers dedicated to their businesses. Moreover, a private cloud can be managed or unmanaged, depending on whether you have the time and dedicated staff to maintain it.

## Getting Through This Together, Apart

The COVID-19 pandemic is a situation without precedent, creating entire nations of at-home workers, students, and entertainment-seekers all jumping on the internet at the same time. And with isolation and [lockdown orders](https://www.wsj.com/articles/china-reports-no-new-domestic-coronavirus-infections-for-the-first-time-since-outbreak-started-11584611233) coming [faster every day](https://www.washingtonpost.com/world/2020/03/20/coronavirus-latest-news/), this isn’t a situation [likely to change in the immediate future](https://www.washingtonpost.com/health/2020/03/16/social-distancing-coronavirus/).

Keeping streaming services going is a necessity for education, entertainment, and the economy. After a discussion with Netflix CEO Reed Hastings, the Internal Market Commissioner of Brussels, Thierry Breton, had this to say in [a statement to Politico](https://www.politico.eu/article/brussels-in-talks-with-netflix-about-reducing-internet-congestion/):

  “We all have a joint responsibility to take steps to ensure the smooth functioning of the internet during the battle against the virus propagation.”

With scalable network solutions such as a private cloud, we can deploy and use more servers to keep everyone entertained, educated, in shape, and in contact with one another until the situation is resolved. And, hopefully, we can all get back to business — and life — as usual.

<include src="asides/AboutAuth0" />


The (Surprisingly Complex) Impact of COVID-19 on Streaming Media

Leading professional services provider to integrate Auth0 for digital transformation initiatives



**BELLEVUE, Wash. – February 26, 2020 –** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, today announced that [Cognizant](https://www.cognizant.com/) (Nasdaq: CTSH) has joined its [Partner Program](https://auth0.com/partners) and will use Auth0 as one of its main authentication providers for any of its customers’ identity management needs. Ranked 193 on the Fortune 500 list with nearly 300,000 employees, Cognizant is an integral partner in transforming global enterprises’ business, operating, and technology models for the digital era.  

“Cognizant’s broad portfolio of consulting, professional, and managed security services are designed to help our clients around the globe to meet their security challenges,” said Ryan Parthasarathy, Vice President of Cognizant Security. “Given the complexity of identity management, we’re proud to partner with a global expert and game-changer in the CIAM space to enhance our security offerings and deliver only the best for our customers.”

Known for its highly-scalable platform, Auth0 was recently ranked as a [Leader for CIAM](https://auth0.com/blog/auth0-named-a-leader-in-the-g2-winter-2020/) on G2, the world’s leading business solutions review website. With high-velocity growth and more than 9,000 customers worldwide, Auth0 is answering the demand for identity management with a simple, extensible, and powerful solution for any application, for any audience.

“We’re thrilled to partner with Cognizant, an experienced leader in complex identity projects, and combine our teams’ expertise with our extensible, flexible, and trusted platform to aid Cognizant customers in a successful and secure digital transformation journey,” said Bill Lapcevic, VP of business development of Auth0. “Identity management is a critical and complex step in any transformation process, and a strong CIAM system will help customers modernize their business in a quicker and more organized fashion to address identity and security needs.”

Learn more about the [Auth0 Partner Program here](https://auth0.com/partners) along with the recent [growth of Auth0’s global partner network](https://auth0.com/blog/auth0-partner-program-accelerates-global-growth/), now serving more than 60 partners worldwide.

For more information about Cognizant Security, please visit [www.cognizant.com/security](https://www.cognizant.com/security).

<include src="asides/AboutAuth0" />

### Media Contacts
Kaycie East<br>
Auth0 Global Communications<br>
[press@auth0.com](mailto:press@auth0.com)<br>
 
Ryan Schin<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com)<br>


Auth0 Expands Global Partner Network with Cognizant

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 selected for meeting criteria and providing demonstrated market fit for AWS customers



**BELLEVUE, Wash. - Dec. 4, 2019 -** The [Auth0](https://auth0.com/) Identity Platform, a product unit within Okta, announced today that it has joined the Amazon Web Services (AWS) Partner Network (APN) Global Startup Program. The APN Global Startup is a unique “white glove” support and go-to-market (GTM) Program for selected startup APN Partners so that they can build on their AWS expertise, better serve shared customers, and accelerate their growth. To be selected for the APN Global Startup Program, [Auth0](https://auth0.com/) has to meet pre-defined criteria, including a clear, demonstrated product-market fit for an innovative enterprise tech product, be backed and recommended by a top-tier venture capital firm, and have a strategic commitment to building their cloud expertise.

The APN Global Startup Program enables qualifying startups to gain product design wins, visibility, exposure, leads, and commercial opportunities made possible with exclusive APN resources and dedicated Startup Partner Development Managers (PDM) with deep AWS knowledge and startup business experience, that guide startups in their growth journey with AWS. By becoming an APN Global Startup Partner, [Auth0](https://auth0.com/) will receive benefits ranging from a tailor-made plan for mapping the startup needs and opportunities to a selection of AWS services and APN programs, promotion support to drive visibility and awareness around the startup offering, to resources for helping startups sell and deploy innovative solutions on behalf of AWS shared end-customers.

