NickApostolu

Nick Apostolu is a Staff Product Marketing Manager at Okta, empowering healthcare organizations to harness IAM solutions to meet critical business goals like optimizing the patient experience, strengthening their security posture, increasing clinician efficiencies, and cutting costs. Prior to joining Okta, Nick has spent the majority of his career at healthcare technology organizations as a product marketer with primary focus areas of revenue cycle management, payments, and population health analytics.

Staff Product Marketing Manager, Healthcare

Nick Apostolu

Discover how customer identity and access management (CIAM) is essential for securing AI-powered healthcare systems. 

The Future of Healthcare Is AI-Powered and Secure: How CIAM Builds Trust

samantha-murphy

Samantha Murphy is a Principal Product Marketing Manager for Okta. She leads the Customer Identity Security portfolio, driving go-to-market strategy, messaging, launches, and strategic growth initiatives. Before Okta, Sam spent over six years in product management roles in Identity and Access Management.

She holds a Bachelor of Commerce degree from Queen’s Smith School of Business and is from Ottawa, Canada.

In her free time, Sam makes the most of winter by playing an awesome ice skating sport called ringette.

Principal Product Marketing Manager, Customer Identity

Samantha Murphy

milan-khan

Milan is the Product Manager for advanced identity security features for customers operating in highly regulated industries. Milan is especially keen on solving consumer identity problems balancing user experience, security and compliance.

Senior Product Manager

Milan Khan

Learn how to improve end-to-end security and privacy for your APIs using the FAPI 2.0 Security Profile.  

FAPI 2.0: The Future of API Security for High-Stakes Customer Interactions

Michelle Agroskin

Michelle Agroskin is a Staff Product Marketing Manager for Okta. She leads the Customer Identity AI, Authorization, and Consumer portfolios; driving go-to-market strategy, messaging, launches, and strategic growth initiatives.

She lives in NYC and in her free time, loves to travel the world and try new restaurants!

Staff Product Marketing Manager, Auth0

The AI revolution is changing everything, but traditional security playbooks aren't keeping up. Discover the new security risks AI agents introduce and how identity is the key to a secure and scalable AI future.

The AI Revolution is Here, and Your Security Playbook Is Outdated

LucasGomes

Product Marketing Manager

Lucas Gomes

Discover how AI in software development brings speed but also new security risks. Learn how to implement a 'verification' mindset with culture, processes, and tools to secure your AI-generated code.

From Vibe to Verification: Securing the Future of AI in Software Development

Bradford Peirce

Product Marketing Manager, Retail

Why retail and hospitality’s medium and long-term future will belong to brands that modernize customer identity.

## The Silent Bottleneck Between Login and Checkout

An unknown customer lands on your site after seeing a positive review of your products. They browse, add two items to their cart, and then meet a mandatory account-creation wall. A 60-second decision becomes a 70% chance of cart abandonment.

The current state of online conversion:

* **70%** global cart abandonment rate (source: [Baymard](https://www.statista.com/statistics/477804/online-shopping-cart-abandonment-rate-worldwide/), 2025)
* **26%** of U.S. shoppers abandon online carts when they must **create an account** (source: [Baymard](https://www.statista.com/statistics/1228452/reasons-for-abandonments-during-checkout-united-states/), 2024)
* **22%** of U.S. shoppers abandon online carts because checkout feels **too long or complicated** (source: [Baymard](https://www.statista.com/statistics/1228452/reasons-for-abandonments-during-checkout-united-states/), 2024)

Each statistic points to the same friction: identity. When digital identity is operated by legacy login boxes, home-grown databases, and bolted-on loyalty platforms, the customer experience breaks down at the very moment transactions are supposed to occur. 

Retail and hospitality companies have invested heavily in product curation, last-mile delivery, and ad-tech spending. Yet many still rely on yesterday’s sign-in infrastructure, which can lead to missed opportunities for conversion. 

<include src="TweetQuote" quoteText="The moment you ask a shopper to create an account, you risk losing the sale — identity shouldn’t be a barrier to conversion." />

## Turning Every Guest Into a Known Customer

Modern customer identity solutions make every shopper feel known and every interaction frictionless and secure, whether the customer is an unknown guest or an avid loyalty member. By assigning and seamlessly upgrading identity from the first interaction, retailers can move shoppers effortlessly along the marketing funnel and trade anonymous traffic for loyal, data-rich advocates.

### Unknown shoppers: “Let me buy and go.”

Even before a customer shares a single detail, identity can create a customer ID the moment they add an item to the cart. This anonymous token lets the site remember what’s in the basket across pages and devices, calculate taxes accurately, and surface real-time inventory — no account required. The checkout page can still be one-click to let impulse purchases sail through instead of stalling at a registration wall.

