Engineering, security, and product updates
Deep dives into how we build a security-first identity provider. Post-quantum crypto, privacy engineering, and hard-won lessons from production.
Latest posts
Your Browser Updated. Why Did That Sign You Out?
Sessions were being terminated as suspected theft when nothing had been stolen. The cause was a session fingerprint that included the browser's version number, so a routine auto-update looked identical to an attacker replaying a stolen cookie from a different machine. Here is why the check was wrong, and what replaced it.
An Identity Pass Anyone Can Verify Without Asking Us
Most digital ID schemes verify by calling the issuer, which means the issuer learns every place you present it. Identity Pass is an RS256-signed credential checked against a public JWKS instead, so verification is offline, the address is rotatable, every field has its own switch, and the subject is pairwise.
Zero Knowledge Is a Schema Decision
Calling a vault end-to-end encrypted is easy. Making it true is mostly about what columns exist. We walk through the Locker's derivation chain, why the server stores a wrapped key it cannot unwrap, why the authentication hash is a fast one on purpose, and the recovery design that follows from all of it.
Signed Requests, Signed Responses: Making OAuth FAPI-Shaped
Most OAuth deployments sign the token and leave everything around it unauthenticated. We moved access tokens to RS256, added private_key_jwt so clients authenticate with a key instead of a shared secret, and signed both the authorization request and the authorization response. Here is what each one actually stops.
Push Approvals Without a Push Vendor
Push-based two-factor usually means handing a third party a channel into your users' devices. Web Push with VAPID does not require that. We built approve-or-deny as a second factor on the open standard, and the hard parts turned out to be the approval screen and the polling endpoint, not the cryptography.
What Your Account Can Tell You About Itself
Your account holds a record of every sign-in, every consent, every claim handed to every connected app, and every security decision made on your behalf. Most of it is invisible in most products. Here is a tour of where each of those lives, what the entries mean, and which ones are worth acting on.
Introducing Post-Quantum Session Signatures
Every session token issued by UniAuth is now signed with ML-DSA-44, a FIPS 204 post-quantum digital signature algorithm. We explain why we moved early, how the performance budget stays under 2ms, and what this means for your users when large-scale quantum computers arrive.
Why We Made 2FA Mandatory for Social Sign-In
Social OAuth providers verify email ownership, but they cannot tell us about device compromise or credential stuffing upstream. Starting this month, every social-linked account is prompted for a second factor within 24 hours of first login. Here is the data that drove the decision.
How Pairwise Privacy Protects Your Users
UniAuth never exposes real user IDs to OAuth clients. Instead, each app receives a deterministic, app-specific HMAC identifier that prevents cross-service correlation. We walk through the cryptographic construction, the privacy guarantees, and why even we cannot reverse the mapping without the HMAC key.
Building a DNS-Rebinding-Safe HTTP Client
Webhook delivery and SCIM provisioning both require outbound HTTP requests to user-supplied URLs. We built an SSRF-resistant HTTP client that validates resolved IPs after DNS lookup but before connection. This post covers the pitfalls of naive URL parsing and the dual-stack IPv4/IPv6 edge cases we caught.
SCIM 2.0 Multi-Tenant Isolation: Design Decisions
When multiple organizations share a UniAuth deployment, their SCIM group memberships must be strictly isolated. We discuss the schema design that gives each tenant its own namespace, the bearer-token-per-client auth model, and how bulk operations respect tenant boundaries without sacrificing throughput.
Stay in the loop
Get notified when we publish new posts about security, engineering, and product updates. No spam, unsubscribe any time.
We respect your privacy. Read our Privacy Policy.