“Auth0 is honored to be part of the AWS Partner Network Global Startup Program. We look forward to taking advantage of the additional support and worldwide exposure they are providing as part of this program,” said Eric Snyder, senior director of partnerships at Auth0. “We are dedicated to being a valuable partner in the AWS network and providing the best identity management platform to all customers.”

Auth0’s universal platform provides out-of-the-box extensible identity management for customers of virtually any size, and any authentication or authorization needs. As a member of the AWS APN Global Startup Program, Auth0 will continue to help companies achieve their technology goals by leveraging the agility, breadth of services, and pace of innovation that AWS provides.

“[Working with Auth0](https://auth0.com/case-studies/chaossearch/) enabled us to deliver an SSO offering to the **CHAOS**SEARCH customers in a time frame that was impossible without them,” said Thomas Hazel, founder, and CTO, **CHAOS**SEARCH. “By choosing Auth0, we can meet our enterprise customer demand for federated identity in a simple and elegant deployment, allowing us to focus on the business value of our offering. The service was easy to implement and the team, from beginning to end, was exceptional.”

AWS is enabling scalable, flexible, and cost-effective solutions from startups to global enterprises. The APN is a global program helping partners build a successful AWS-based business, by helping organizations build, market, and sell their offerings. The APN provides valuable business, technical, and marketing support, to help startups achieve exponential growth. 

For more information on how AWS customers can have the quick, easily implemented identity solution they need for their specific application, please download the [Why Auth0 and AWS](https://auth0.com/resources/ebooks/aws-auth0-ebook) ebook.

<include src="asides/AboutAuth0" /> 

### Media Contacts <br>
Alex Plew<br>
Matter for Auth0<br>
[auth0@matternow.com](mailto:auth0@matternow.com) <br>

Deepika Zafar<br>
Racepoint Global for Auth0, EMEA<br>
[auth0@racepointglobal.com](mailto:auth0@racepointglobal.com)<br>



Auth0 Joins the AWS Partner Network Global Startup Program

jenny-obrien

I'm a former business journalist who's fascinated by the intersection of tech and business strategy — in particular how the right solution can transform an idea into reality. I specialize in ROI, data privacy, and identity.

Business Content Manager

Jenny O'Brien

Constantly test new technologies, monitor user behavior, and maintain secure networks to reap the full rewards.



While humans traditionally have staffed assembly lines, prepped and served food, and entered data into spreadsheets — more and more, machines are taking over these tasks. Although we're far from seeing robots at work that dominate entire professions, organizations are beginning to realize value from integrating intelligent machines into day-to-day operations. Small fixes like allowing machines to [prep tax forms](https://www.teampay.co/insights/finance-jobs-taken-by-robots/) or support with [revenue recognition](https://www.zuora.com/2018/05/31/the-art-and-science-of-revenue-automation-practical-lessons-for-automating-revenue-under-asc-606/) can speed things up during crunch time and allow employees to do more creative and complex work.

With advances in workplace automation come a new set of security concerns. Interconnected devices and systems mean that an attack in one location can have ripple effects across an entire company. A [data breach](https://auth0.com/blog/what-is-a-data-breach/) in one factory, for example, could halt processes across several plants. If cyberthieves illegally access patient records, they have the power to tamper with patients' medical devices and buy prescription drugs in their name.

This piece highlights three major examples of workplace automation and the ways team leaders can enhance the security of these systems to mitigate their risks.

## Warehouses: Peeking Under the Hood of Amazon

When people think of robots, they don't often think of warehouses and inventory turnover. Amazon is changing this. In 2014, Amazon began rolling out robots at work to automate and speed up processes in its warehouse facilities.

The company has more than [700 distribution facilities worldwide](http://www.mwpvl.com/html/amazon_com.html). At the height of last year's holiday season, Bisnow reports that some of Amazon's warehouses delivered [more than 1 million](https://www.bisnow.com/national/news/industrial/how-amazon-prepares-for-the-holiday-delivery-rush-81726) items per day.

![Amazon's RoboStow](https://images.ctfassets.net/23aumh6u8s0i/2IYft6NC5lAjSqy0JCkNQ8/8f702a74fe3b41e6ac4341f7789c191a/automated)

[Amazon's RoboStow](https://press.aboutamazon.com/images-videos)

RoboStow, one of Amazon's most powerful robots, weighs a whopping six tons and can move pallets of products over twenty feet high across a warehouse floor. This drastically reduces the physical labor and risk for Amazon's human employees. With its enormous capacity, RoboStow has helped Amazon store [50% more inventory](https://money.cnn.com/2016/10/06/technology/amazon-warehouse-robots/index.html) over the last five years and reduce the human labor portion of shipping to just [one minute](https://money.cnn.com/2016/10/06/technology/amazon-warehouse-robots/index.html) per package.

The results have also corresponded with a boost to Amazon's finances. According to a Slice Intelligence report, cited in The Wall Street Journal, in 2017 the company [retained 42 cents of every dollar spent online](https://www.wsj.com/articles/how-amazon-can-make-or-break-holiday-retail-1511265601), up from 38 cents in 2016. This highlights improvements in the company's ability to cut costs and overall operational efficiency.

