Account security
Authentication and authorization: identity and permission are different checks
Authentication establishes an identity or credential claim under a system's process.
Read the guideGuides & directories
Learn about networks, accounts and viewing — page 3
Use practical technical references to understand a connection, message or account decision.
82 guides · Page 3 of 4
Account security
Two passwords are not two independent authentication factors
Multi-factor authentication combines different kinds of evidence, such as knowledge of a secret and possession of an enrolled authenticator.
Read the guideAccount security
One-time codes authorize actions: keep the purpose with the number
A one-time code is part of a specific authorization or verification process.
Read the guideAccount security
Passkeys and device PINs: related protections, different roles
A passkey is an account authentication credential based on public-key cryptography.
Read the guideAccount security
Recovery codes: backup access needs private storage
A recovery code can provide an alternate way to regain access under a provider's authentication process.
Read the guideAccount security
A signed-in session and a registered device are different records
A session represents an authenticated interaction under a system's rules.
Read the guideAccount security
Bearer tokens: possession can be enough to use the access
A bearer token can grant access to whoever possesses it under the relevant system's rules.
Read the guideAccount security
A readable JWT payload is not proof that a token is valid or public
A JSON Web Token can carry claims in a compact format.
Read the guideAccount security
HTTPS protects a connection; verify the business claims separately
HTTPS protects an HTTP connection using TLS.
Read the guideAccount security
Certificate hostname checks: use the intended server name
A secure client checks the server's presented identity against the destination it intended to reach.
Read the guideAccount security
Certificate validity and device time: keep the clock accurate
Certificate validation uses time-related information, so a badly incorrect device clock can make a secure connection fail.
Read the guideAccount security
Checksums and digital signatures: integrity and source trust are different questions
A checksum can help compare a file with an expected value.
Read the guideAccount security
Password hashing and encryption are not the same storage mechanism
Hashing and encryption serve different purposes.
Read the guideAccount security
Encryption in transit and at rest protect different stages
Encryption in transit protects a communication path under its mechanism.
Read the guideAccount security
A local screen PIN and a service password protect different access
A local PIN can unlock a device or restrict a particular interface.
Read the guideAccount security
Least privilege in support: grant only the access the task needs
Least privilege means giving a person or system only the access needed for the authorized task.
Read the guideAccount security
Diagnostic logs can contain credentials even when the screen does not
A diagnostic log can contain more information than the visible error screen.
Read the guideHome networking
Network port numbers are not physical sockets or viewing allowances
A network port number helps identify a transport endpoint used by an application.
Read the guideHome networking
TLS server-name indication: why the hostname matters before HTTP
Server Name Indication, or SNI, lets a TLS client indicate the server name it intends to contact.
Read the guideHome networking
ALPN: choosing an application protocol during a secure connection
Application-Layer Protocol Negotiation, or ALPN, lets endpoints agree on an application protocol during a TLS handshake.
Read the guideHome networking
A DNS CNAME is an alias, not another subscription or channel
A DNS CNAME record identifies one domain name as an alias of another name.
Read the guideHome networking
A and AAAA records: one hostname can offer different address families
DNS A records provide IPv4 addresses, while AAAA records provide IPv6 addresses.
Read the guideHome networking
An IPv6 link-local address is not proof of internet access
An IPv6 link-local address serves communication on a local link.
Read the guideHome networking
IPv6 router advertisements: a route is not supplied the same way as every address
IPv6 router advertisements participate in discovering routers and relevant local-link configuration.
Read the guide