Authentication: Security Deep-Dive With Okta

Fernandez traces his path from early home computers such as the ZX81 to mainframe security systems. Mainframes relied on user IDs and passwords, a model that later carried over to personal computers. As software and services became more connected, that simple approach faced more complex security needs.

Fernandez distinguishes consumer, business, and internal employee authentication, and describes single sign-on as a way to sign in once across multiple applications. He also explains machine authentication, where a background service identifies itself to another service instead of acting as a user. Mobile apps can use social login, passwords, biometrics, and passkeys, balancing user convenience with protection.

Fernandez describes passkeys as passwordless credentials based on public and private keys, with the private key kept on the user's device. He says this helps protect against phishing and means a compromised backend database cannot be used to recreate passkeys. Discoverable credentials and device pairing can help users sign in across devices.

Fernandez recommends using an established authentication service unless authentication is the product being built, since standards and customer needs keep changing. He clarifies that OpenID Connect is for application authentication, while OAuth 2.0 is for API access and authorization. Auth0 was built with developers and B2C and B2B applications in mind, while Okta also serves enterprise workforce needs.

For consumer apps, Fernandez suggests considering passwords, passkeys, social authentication, and multi-factor authentication. Step-up authentication can add a security check for sensitive actions such as financial transactions. As an app grows into B2B use, enterprise federation and single sign-on can let employees access it through their company identity system.