Despite the hype around RoboStow, the machine isn’t 100% secure. While new robots may appear like they’re bulletproof, in reality they’re subject to many of the same flaws as other devices connected to the internet.

One [recent study](https://ioactive.com/robots-want-bitcoins-too/) by IOActive highlighted how their research team was able to steer several of Softbank’s robots meant for telecommunications to curse at people instead. They did this by injecting ransomware into the robot’s system through a public Wi-Fi network. Since many robots store valuable data (even if they’re simply transmitting it to a different endpoint), the team also revealed how hackers might access a robot’s software remotely, freeze it, and force the robot’s handlers to deliver something of value (e.g., money or other sensitive data) before unlocking it again.

In 2017 IOActive found nearly [50 vulnerabilities](https://ioactive.com/robots-want-bitcoins-too/) through which hackers could command popular commercial robots remotely. For Amazon and other companies that employ robots for physical labor in their warehouses, the dangers to human employees if a robot is hijacked or malfunctions could be severe.

While there is no single solution for fully securing machines like RoboStow, applying the same techniques used to [secure other mobile devices](https://auth0.com/blog/ten-mobile-security-threats-and-what-you-can-do-to-fight-back/), such as unique and complex passwords, employee education, and keeping systems updated goes a long way towards deterring dishonest users.

## Factory Robots Exposed via Routers

The epitome of monotonous (and often hazardous) labor — factory work is a popular target for workplace automation.

Today, Japan-based FANUC is leading the way with a factory that builds industrial robots for sectors as diverse as transportation and big pharma.

![Industrial Robots](https://images.ctfassets.net/23aumh6u8s0i/5u8tKWzuaPWA28wWLBfM1L/40a3a017f2895841b7f0ff1a1f632ac1/automated)

Source: [FANUC](https://www.fanuc.eu/fr/en/robots)

[Nearly 80%](https://www.bloomberg.com/news/features/2017-10-18/this-company-s-robots-are-making-everything-and-reshaping-the-world) of FANUC's assembly work is automated. [According to the company](https://www.bloomberg.com/news/features/2017-10-18/this-company-s-robots-are-making-everything-and-reshaping-the-world), human engineers complete only the wiring portion of the finished robots. That helps cut the costs of production dramatically and expands FANUC's margins.

Yet even this cutting-edge team isn't safe from cybercrime. Last year, researchers found that [over 80,000 industrial routers were exposed](https://www.darkreading.com/vulnerabilities---threats/researchers-hack-industrial-robot-/d/d-id/1328790) on the public internet, including those of FANUC. Industrial routers underlie remote networks and devices and support automation at many levels, yet despite their outsized importance, this research found that several of these devices didn't even require authentication.

[Authentication](https://auth0.com/docs/getting-started/overview) is critical to building a secure company foundation. Without it, organizations aren't able to verify the identities of its users —including employees, consultants, and customers. Without authentication, it's a cinch for a dishonest user to sneak in and steal company secrets.

At FANUC or another manufacturer with connected devices, a breach in one location could have widespread consequences across operations. As a company decision-maker, it's critical to constantly test for holes and patch and upgrade your systems to ensure that they're able to withstand increasingly numerous and complex threats.

## The Automated Workplace of McDonald's

Restaurants and food service have some of the more visible examples of automation. A robot barista Cafe X, for example, recently opened up shop in San Francisco.

![Robot Barista CafeX](https://images.ctfassets.net/23aumh6u8s0i/3VC1VT1WQ9iDbmtXwdTj4I/b20c9a7437703161633051e9b7b99ec5/automated)

[Image Source](https://www.youtube.com/watch?v=t4r6nAkav9o)

Robots have also been spotted [flipping burgers](https://www.usatoday.com/story/tech/talkingtech/2018/05/28/hamburger-making-robot-flippy-back-serving-300-burgers-day/649370002/) and [delivering meals](https://www.npr.org/sections/alltechconsidered/2017/03/23/520848983/hungry-call-your-neighborhood-delivery-robot).

On a large scale, McDonald’s has boosted workplace automation by installing thousands of ordering kiosks. The company is aiming to install kiosks in [_1,000 stores_](https://www.cnbc.com/2018/06/04/mcdonalds-to-add-self-order-kiosks-to-1000-stores-each-quarter.html) each quarter until its entire network is complete.

![McDonald's Ordering Kiosk](https://images.ctfassets.net/23aumh6u8s0i/1Ia8lLIiQuLScjPcHK4IIy/a0d5e23154170cbc02f03bf9a6f49276/automated)

[Source](https://www.businessinsider.com/mcdonalds-kiosk-vs-cashiers-photos-2018-3#the-beauty-of-the-kiosk-really-is-customization-making-your-order-the-way-you-want-it-on-here-is-much-easier-than-repeating-what-you-want-to-a-cashier-several-times-just-hit-the-customize-button-after-youve-chosen-the-item-you-want-and-go-from-there-9)

At the kiosk, customers can customize their meal — easily adding toppings and viewing nutritional information, such as calories. This reduces lag time in speaking with an employee at the cash register. McDonald's has also figured out how to present menu options on these digital screens in a more tantalizing format. They noted that customers spend an average of [_30%_](https://www.pymnts.com/restaurant-technology/2018/mcdonalds-kiosk-strategy/) more when using automated kiosks.

