IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
The big picture
Maya started this track with one password on a dozen sites. Now that password is gone. What replaced it is safer and easier. Here is the whole story before the quiz.
The story you just lived
First we removed the password. In passkeys & WebAuthn, Maya swapped the shared secret for a key pair. The private key is never sent to a site, so there is nothing to phish.
A device can be lost. MFA enrollment & factors added a second factor. Safe account recovery then built the way back in. Then adaptive risk-based MFA challenged only strange sign-ins. For a risky action, step-up & assurance asked for fresh proof.
Attackers hit the login with stolen passwords. Bot detection & CAPTCHA made that costly. Breached-password detection refused leaked passwords. For business customers, enterprise SSO & home-realm discovery sent each user to their own company login.
Then the story moved past login. Sessions, cookies & sign-out showed three sessions on three clocks. Native-to-web SSO carried a sign-in from an app to a web page. Magic links & email OTP traded the password for the inbox. Identity verification proved the real person.
The threads that tie it together
Remove the shared secret
Passkeys remove it. Leak checks block stolen ones. Magic links still carry a risk, because they lean on an emailed secret.
Friction only when earned
Add MFA only when needed. Adaptive MFA challenges odd logins. Step-up asks before risky actions. Bot detection shows a CAPTCHA only for robotic traffic.
The API is the real gate
The client only asks for a factor. The server must check it, as an API gate. Sessions live or die on the server, not in the cookie.
One sign-in, many places
Enterprise SSO reaches the customer's IdP. Native-to-web SSO links app and browser. Single logout does the same job in reverse.
You now know why a passkey cannot be phished. You know when to challenge and when to stay out of the way.
Where these ideas go next
Token Security shows what every sign-in hands out and how APIs check it. To see the attacks these defenses answer, read adversary-in-the-middle phishing. To harden recovery, read account recovery. To teach users to spot fake messages, share Spotting phishing and fake logins.
Ready to prove it stuck? The cheat sheet & pop quiz is next.