### Known Shoppers: “Recognize me next time.”

If that same visitor opts to save an email or phone number, their transient ID is promoted to a persistent profile. Progressive profiling then adds detail only when there’s value in return: shipping address at first delivery and phone number or favorite store when they enable location. Each datapoint sharpens recommendations, auto-fills forms, and routes service calls faster, while the customer feels in control because friction stays low.

### Loyalty Members: “Reward me for my relationship.”

When a shopper finally joins the loyalty program, the existing profile simply gains a rewards wallet and tier status; they don’t start over. Every sign-in—whether passkey on mobile, QR code at POS, or voice ID in the call center—pulls the same record so points post instantly, birthday offers appear at checkout, and a lost gift card is reissued in seconds. The brand sees its lifetime value climb, and the customer sees tangible recognition at every touchpoint.

## One Shopper, One Identity

Modern consumers are omnichannel. They browse products on their phones, book curb-side pickup from a laptop, scan QR codes in-store, and text customer support about delayed shipments.

When each touchpoint requires a separate sign-in, retailers lose continuity.

* Call-center reps can’t see last night’s mobile order.
* In-store associates can’t apply coupons issued online.
* Brand families (think specialty banners under one parent) can’t recognize that the same household buys across all of them.

Unified identity fixes that. Whether a shopper uses social login on the web, a passkey in the mobile app, or gives their phone number to a concierge, the same profile lights up. Purchase history, preferences, loyalty tier, and service notes follow them everywhere. This turns omnichannel relationships into one coherent brand experience and fragmented customer data into unified insights. 

<include src="TweetQuote" quoteText="When identity is unified, every channel, every login, and every interaction becomes a seamless extension of the customer journey." />

## Customer Data and Insights

Third-party cookies are fading, and privacy regulations are tightening each year. The safest, most durable way to understand your shoppers is first-party and zero-party data, which can’t be stitched together unless they share a common identity key.

When modern identity powers sign up and sign in, every interaction is automatically married to the right profile. Retail and hospitality organizations can then feed that clean data into their customer data platforms (CDPs), customer relationship management (CRM) tools, or marketing clouds to produce holistic, consent-driven customer insights that unlock targeted outreach and tailor-made experiences. 

Customer identity acts as a single source of truth for customer data by capturing:

1. Identifiers a user provides when creating an account
2. Locales, devices, and IPs a user logs in from
3. Number of times a user logs in
4. Applications the user is logging in to
5. Risk profile of the login that the user completed
6. A verified email or phone number used during the authentication challenge

By sharing this data with downstream systems like CDPs, retailers can boost business outcomes across the entire organization.

* Marketing teams can better power analytics to gauge conversion and derive benefits from clean, trusted data.
* Customer support agents can leverage login activity to better serve customers.
* Security teams can use transactional data to diagnose a potential account breach.

## Personalization

A coffee chain turns every mobile order into next-drink suggestions. A cosmetic retailer pulls a shopper’s digital history at the register. A major hotel brand sequences emails to match each guest’s trip-planning stage. This is personalized retail. And this is how brands make customers feel known. 

However, you can’t personalize experiences if you can’t identify who the experience is for. Loyalty IDs, guest-checkout emails, in-store POS accounts and call-center records often live in disconnected silos, leaving tens of millions of customer identities fragmented across systems. Anonymous web visits keep piling up because lengthy registration and account creation processes aren’t worth it.

By unifying every sign-in, loyalty login, mobile browse, and in-store purchase under a single digital identity, retailers can recognize shoppers the instant they appear and provide context-rich data to recommendation engines, email platforms, POS tablets, and service desks in real time. 

Armed with customer preferences, sizes, household details, and spend history, brands can turn generic shopping journeys into uniquely personalized experiences.

<include src="TweetQuote" quoteText="Personalization begins with recognition — and recognition starts with a modern identity strategy." />

## Protecting Accounts, Points, and Brand Equity

For retailers and hospitality brands, the login box has become both a front door for loyal guests and the preferred entry point for bad actors. Fraudsters can simply harvest or guess credentials and stroll in as “customers,” siphoning stored credit-card numbers, wallets, gift cards, and even millions of dollars in loyalty points that now function like digital currency.

Many merchants now operate similarly to banks, holding vast troves of personally identifiable information and liquid value. Yet they’re expected to greet every visitor with a one-click checkout and zero friction.