These kiosks certainly aren't immune to hacks. Last year, someone breached a McDonald's kiosk in Australia and removed [$4.70 from their order.](https://www.kioskmarketplace.com/articles/how-vulnerable-are-kiosks-to-hacking/) This might seem like a fun prank; however, the implications for customers and for the company's operations are more dire. If a hacker can access order histories, it’s likely they can also view customer names and credit card information.

Even in common products like ordering kiosks, being able to control users' navigation and access historical behaviors on the platforms are critical to figuring out where there might be holes.

## New machines, similar security problems.

Despite their allure, robots at work have many of the same vulnerabilities as other pieces of hardware — and workplace automation falls prey to holes in unsecured networks. In the worst case scenario with robots, cybercriminals could exploit weak points to control their movements and cause harm to human employees or a company's operations. At the other end of the spectrum, stealing a few dollars by breaching ordering kiosks still underscores larger risks of personal data theft.

An interconnected workplace —with systems that help ease time-consuming, costly, and low-value work —can be an enormous asset. Learning from leaders in the field is a great place to begin. Understanding where they've fallen short will help your organization go one step further and create an even stronger foundation on which to grow.

<include src="asides/AboutAuth0" />

---


Staying Safe in the Automated Workplace

Auth0 CISO Joan Pepin to speak Women Who Code Portland’s Networking Night + leadership advice video.



Want to know what it takes to be a successful woman in infosec?

Join us at [Women Who Code Portland’s Networking Night](https://www.meetup.com/Women-Who-Code-Portland/events/253324140/) on Thursday, Aug. 16 from 5 - 8:30 p.m. to hear what this group of notable women have to say about how they got into InfoSec, what their roles are like, and advice for someone breaking into the field. (Special thanks to sponsor [Mozilla](https://www.mozilla.org/en-US/).) The panel will include:

- **Joan Pepin** , Chief Information Security Officer (CISO) and VP Operations, Auth0
- **LJ Johnson** , Sr. Director, Information Security, Nike
- **Miki Demeter** , Security Researcher, Intel
- **Moderator:** Ann Wallace, Technical Cloud Consultant, Google

Recently, Joan expanded her Auth0 CISO role, adding VP of Operations to her title. As a preview, we asked her to offer some leadership advice for people stretching into new roles:

<AmpContent>
<amp-video controls
  layout="responsive"
  width="480" height="270">
  <source src="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4"
    type="video/webm" />
</amp-video>

</AmpContent>

<NonAmpContent>

<video controls="controls">
  <source src="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4">
   Your browser doesn't support HTML5 video. Here is a <a href="https://cdn.auth0.com/blog/videos/joan-pepin-leadership-advice.mp4">link to Joan Pepin Leadership video</a> instead.
</video>

</NonAmpContent>

<include src="TweetQuote" quoteText="Stretching into a new role? Here’s some advice from @CloudCISO_Joan — and an opp to hear her in person in Portland this week! #WWCode"/>



Auth0 CISO Joan Pepin to Speak at WWC Portland Networking Night

001c9ddc5ceb9829b6aaf24f5d28502a

I am software developer with a keen interest in open-source technologies, Linux, and native development. I've worked on many different platforms Android, iOS, Win32, Linux, FreeRTOS, the Web, and others. I've gone through the whole stack and I enjoy learning and using the latest technologies. I now work as a full-stack developer at Auth0.

Senior Engineer

Sebastian Peyrott

Embed Multi-Factor Authentication using push notifications, SMS, or TOTP anywhere, taking full control of the experience.



We are pleased to announce the availability of our [Multi-Factor Authentication API](https://auth0.com/docs/api-auth/tutorials/multifactor-resource-owner-password). Up to now, we have provided support for MFA through a simple switch in the Auth0 Dashboard, following our premise of *simplicity* and ease of use. However, we also believe in providing powerful *building blocks* for our users. For this reason we have developed a new API to perform the full MFA flow, even with multiple authenticators, in a flexible and convenient way. In this article we will take a look at the API and build a simple CLI app to demonstrate how to use it. Read on!

<include src="TweetQuote" quoteText="The MFA API is now available, learn how to embed MFA in your apps taking full control of the experience!"/>

> **Note**: for most MFA scenarios, we still recommend the use of [Universal Login](https://auth0.com/docs/hosted-pages/login) whenever possible. This new API is meant for advanced use cases where Universal Login is not flexible enough. [Universal Login is the best alternative](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) in most cases.

---

## Why?
Up to now, enabling MFA at Auth0 was simply a matter of flipping a switch and optionally selecting which application you wanted to enable MFA for. When MFA is enabled, hitting the `/authorize` endpoint or starting an authorization flow through one of our libraries was enough to trigger MFA. Simple, convenient.

