@MojoAuth

Your reliable & simplified #passwordless solution provider. Prevent #credentialstuffing & password attacks. Give your users the best login experience

mojoauth.com/
Joined February 2021
  • Tweets1.1K
  • Following665
  • Followers275
366Media
⚙️ MojoAuth = 1 API for Email, SMS, WhatsApp & Authenticator OTPs. ⏱ Integrate in hours, not months. 🌍 Global delivery <3s. 👉 Build faster: mojoauth.com #OTP #Security #SaaS
1
3
206
The database was slow for one minute. Every failed login retried 5 times, no delay. One login became six requests, load hit 5x, and the database ran out of connections. The retries made it an outage. What should the client have done instead? #sre #backend
12
Monday's bug: every request fetched the signing keys. 5,000 req/s = 5,000 calls to your IdP. Fix: fetch once, cache, verify locally. Refetch only on an unknown kid, rate-limited. Key rotation still works. How often does your API fetch its keys? #oauth #jwt
1
1
2
41
The right answer is "almost never": once at startup, again when the cache ages out (every 10 minutes by default in jose), and once when a token shows up with a new kid. If yours says "every request", cache the key set. If it says "never", check that a new kid triggers a refetch
10
This middleware fetches your IdP's signing keys before it checks any token. Staging: 5 calls/s. Fine. Production: 5,000 calls/s to your IdP, a round trip on every request, and one IdP slowdown fails all auth. What would you change? #javascript #oauth
1
17
Every request makes a network call to your identity provider first: 5,000 key fetches a second, extra latency on every call, and if the provider slows down or rate-limits you, your whole API fails auth. The fix is today's post: cache the keys, refetch only on an unknown key ID.
5
Everyone logged in at 9:00 with a 1-hour token. At 10:00 they all refresh. At 11:00, again. Your login spike just became an hourly echo. Refresh at a random 75–90% of the token's life instead. Fixed time or random: which do yours do? #oauth #backend
13
Set-Cookie: sid=8f3a91c2 Sent over HTTP. Readable by any script. Carried on cross-site requests. Alive until the browser quits. A subdomain can plant a copy. Five words fix it: __Host- Secure HttpOnly SameSite=Lax Max-Age How many does yours have? #websecurity #webdev
1
19
One login, itemized: 504 ms against a 300 ms budget. Two lines on this receipt could happen after the response. Which two? #performance #backend
1
1
20
The audit log write and the welcome-back email. Queue both and respond first. The fraud score usually has to stay: it decides whether the login goes through.
4
10,000 users tap "Log in" at 9:00:00. What breaks first? A) CPU: password hashing B) DB connections C) SMS/email provider D) Rate limiter Reply with a letter and why. #backend #systemdesign
13
Monday, 9:00. Login p99 is 14.2s. Pods at 100% CPU. New pods need 3 min. Marketing just emailed 2M users. The load test? One user, 10,000 times. Six messages. Three minutes. All fixable on Friday. Which one would you have caught? #sre #incidentresponse #devops
21
50% CPU: a login waits about 2× its work time. 90% CPU: 10×. 99% CPU: 100×. Queues don't get slow slowly. They fall off a cliff. What CPU target do you scale at? #sre #performance #backend
19
"Login is slow, let's lower the bcrypt cost." That makes it faster for attackers too. The fix is more hashing capacity, not weaker hashes. Which would you pick: more cores, or a separate hashing pool? #security #appsec #backend
1
26
19 MiB per argon2id hash: OWASP's minimum. That's memory, not CPU. 1,000 logins hashing at once need about 18.6 GiB. Are your auth pods sized for that? #security #backend #capacityplanning
3
38
Size the hashing pool by both: cores for the CPU time, RAM for the memory. Cap concurrency so a pod can never exceed its limit; a queued login is a slow login, an OOM-killed pod is a failed one. Your peak will differ.
3
RAM in use = hashes in flight × memory per hash. 1,000 × 19 MiB = 19,000 MiB ≈ 18.6 GiB. Hashes in flight = logins per second × seconds per hash (Little's law). At 100 ms per hash, 1,000 in flight means 10,000 logins/s; at 500 ms per hash, 2,000/s.
5
Where the numbers come from: 19 MiB (m = 19456 KiB), t = 2, p = 1 is the minimum argon2id setting in the OWASP Password Storage Cheat Sheet. Memory-hard by design: the cost is RAM, not only CPU.
9
Password hashing is supposed to be slow. That's the point. 5,000 logins/s × 100 ms per hash = 500 cores, just to check passwords. Have you ever timed one hash on your production hardware? #security #backend
3
1
42
• Cores = logins per second × seconds per hash (Little's law). 5,000 × 0.1 = 500. • Memory = hashes in flight × memory per hash. 500 × 19 MiB ≈ 9.3 GiB. Your numbers will differ. The method won't. Tomorrow: why "lower the cost" is the wrong fix.
4
• 100 ms per hash is a scenario. On a current server core the same setting lands anywhere from tens of ms up; that's why the post says "measure yours".
3
Where the numbers come from: • 19 MiB, 2 iterations, parallelism 1 is the minimum argon2id setting in the OWASP Password Storage Cheat Sheet.
9
Load more