--- title: "Field Guide" canonical_url: https://www.janbrennenstuhl.eu/knowledge-base/ author: Jan Brennenstuhl --- # Field Guide Short reference entries on identity, authentication and account security. Each one answers a question with a claim, shows the evidence behind it and states its review status. I keep this field guide for engineers and product people who need an answer they can cite. Every entry starts with a short answer, lists key findings with their sources and summarizes the studies behind them. Each entry shows its review status, and its change log records every substantive update. ## Entries - [How does authorization work for MCP servers?](https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/) (2026-10-13, guide): In MCP revision 2026-07-28, a protected MCP server over HTTP is an OAuth 2.1 resource server that accepts only tokens issued for itself. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/mcp-authorization/index.md - [How should people grant and revoke an agent's access?](https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/) (2026-10-13, guide): People should grant an agent access per service with chosen permissions and an expiry, and be able to revoke that grant at any time. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/consent-and-revocation/index.md - [How does OAuth 2.0 Token Exchange keep provider tokens away from agents?](https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/) (2026-10-13, guide): OAuth 2.0 Token Exchange (RFC 8693) lets a gateway trade an agent's token for a provider token, so the provider token never has to reach the agent. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/token-exchange/index.md - [What is inside a JWT?](https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/) (2026-10-13, guide): A signed JWT's claims are readable by anyone who holds it; trust comes only from verifying the signature with an allowed algorithm and a trusted key. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/oidc/jwt-anatomy/index.md - [What should a password policy require?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/) (2026-10-13, guide): NIST SP 800-63B-4 sets a 15-character minimum for single-factor passwords, forbids composition rules and periodic changes, and requires blocklist checks and support for password managers. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-policy-requirements/index.md - [Should an agent use a robot account or delegated access?](https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/) (2026-10-13, guide): An agent that acts for a person should use delegated access that names both the person and the agent. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/agent-identity/delegation-vs-robot-accounts/index.md - [Where do OpenID Connect implementations break?](https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/) (2023-05-15, guide): Testing 6 certified OpenID providers and 8 relying parties against 18 known attacks uncovered 12 implementation flaws. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/oidc/openid-connect-security/index.md - [Do password strength meters work?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/) (2023-05-03, guide): Password strength meters produce stronger passwords when users change passwords on important accounts, but make no observable difference on unimportant ones. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-strength-meter/index.md - [Do login challenges and risk scoring stop account takeover?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/) (2023-04-27, guide): Device-based login challenges block far more account takeover attempts than knowledge-based ones. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/reinforced-authentication/index.md - [How common is password reuse?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/) (2023-04-27, guide): Somewhere between 43% and 51% of users reuse the same password across multiple sites. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/password-reuse/index.md - [How do you protect accounts from stolen credentials?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/) (2023-04-21, guide): Checking credentials against breach data and adding device and location risk signals to the login decision reduce the risk from stolen passwords. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/index.md - [How secure are email-based password resets?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/) (2023-04-21, guide): 72% of the website account recovery mechanisms studied had at least one implementation weakness. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-recovery/index.md - [How do attackers take over accounts?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/) (2023-04-21, guide): At least 35 of 75 popular online services studied were vulnerable to account pre-hijacking attacks. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/index.md