![MFA Switch](https://images.ctfassets.net/23aumh6u8s0i/4Fk1xnLP6wm5Ay24YJLeex/c7047fc95a6712dfa7a92f5b7c5522e7/1-mfa-enable)

However, some of our customers have requested to have more control over the MFA process. For this reason, we have been working with [ATEA Norge](https://www.atea.no/) and other customers under a private BETA program to find the right implementation for this feature. The result: a new API for MFA to give back control to you when required. Let's check it out.

> **Note**: for most MFA scenarios, we still recommend the use of [Universal Login](https://auth0.com/docs/hosted-pages/login) whenever possible. This new API is meant for advanced use cases where Universal Login is not flexible enough. [Universal Login is the best alternative](https://auth0.com/blog/authentication-provider-best-practices-centralized-login/) in most cases.

## A Simple API
The API works by introducing some changes to how the `/token` endpoint behaves. Let's take a look.

<include src="TweetQuote" quoteText="The new MFA API is simple, it works on top of the existing /token endpoint."/>

The API works in four simple steps:

1. Access token request to `/token`.
2. Challenge request to `/challenge`.
3. Asking the user for a code (if necessary).
4. Final request to `/token`.

> This scenario assumes the user is already enrolled in MFA and has at least one authenticator enabled. There's also a [new API for enrollment](https://auth0.com/docs/multifactor-authentication/api/otp) to have full control over the enrollment process. This API also allows for obtaining a list of associated authenticators, useful for using multiple authenticator, as we will see in step 2 below.

### 1. Access Token Request to `/token`
When a request is made to the `/token` endpoint to get an access token, normally you either get an error, or you get an access token. However, when the MFA API is enabled, the `/token` endpoint may return a new error code: `mfa_required`.

```
POST /oauth/token HTTP/1.1
...

{
  "username": "...",
  "password": "...",
  "grant_type": "password"
  ...
}
```

Response:

```
HTTP/1.1 403 Forbidden
...

{
  "error": "mfa_required",
  "mfa_token": "..."
}
```

The `mfa_token` in the response value must be used in the following requests.

> MFA is also supported for the `refresh_token` [grant type](https://auth0.com/docs/applications/application-grant-types). This allows for use cases in which you want to require 2FA (TOTP, SMS, push notifications) when refreshing an access token, useful for extra security and step-up authentication.

### 2. Perform an MFA Challenge
When the `mfa_required` error is returned, the client must then perform a `challenge`. This is done by sending a request to the `/mfa/challenge` endpoint.

```
POST /mfa/challenge HTTP/1.1
...

{
  "mfa_token": "<from step 1>",
  "challenge_type": "otp oob",
  "authenticator_id": "optional, if known"
}
```

Response:

```
HTTP/1.1 200 OK
...

{
  "challenge_type": "oob",
  "binding_method": "prompt",
  "oob_code": "..."
}
```

The response tells the client which type of authenticator will be used (`challenge_type`) and also returns additional arguments relevant for that method. The `binding_method` parameter tells the client it should ask the user for a code.

The client may optionally request a specific authenticator through `authenticator_id`. This allows for multiple authenticators, even for the same resource.

> `OOB` means "out-of-band". All methods that are not [TOTP](https://auth0.com/blog/from-theory-to-practice-adding-two-factor-to-node-dot-js/) are OOB.

### 3. Prompt For Input (If Necessary)
If the `challenge_type` is `otp` or the `binding_method` parameter is set to `prompt`, the client should ask the user to input a code before continuing.

### 4. Get The Access Token
Finally, a new request to the `/token` endpoint is performed.

```
POST /oauth/token HTTP/1.1
...

{
  "mfa_token": "<from step 1>",
  "oob_code": "<from step 2, optional>",
  "binding_code": "<from step 3, if 'binding_method' === 'prompt'>",
  "otp": "<from step 3, if challenge_type === 'otp'>",
  "grant_type": "<one of two strings, see below>"
}
```

Grant type must be one of two values:
- For OTP: `http://auth0.com/oauth/grant-type/mfa-otp`
- For OOB: `http://auth0.com/oauth/grant-type/mfa-oob`

Response:

```
HTTP/1.1 200 OK
...

{
  "access_token": "...",
  "expires_in": "...",
  ...
}
```

Note that certain methods do not require the user to input anything (push notifications, for example). For those cases, this request must be performed repeatedly until an access token is returned or the authorization is denied. If the client is expected to repeat the request again in the future (after a certain amount of time) the response will be:

```
HTTP/1.1 400 Bad Request
...

{
  "error": "authorization_pending"
}
```

This means the user has not performed any actions yet and the client should wait a bit before trying again. The `error` can also be `slow_down` if the client is not waiting enough between requests.

That's it! If all went well, you now have an access token issued through MFA!

## Example: A CLI App with MFA
To give you a better understanding of how the API works we have developed a [simple CLI app that uses MFA](https://github.com/auth0-blog/oauth2-mfa-cli-example).

<video src="https://cdn.auth0.com/blog/oauth2-mfa-api/cli-demo-2.m4v" controls autoplay loop></video>

Take a look at the [full code in GitHub](https://github.com/auth0-blog/oauth2-mfa-cli-example). You will find the interesting bits in the `/token-endpoint.mjs` file, particularly in the `token` function.

