Identity, trust and the plumbing of the web·on the home of the Yadis discovery protocol since 2005
Helvetesmaskin, 1600-tal - Skoklosters slott - 102579 / Unknown authorUnknown author, Public domain
§01 Identity & Access
When account holders lose the things that authenticate them, the path to recovery is a security control, not a support convenience. Brute-forcing it open is a known attack, and falsely enabling it makes this attack worryingly…
§01 Identity & Access
Online gaming is not only about games, fun, and bright graphics. It is also about trust. When people play with real…
§01 Identity & Access
An OpenID Connect ID token is not a user-identity data blob. It's a compact cryptographic artifact that only speaks to…
§01 Identity & Access
Designing OAuth scopes is a critical aspect of any modern application that relies on third-party integrations and user…
§01 Identity & Access
Device-bound passkeys are lost forever if the hardware storing them fails or is stolen. With a synced passkey, the…
Yadis 1.0 described how a URL can tell a service which identity protocols it speaks — the discovery step that OpenID, LID and i-names all needed. The working wiki of that effort still lives here, unedited.
Yadis 1.0, full text
HTML, as published
Yadis 1.0 (PDF)
the signed release document
What is Yadis
the short explanation
Conformance test
the 2006 test harness
§01 Identity & Access
Online gaming is not only about games, fun, and bright graphics. It is also about trust. When people play with real money, they share personal data…
§01 Identity & Access
An OpenID Connect ID token is not a user-identity data blob. It's a compact cryptographic artifact that only speaks to authentication when the…
§01 Identity & Access
Designing OAuth scopes is a critical aspect of any modern application that relies on third-party integrations and user permissions. Poorly designed…
§02 Web Standards
The Vary response header is the pivot point in HTTP content negotiation. Negotiated content can only be cached if the server explicitly directs…
§02 Web Standards
Web standards are the building blocks of the modern Internet, yet the path from a clever specification draft to widespread adoption is a complex…
§02 Web Standards
The process for modern web applications to discover each other and the services they offer on behalf of a user has evolved from specialized XRDS…
§03 Security & Privacy
Threat modeling is an essential exercise that security teams use to identify security flaws before an application is released. Draw this on a…
§03 Security & Privacy
It was late on a Friday. Odds rolled in fast. Bets queued up. Then, bets froze. Payouts stalled. Support lines lit. The root cause was not epic. A…
§03 Security & Privacy
Friday night. A big promo drops. Sign-ups jump. Deposits look clean. Support is quiet. By Monday, the bonus pool is gone, VIPs are upset, and a few…
§04 Dev & Infrastructure
Web caching slows down user experience under three conditions: – If previously caught content is cached, if the cache size exceeds the capacity of…
§04 Dev & Infrastructure
Ninety milliseconds can flip a match. A winger breaks free. The live price should swing. But your stream trails. Your odds API stalls at the worst…
§04 Dev & Infrastructure
We launched in five new markets in one week. The copy was fine. The code passed tests. Yet checkout tanked. Prices showed in USD for users in Paris…
§05 Gaming Tech
The line between valid gameplay and cheating is becoming increasingly hard to draw. Servers are now expected to police player actions, yet a strict…
§05 Gaming Tech
You tap Spin. The reels flash. Seven long seconds pass. Did the house nudge the odds, or did math and code pick the line? That doubt is normal. You…
§05 Gaming Tech
We were scared to soften the streak. A growth PM said churn would spike if users could miss a day and keep their run. We did it anyway. We added a…
§06 AI & Data
Here is a small story. A team shipped “smart offers” to help users save time. Clicks went up for two weeks. Then complaints grew. People felt…
§06 AI & Data
Every product team will use a third-party generated model at some point, whether you sell software, offer a content recommendation engine or focus on…
§06 AI & Data
We once took out a “hurry up” timer on a deposit page. It looked urgent, but the time did not matter. It pushed people to act fast. We also made the…