Engineering, security, and product updates
Deep dives into how we build a security-first identity provider. Post-quantum crypto, privacy engineering, and hard-won lessons from production.
Security posts
The Binance Verification-Code SMS That Uses a Real Binance Link
A user reported two SMS messages carrying a Binance verification code they never asked for, and a link on a genuinely authentic Binance domain. The link is real, the shortener is Binance's own, and the page at the end asks you for nothing at all. We decode the full chain and explain why the fake code is the cleverest part of the attack.
Zero Knowledge Is a Schema Decision
Calling a vault end-to-end encrypted is easy. Making it true is mostly about what columns exist. We walk through the Locker's derivation chain, why the server stores a wrapped key it cannot unwrap, why the authentication hash is a fast one on purpose, and the recovery design that follows from all of it.
Signed Requests, Signed Responses: Making OAuth FAPI-Shaped
Most OAuth deployments sign the token and leave everything around it unauthenticated. We moved access tokens to RS256, added private_key_jwt so clients authenticate with a key instead of a shared secret, and signed both the authorization request and the authorization response. Here is what each one actually stops.
Introducing Post-Quantum Session Signatures
Every session token issued by UniAuth is now signed with ML-DSA-44, a FIPS 204 post-quantum digital signature algorithm. We explain why we moved early, how the performance budget stays under 2ms, and what this means for your users when large-scale quantum computers arrive.
How Pairwise Privacy Protects Your Users
UniAuth never exposes real user IDs to OAuth clients. Instead, each app receives a deterministic, app-specific HMAC identifier that prevents cross-service correlation. We walk through the cryptographic construction, the privacy guarantees, and why even we cannot reverse the mapping without the HMAC key.
Stay in the loop
Get notified when we publish new posts about security, engineering, and product updates. No spam, unsubscribe any time.
We respect your privacy. Read our Privacy Policy.