To use the app, make sure that:
- You have created a new [Application](https://manage.auth0.com/#/applications) in the Auth0 Dashboard. Select the `Machine-to-Machine type`.
- The `token authentication method` is set to `none` in the Auth0 Application settings.
- You have enabled the `Password` and `MFA` grants in `Application -> Advanced Settings -> Grant Types`.
- You have MFA enabled. Go to [Multifactor Auth](https://manage.auth0.com/#/guardian) and enable SMS and push notifications for [Guardian](https://auth0.com/docs/multifactor-authentication/guardian/user-guide).
- You have set the right client ID (get this from the [application](https://manage.auth0.com/#/applications) settings area) in the MFA rule in the [Multifactor Auth](https://manage.auth0.com/#/guardian) section. Otherwise MFA will be enabled for all clients.

To use the app simply do:

```sh
git clone git@github.com:auth0-blog/oauth2-mfa-cli-example.git
cd oauth2-mfa-cli-example
npm install
node src/index.js login
```

The app supports some other commands. You can take a look at them by running it with no arguments.

## Other Use Cases
The sky is the limit! Here are some scenarios where using the new MFA API could make sense:

- Protect a VPN like OpenVPN (Pritnul) or Juniper with a second factor.
- Integrate with a PAM module to do second factor with SSH.
- Integrate with an LDAP service to provide a second factor.
- Step up authentication when refreshing an `access_token` (`refresh_token` grant).
- Trigger second factor from any backend process.

You are now free to build powerful MFA flows wherever you want!

## Conclusion
The MFA API brings flexibility to the use of MFA in your apps. One thing you may have noticed is that we are using the [OAuth 2.0 `/token` endpoint](https://tools.ietf.org/html/rfc6749#section-3.2). In fact, we designed this to be compatible with OAuth 2.0 right from the start. We have prepared two specification drafts, [one for MFA](https://github.com/jaredhanson/draft-oauth-mfa/blob/master/Draft-1.0.txt), [the other for authenticator association](https://github.com/jaredhanson/draft-oauth-mfa-assoc/blob/master/Draft-1.0.txt), to be sent to the [IETF OAuth 2.0 Working Group](https://tools.ietf.org/wg/oauth/). Other implementations of OAuth 2.0 can follow these specifications to implement MFA in a flexible, yet powerful way, while remaining compatible. We will have more information about this in an upcoming post.

We can't wait to see how you use this API to build powerful multi-factor flows! Let us know what you think in the comments.

<include src="TweetQuote" quoteText="We can't wait to see how you use this API to build powerful multi-factor flows!"/>


Introducing the Multi-Factor Authentication API

krti_XnE_400x400

At Auth0 we ❤️ developers. Serving & giving back to the community is one of the most rewarding things we do. We want to empower others to join the mission!

Auth0 Ambassador

ngVikings brought the European Angular communities to Espoo, Finland for two days of networking and learning.



A big part of being an [Auth0 Ambassador](https://auth0.com/ambassador-program) and Evangelist is attending and speaking at conferences all over the world. Our ambassadors attend a very diverse set of events ranging from technology-specific conferences, like [Oracle Code](https://developer.oracle.com/code), to technology agnostic conferences like [CodeMash](http://www.codemash.org/), and everything in between.

The **Conference Recap** series will summarize our experiences at the various conferences we attend, sharing the big news, things we learned, things we liked, and more. We’ll kick the series off with [ngVikings](https://ngvikings.org/).

<AmpContent>

[Watch "ngVikings 2018 &mdash; Highlights"](https://www.youtube.com/watch?v=-wVodWS-9OU)


</AmpContent>

<NonAmpContent>


<iframe width="560" height="315" src="https://www.youtube.com/embed/-wVodWS-9OU" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>


</NonAmpContent>

## ngVikings 2018

![ngVikings Venue](https://images.ctfassets.net/23aumh6u8s0i/39jPAKVqu8vOejBL7XQTh2/b36446505b50304cdbb11d97532c8903/ng-vikings-2018-stage)

Dubbed as the "main Angular event in the Nordics — and the only traveling Angular conference in the world", ngVikings was a unique two-day conference organized by a coalition of Angular and GDG Meetups from the Nordic countries of Norway, Sweden, Finland, and Denmark. This year, the traveling conference was scheduled to be in Helsinki but found itself in close-by Espoo, Finland and was held at [Aalto University](http://www.aalto.fi/en/).

The conference brought together over 300 developers and speakers from all over the world.

