The big picture

In this track, the people who sign in are your customers. There are millions, and you cannot remove them. One idea runs through everything: friction against trust. Ask for too much and you lose the customer. Ask for too little and you lose trust.

The story you just lived

Maya starts as a stranger at your signup form (signup). The form is a door with one short line and one honest check that her email or phone is hers.

Then she forgets her password (recovery). Attackers love this side door, so the way back in must be as strong as the way in.

Next she taps "continue with your social account" (social login). Same email does not mean same person. Account linking is safe only with a verified email and fresh proof of the old account.

You learn who she is little by little, with progressive profiling and honest consent. Each yes is as easy to withdraw as to give.

Her account is worth stealing, so you build layers against account takeover. A passkey ends credential stuffing for that account. Then you move the whole customer base with lazy migration so nobody notices (user migration).

Sam's company buys your product for forty people. So you build B2B identity: organizations, invites, org-scoped roles and tenants with their own SSO. Numbers change and phones get lost, so you plan the whole life of the account (new number, new phone, leaving). Last, in wallets & verifiable credentials, Maya carries signed proofs (verifiable credentials). She shows each service only what it needs. That is selective disclosure.

Two views of the same product

You are a customer of many apps. Read each lesson from both sides.

Where these ideas go next

Takeover defense gets smarter with risk-based, adaptive challenges. The recovery side door meets its nastiest attacker in SIM swap. Keeping one customer's world apart from another's is the job of multi-tenancy.

Ready to test yourself? The cheat sheet & pop quiz is one page on.