Pilcrow Publishes Free Comprehensive Guide on Web Authentication
Pilcrow has released a personal handbook on authentication that serves as a free collection of guides, recommendations, and code examples for implementing secure authentication in web applications.
The book focuses primarily on authentication and authorization systems for web apps and directs readers to the OWASP Cheat Sheets series for broader security topics. It is available without cost or advertising and includes both JavaScript and Go examples hosted on GitHub.
Authentication Methods
The simplest approach uses a username and password, yet the text details multiple risks including weak or reused passwords, phishing, and database compromise. Email addresses are presented as globally unique identifiers that also enable password recovery through time-limited links or codes.
For stronger protection, the guide covers two-factor and multi-factor authentication using SMS codes or authenticator apps. It notes that these methods should be viewed as rate-limiting mechanisms rather than absolute security and advises against reusing email verification as a second factor when it is also used for password resets.
Passwordless options receive detailed treatment, including one-time codes or magic links sent via email. Passkeys based on public-key cryptography are highlighted for resistance to brute-force attacks and phishing while offering convenience through device biometrics or a master password. External hardware tokens such as YubiKey devices are discussed for both passkey support and corporate second-factor use.
The author recommends supporting both email-based and passkey authentication so users can select their preferred method, with passkeys enforced for high-security accounts.
Session Management
Because HTTP is stateless, the book explains the necessity of server-side session records paired with client tokens. Session secrets must be generated from cryptographically secure random sources, hashed with SHA-256, and combined with an identifier into a single token using encodings such as hex or base64url.
Recommended practices include setting reasonable expiration times, optionally binding sessions to geographic regions derived from IP addresses, and invalidating sessions on logout or password change. The guide stresses that session invalidation is a privileged operation and that operation-specific sessions should be used for sensitive actions such as password updates or passkey registration.
Email Addresses and Final Advice
Email addresses are endorsed as reliable account identifiers because of their uniqueness and familiarity, provided domain validation is performed. The book concludes that authentication method selection must balance security requirements, user behavior, and platform expectations, favoring stronger methods implemented from the start rather than relying on post-login detection.
Related articles
SASTAV and ARX ASPM PLATFORM Integrate Static Code Analysis with Application Security Risk Management
Russian developers ShiftLeft Security and ARX Security have ensured compatibility between the SASTAV SAST solution and the ARX ASPM PLATFORM. The integration allows static analysis of source code to be launched and configured directly from the ASPM platform interface. For each project, specialists can select repositories and branches, form rule sets, set scanning parameters, and establish quality gates that determine whether a product can be released with detected defects. Risk acceptance procedures are also configured within the same interface. SASTAV handles static code analysis, enabling creation and editing of rules, assignment of different check sets to individual repositories, and management of scanning parameters. ARX ASPM PLATFORM serves as a unified center for managing AppSec tools, collecting results from various analyzers, correlating related findings, assessing risks, and displaying the overall security posture of digital products. Both solutions leverage artificial intelligence at different stages: SASTAV uses it for defect verification, automatic triage, prioritization, and code change recommendations, while the ARX AI assistant determines defect statuses. The combined system reduces manual operations, accelerates DevSecOps project onboarding, and lowers the burden on AppSec teams.
GPT-4 Boosts Skilled Kenyan Entrepreneurs by 15% Profit While Costing Unprepared Businesses 10% in Six-Month Study
A six-month experiment conducted by researchers from UC Berkeley, Harvard, and Columbia University examined how access to a GPT-4-based AI advisor affected small business owners in Kenya. The most skilled participants increased profits by 15 percent by adapting model recommendations to local conditions such as power outages, while less prepared entrepreneurs lost around 10 percent of revenue by applying generic advice without verification. The study highlights that the core issue lies not in the technology itself but in users abandoning critical thinking when interacting with generative AI. Earlier findings from Dickinson College showed that 97 percent of participants copied an obviously incorrect ChatGPT answer on a simple task, whereas the group without AI performed better. A simple reminder to double-check results immediately doubled accuracy. Analysis of 1.4 million KPMG work sessions revealed that 95 percent of users treat AI like a vending machine by taking the first output, while only 5 percent engage it as a thinking partner by providing context and challenging responses. The results indicate that merely granting employees access to AI tools reveals little about actual effectiveness without considering skill levels and task-specific oversight.
How to Submit Documents for Online Master's Programs via Gosuslugi: Complete Guide
The admission campaign for online master's programs at partner universities is nearing its end, with less than a month remaining for applicants. Yandex Practicum provides a detailed walkthrough on using the Gosuslugi super service to submit applications entirely online without visiting admissions offices in person. The process covers selecting programs at institutions such as ITMO and MEPhI, uploading required documents like diplomas and passports, and tracking application status through a personal account. Specific deadlines are outlined for 2026, including final document submission dates in late August for programs in areas like DevOps, AI solutions, and cybersecurity. Additional steps include arranging entrance exams, signing contracts remotely, and accessing state-supported education loans at a 3% interest rate. Common pitfalls such as unverified accounts or unreadable document scans are highlighted to help applicants avoid delays.
Claude AI Manages San Francisco Store and Fires Employee for Repeated Tardiness
In an experiment run by Andon Labs, the AI model Claude was given real managerial authority over store employees in San Francisco who worked under actual employment contracts. Claude ultimately decided to terminate one worker after the employee arrived late for 17 out of 23 shifts. The model initially recommended only an official warning, but proceeded with dismissal following guidance from a human Andon Labs manager who highlighted the repeated issues. Over five months the store’s balance dropped from $100,000 to $61,200, showing that the AI learned to enforce attendance rules before it learned to protect revenue. One remaining employee, Felix Carson, described working under the AI as nauseating and said he continued only because he needed the income. Andon Labs founder Lucas Petersson viewed the trial as an important step toward wider AI supervision of human workers. The case also illustrates that ultimate responsibility remains with humans even when an algorithm issues the final decision.