The keynote address was delivered by a core member of the Angular team [Matias Niemelä](https://twitter.com/yearofmoo/) and focused on his journey to Angular, how Angular has evolved over the last five years, and where it’s headed next. [Angular Elements](https://github.com/angular/angular/issues/20891) and the new ngIvy renderer seem really promising additions to the already excellent framework. Watch the keynote here:

<AmpContent>
<amp-youtube
    data-videoid="WahpV6zn8lQ"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/WahpV6zn8lQ" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

After the keynote, the conference was split into two tracks with each speaker giving a 30-minute presentation. The talks featured at ngVikings focused mainly on Angular 2+ showing best practices, sharing lessons learned, and focusing on the future of the framework. You can view all of the talks [here](https://www.youtube.com/watch?v=WahpV6zn8lQ&index=1&list=PLVI0Ut22uwY4UC1v5fUvi2RIU4R4jPkba), and while all of the talks were great and worth checking out, a few that really stood out for me where:

### Deploying Angular and Node to the Cloud

<AmpContent>
<amp-youtube
    data-videoid="XmpEZN5TCjw"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/XmpEZN5TCjw" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [John Papa](https://twitter.com/John_Papa)

> Your Angular app is complete! Now it's time to deploy it to the cloud. But how? One key ingredient is determining our goals. Do you want to publish directly from your laptop or through source control and CI/CD? Do you worry that it may work differently on your machine than the cloud? What about locking down versions of node, packages, and OS? Is your head about to explode? We'll explore several good options as we discuss the pros and cons of each including direct deployments, GitHub hooks with CI, and docker. We'll demonstrate how to code, debug, and run docker locally to have confidence that what works locally will work in the cloud. The good news is that tooling has improved to make all of these deployment options within your reach to guide you to successfully deploy your Angular app to the cloud.

### Advanced Angular DI

<AmpContent>
<amp-youtube
    data-videoid="PRRgo6F0cjs"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/PRRgo6F0cjs" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [Ward Bell](https://twitter.com/wardbell?lang=en)

> You Don’t Know DI? Go beyond Dependency Injection basics. Learn about the two parallel DI hierarchies and which one wins, what happens when you provide the same token twice … when multi is true, what’s the effect of lazy loading, what’s going on in forRoot and forFeature, what’s in a component’s injector, and how to talk to the components in content children when you don’t know their types. It’ll be fast, code-frontal, fun.

### 6 Apps One Codebase with Ionic

<AmpContent>
<amp-youtube
    data-videoid="4bGMXuPM_FI"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/4bGMXuPM_FI" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

by [Sani Yusuf](https://twitter.com/saniyusuf)

> You and your team have this great Idea and you have your users using different devices and operating systems to access the same application. Some users are on the Web, some on Mobile some of their Desktop and you also have to worry about what operating system they are on and also have to consider how your application is presented on each device & operating system. What if there was a way to code your app without worrying too much about operating systems/devices/screen sizes and just focusing on getting your idea across to your users regardless. Join me on a journey where I show you how to use Angular, Ionic & the PWA standard to build apps for IOS, Android, Windows, Web, Mac & PC with the same code all using just HTML5.

A big shout out to the organizers including [Maxim Salnikov](https://twitter.com/webmaxru), [Shahrzad (Sherry) Aziminia](https://twitter.com/sherrrylst), [Chris Noring](https://twitter.com/chris_noring), [Jussi Kinnula](https://twitter.com/jussikinnula), and the [rest of the team](https://2018.ngvikings.org/team/) for putting together such a great conference.

## Auth0 at ngVikings 2018

[Ado Kukic](https://ado.xyz), Developer Evangelist at Auth0, was the only Auth0 representative at ngVikings and gave a talk titled “A Token Walks Into a SPA…”, which focused on token-based authentication for single page applications and Angular in specific. You can watch the talk here:

<AmpContent>
<amp-youtube
    data-videoid="EoEOjQhSHNo"
    layout="responsive"
    width="480" height="270">
</amp-youtube>

</AmpContent>

<NonAmpContent>

<iframe width="560" height="315" src="https://www.youtube.com/embed/EoEOjQhSHNo" frameborder="0" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>

</NonAmpContent>

The talk covered topics ranging from why you should consider token-based authentication, how JSON Web Tokens actually work, SPA architectures and security considerations they bring with them, and finally how to incorporate token based authentication using various Angular specific features like HTTP Interceptors, Route Guards, and more.

## ngVikings 2019

I am very hopeful that ngVikings makes a return next year, and the official conference website implies it will. Check out the [official site](https://ngvikings.org/) for updates on where the traveling conference is sailing to next!

![Over 300 developers attended ngVikings](https://images.ctfassets.net/23aumh6u8s0i/5ysl15Y4PNwYquLgpU7r3E/0a5ed58058f87f7c08effe5b1057022a/attendees)

If you are interested in learning more about or joining the Auth0 Ambassador program, check out the [Ambassador page on our website](https://auth0.com/ambassador-program).

<include src="asides/AboutAuth0" />


Conference Recap: ngVikings 2018

Secure, social sign-on capabilities result in 25% increase in conversion rates.



**BELLEVUE, WA**—Auth0, the leading Identity-as-a-Service (IDaaS) platform, has helped [Giving Compass](https://givingcompass.org/about/?r=a0) stay secure while pursuing its mission. Giving Compass is a nonprofit organizing the world’s information to make it easier to give well.

Giving Compass is relying on Auth0’s robust authentication platform to create a secure and easily accessible platform for its growing network of philanthropists. 

