Reference
Field Guide
Short reference entries on identity, authentication and account security. Each one answers a question with a claim, shows the evidence behind it and states its review status.
I keep this field guide for engineers and product people who need an answer they can cite. Every entry starts with a short answer, lists key findings with their sources and summarizes the studies behind them. Each entry shows its review status, and its change log records every substantive update.
Agent identity
How AI agents get scoped, revocable access to tools and services when they act on behalf of people.
- Should an agent use a robot account or delegated access?
When an agent acts for a person, give it delegated access that names both the person and the agent, with narrow scopes, an expiry, and a way to revoke it. A robot account shared by several people gives the agent their …
- How does OAuth 2.0 Token Exchange keep provider tokens away from agents?
OAuth 2.0 Token Exchange (RFC 8693) lets a client trade one token for another token meant for a specific target service. When a gateway runs that exchange on each tool call, as in the Agentic Identity Broker, the …
- How should people grant and revoke an agent's access?
Let people grant each agent access per service, with a permission set they choose and an expiry, and let them revoke that grant at any time. Revoking the grant has to stop every token derived from it, so keep issued …
- How does authorization work for MCP servers?
In the MCP authorization specification (revision 2026-07-28), a protected MCP server over HTTP is an OAuth 2.1 resource server: it publishes Protected Resource Metadata that points clients to its authorization server and …
Account security
What research says about password reuse, stolen credentials, strength meters, account recovery and account takeover.
- What should a password policy require?
Under NIST SP 800-63B-4, a password used on its own must have at least 15 characters, or 8 when it is one factor of multi-factor authentication, and systems should accept at least 64. Composition rules, forced periodic …
- How do attackers take over accounts?
Some attackers prepare an account before the victim even signs up: at least 35 of 75 popular services studied were vulnerable to such pre-hijacking. Others are paid to break into a specific account and mostly use …
- How secure are email-based password resets?
In a 2021 study of 366 websites from the Alexa Top 5K, 72% of account recovery mechanisms had at least one implementation weakness. Common gaps were multiple valid reset tokens, missing change notifications and …
- How do you protect accounts from stolen credentials?
Check usernames and passwords against breach data with a privacy-preserving protocol, and add risk signals such as known devices and locations to the login decision. Breached credentials show up in about 1.5% of logins …
- How common is password reuse?
Password reuse is very common. One study estimates that 43-51% of users reuse the same password across sites, and an in situ study found exact or partial reuse in about 60% of unique passwords. An attacker who holds a …
- Do password strength meters work?
Meters work under the right conditions. In one study they produced stronger passwords when people changed passwords on important accounts, and made no observable difference for an unimportant one. Many deployed meters …
- Do login challenges and risk scoring stop account takeover?
They are an important barrier if you pick the right challenge: device-based challenges blocked over 94% of phishing-rooted hijacking attempts at Google, while knowledge-based challenges stopped as few as 10%. The cost is …
OpenID Connect
Security research on OpenID Connect clients and providers, and the checks that prevent the documented attacks.
- What is inside a JWT?
A signed JWT is 3 base64url-encoded parts joined by dots: a header that names the algorithm, a payload of claims, and a signature over both. The payload is encoded, not encrypted, so anyone holding the token can read it; …
- Where do OpenID Connect implementations break?
Implementations break mostly where tokens and redirects get checked. Documented attacks on relying parties include token substitution, key confusion and replay, and attacks on providers include redirect URI manipulation, …
Track revisions: changes (RSS) JSON Feed all findings (JSON) Glossary