track: who are you

5 articles · newest first

Flat illustration of a person past a door marked with a checkmark, now stopped at an inner gate by a guard checking a list

Authorization vs authentication: logged in isn't the same as allowed

Lesson 5 of who are you: the app knows who you are. That's a different question from what you're allowed to touch. The gap between the two is where data leaks.

Sam Ortega · 51m ago · 4 min

Flat illustration of a person approving a request on a phone marked Google, which hands a small token card to a separate app

Build

What is 'Sign in with Google'? And why it's often safer

Lesson 4 of who are you: when you tap 'Sign in with Google', the app never sees your Google password. What OAuth hands over instead, and why it means one less thing to leak.

Sam Ortega · 51m ago · 4 min

Flat illustration of a person getting a glowing wristband at a door, then being waved through a second gate by flashing it

Build

Sessions and tokens: the wristband that keeps you logged in

Lesson 3 of who are you: you don't send your password with every tap. After login the server hands your device a token, and whoever holds it is treated as you.

Sam Ortega · 51m ago · 4 min

Flat illustration of a password going into a one-way funnel and coming out as a scrambled block, with a person unable to run it backwards

Build

Passwords and hashing: why a good app can't tell you your own password

Lesson 2 of who are you: a well-built app doesn't store your password, so it literally can't email it back. What a hash is, why salt matters, and the one red flag to watch for.

Sam Ortega · 51m ago · 4 min

Flat illustration of a person holding a key up to a friendly locked door with a small window, a checkmark glowing inside

Build

What is login, actually? How an app knows it's you

Lesson 1 of who are you: logging in doesn't prove you're you. It proves you hold something only you should have. What the app actually checks, and what it starts.

Sam Ortega · 51m ago · 4 min