With a leadership team that hailed from the tech world, it was important to Giving Compass that they put technology first to help further their mission for good. After a thorough evaluation of identity providers, Auth0 was selected for its ease of use, as well as the ability to provide social login for users while keeping member data completely secure. 

“Writing the code for authentication is always a nightmare, and it's the first potential door to a cyberattack,” said Luis Salazar, Co-Founder and Interim CEO, Giving Compass. “Peace of mind by having something that is proven and super easy to implement is the number one reason we chose Auth0. It just works.”

Auth0 was implemented in less than a week and provided Giving Compass with the solid technology foundation in which to grow its network. Thanks to the rapid integration, Giving Compass has saved more than 100 hours of identity-related development and testing (an estimated $25,000 thus far). It has also witnessed a 25% increase in conversions with social login functionality, resulting in 97 out of 100 people completing the signup process. 

For more details on how authentication helped propel Giving Compass and it’s mission, please read the full [case study here](https://auth0.com/learn/giving-compass-case-study/). 

[Join](https://givingcompass.org/join/?r=a0) Giving Compass as a secure user.

<include src="asides/AboutAuth0" />

## About Giving Compass

Headquartered in Seattle, WA, Giving Compass is a nonprofit organizing the world’s information to make it easier to give well. Giving Compass guides donors who want to give with intention and impact on a journey to learn, connect with others, and take action to drive meaningful change in communities and the world. Learn more at www.givingcompass.org.


Giving Compass Grows Philanthropic Network with Auth0

99c4080f412ccf46b9b564db7f482907?s=200 avatar

99c4080f412ccf46b9b564db7f482907?s=200

I'm currently a Senior Developer Advocate at MongoDB. I'm also a Google Developer Expert for Web Technologies and spend most my time giving talks at conferences and meetups, mentoring developers and running workshops, and creating online content to help technology professionals.

Former Auth0 Employee

Ado Kukic

Network, catch up on all the big announcements, and grab some swag at Rogue Ales Pub House. The happy hour hosted by Auth0, Algolia, and Keen IO is happening right after the talks end on May 24, 2017.



[Signal.2017](https://www.twilio.com/signal) is less than two weeks away and we can't wait to see what Twilio and the numerous vendors attending will have to show. The two-day conference kicks off May 24 and will be held at Pier 27 in San Francisco, California. After a long day of invigorating sessions including: [IFTTT: Building applications for the future](https://www.twilio.com/signal/schedule/7sIpsjOkTewgygqY86Sc0Y/ifttt-building-applications-for-the-future) by [Linden Tibbets](https://twitter.com/@ltibbets), [Congress on Speed Dial: Advocacy in the age of Twilio](https://www.twilio.com/signal/schedule/6LbXCBBhtYuKCSciyS8WA/congress-on-speed-dial) by [Ian Webster](https://twitter.com/@iwebst), and [What Can You Do With Twilio Voice?](https://www.twilio.com/signal/schedule/4r1gBAICZOAQGEAAascQSi/what-can-you-do-with-twilio-part-2) by [Manav Khurana](https://twitter.com/@manavkhurana), join Auth0, Algolia, and Keen IO as we host a special happy hour for Signal.2017 attendees.

![Signal Website](https://images.ctfassets.net/23aumh6u8s0i/10qrmp8n7s4gPXO0v98RNW/a1096d585fc0d8911d53703d80b15406/signal)

The happy hour will be a great opportunity to meet and network with fellow attendees, talk about all the new announcements, and get some swag. Food and drinks will be provided courtesy of Auth0, Algolia, and Keen IO.

**What**: Auth0, Algolia, and Keen IO Happy Hour

**Where**: Rogue Ales Public House, 673 Union Street, San Francisco, CA 94133

**When**: May 24, 2017 at 7:30pm - 9:30pm

**How**: [RSVP](https://www.eventbrite.com/e/rogue-ales-happy-hour-by-algolia-auth0-and-keen-io-tickets-34586663642) to reserve your spot as space is limited

We can't wait to see you there!

<include src="asides/AboutAuth0" />

### About Algolia

Algolia helps developers connect their users with what matters most. Our hosted search API powers billions of queries for thousands of websites & mobile applications every month, delivering relevant results in an as-you-type search experience in under 100ms anywhere in the world. Algolia's full-stack solution takes the pain out of building search; we maintain the infrastructure & the engine, and we provide extensive documentations to our dozens of up-to-date API clients and SDKs with all the latest search features, so you can focus on delighting your users.

For more information visit [https://www.algolia.com](https://www.algolia.com) or follow [@algolia](https://twitter.com/algolia) on Twitter.

### About Keen IO

Over 60,000 developers use Keen IO APIs to capture, analyze, and embed event data into their tools and products. Thousands of customers rely on Keen’s event data platform to white label data applications in media, e-commerce, adTech, gaming, IoT and retail. Keen’s customers query trillions of data points daily. Keen IO also values and promotes empathy, introspection, distributed innovation, continuous learning, playing to your strengths, and patching your weaknesses with diverse collaborators.

For more information visit [https://keen.io](https://keen.io) or follow [@keen_io](https://twitter.com/keen_io) on Twitter.


"network"