People and machines

Thursday opens with a login. The auditors ask Finn to sign in to the internal dashboards while they watch, and the striking thing is what Finn does not type: a password for that dashboard.

The browser bounces to Traversal’s central identity provider, already satisfied about who Finn is, and bounces back with a yes. Authenticate once, and every internal app trusts the vouching. The pattern is single sign-onConcept · lights on your mapsingle sign-onSSO: authenticate once with a central identity provider, and every company application trusts its vouching. OAuth’s delegation at enterprise scale: one front door, one place to enforce strong login, one switch that cuts all access the day someone leaves., and its quiet superpower is the leaving part. Yesterday’s finding, two contractors with ghost access, has a one-switch fix precisely where SSO is the only front door.

The front door itself asks for two things. Finn’s password, then a tap on Finn’s phone, and the second ask is multi-factor authenticationConcept · lights on your mapmulti-factor authenticationMFA: requiring a second kind of proof beyond the password, something you have, a phone prompt or hardware key, on top of something you know. The highest-value security upgrade in common use: a stolen password alone stops working.. A password can be phished from anywhere on earth. The phone has to be in the room.

How the yes is remembered

One login should not mean typing all this per click, so systems remember the yes, two different ways. session mechanicsConcept · lights on your mapsession mechanicsThe server keeps the memory, ticket 8k2f means Finn, and the browser’s cookie carries only the ticket. Revocation is instant, tear up the ticket and access ends, at the cost that every check consults server state. is the coat-check model. Its counterpart is token mechanicsConcept · lights on your maptoken mechanicsThe credential itself carries signed claims, Finn, engineer, expires at three, so any service verifies it locally with no lookup. Perfect for stateless middles, and the bill is that revoking one before it expires takes extra machinery., the passport model, and you met its bearer forms in Act I as the token riding every API call. Ticket or passport, memory or mathematics: instant revocation against lookup-free checking, and Traversal, like most shops, runs both.

Then the auditors point at the timing ingest and ask their best question of the day. Who logs that in? Nobody does. The ingest authenticates as a service accountConcept · lights on your mapservice accountAn identity for software: the deploy pipeline, the nightly backup job, the ingest service. It gets credentials from the secrets manager, a role, and least privilege exactly like a human, and deserves more scrutiny, since no human notices a machine identity quietly misused at 4 a.m., an identity with credentials and a role and no heartbeat, and its whole life is governed by the same question as the volunteer’s. Who may do what, and no more.

The machines’ walls get read too. The auditors pull the firewall’s rules and go down them line by line, and the line that satisfies them is race week’s oldest: the internet directly to the registrations database, never, from anywhere, under any flag.

People and machines, sorted. After lunch the auditors follow the data itself, and a padlock this story has carried since Act I finally comes open.