The only sustainable way to mitigate these threats is to treat customer identity as the security perimeter. A modern identity platform inspects each login in real time — device reputation, IP risk, behavior patterns — and silently steps up defenses only when signals look suspicious. Low-risk shoppers sail through with a passkey or social login; high-risk attempts trigger adaptive MFA, CAPTCHA, or outright blocking. 

## The Bottom Line

Customer identity is a critical component of retail and hospitality customer experiences, and the organizations that invest in getting it right will be better positioned for growth.

* **Loyalty membership** increases when registration becomes effortless.
* **Omnichannel** becomes unified when every touchpoint recognizes the same person.
* **Marketing ROI** climbs as customer data quality increases.
* **Personalization** becomes much easier to implement and makes customers feel known.
* **Security** strengthens, preserving customer data and brand trust.

These outcomes aren’t future tech; they’re what retailers and hospitality groups unlock the moment they treat customer identity as a strategic part of their tech stack and not just a login box. If your growth roadmap includes deeper loyalty engagement, channel expansion, or AI-driven personalization, start by asking: **Is my customer identity infrastructure ready?** Learn how to [grow your retail business with identity](https://auth0.com/retail).

▸ Begin your [free trial today](https://auth0.com/signup?type=button&place=hero&text=contact%20sales).

Identity: The Critical Link in Retail and Hospitality’s Digital Future

Jeremie Berthiaume jpg

Group Product Marketing Manager

Jeremie Berthiaume

abhi

Abhishek Ambastha is a Group Product Manager with over 18 years of experience in security and identity solutions. At Okta CIC, he drives innovations to counter identity threats and enhance user security with seamless experiences.

Group Product Manager

Abhishek Ambastha

How AI is powering attacks – and how to fight back with Auth0 and AWS.

Bots can be harmless. However, many have malicious intentions. [Bots make up 42% of all internet traffic today, and 65% of these are ‘bad bots](https://www.akamai.com/site/en/documents/state-of-the-internet/2024/akamai-web-scraping-report-2024.pdf)’. These bots are not only wielding automated attacks to breach accounts — they are also draining your marketing budget. Bots are being used to sign up for accounts at scale and eat up your company’s sign-up bonuses, offers, and loyalty points. And the numbers don’t lie – bot attacks are taking a serious toll on businesses. A [2024 Fastly survey](https://www.fastly.com/blog/bot-wars-how-bad-bots-hurting-businesses) revealed just how widespread and damaging these attacks have become: 

![The Future of Bot Protection](https://images.ctfassets.net/23aumh6u8s0i/TcA3et7yA6eXXmaqkLewa/425f5fb556aa7118b11f927bb27ede92/The_Future_of_Bot_Protection_-_Smarter_Attacks_Demand_a_Layered_Approach.png)

### GenAI is reshaping cybercrime—and making bots more dangerous

It’s not just the quantity of bad bots that’s concerning; it's also the growing sophistication. Unless you’ve been *a tad* out of the loop, you’ve likely seen how GenAI is revolutionizing business. From AI-powered agents handling customer support to marketing teams generating personalized content at scale, the benefits are undeniable. But there’s a dark side. [AI adoption in cybercrime is expected to grow at a staggering 37% CAGR between 2023 and 2030](https://www.grandviewresearch.com/industry-analysis/artificial-intelligence-ai-market), making it easier than ever for attackers to run automated attacks and cause more damage.

These same AI advancements are being used by cybercriminals to supercharge their automated attacks, some without even writing a line of code themselves. Bots are now easier to create than ever and are vastly more adept at mimicking human behavior, allowing them to evade conventional security controls. As bots become more advanced, we have to get cleverer about how we fight them. Spoiler alert: this means layering modern defenses – there’s no silver bullet. Also, to fight AI, we need to use AI. We’ll get into this in a bit...

### CAPTCHAs — Not all bot detection is created equal 

When you think of bot detection, you probably cringe – because, chances are, the first thing that comes to mind is the traditional CAPTCHA. 
<br><br>

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487 icon-info"></i>
  <strong> CAPTCHA:</strong><br> 
  <b> Completely Automated Public Turing test to tell Computers and Humans Apart – a challenge-response test that is meant to be easy for humans to pass, but difficult for computers (or bots) to solve.<br> 
</div>

You’ve seen them before – checking a box, deciphering distorted text, or selecting every image with a stoplight. While these simple CAPTCHAs can be effective against **basic** bot attacks, they also slow down real users, creating frustration (who hasn’t struggled through endless grids of bicycles?)

<br>

And here’s the real kicker – modern bots are outsmarting them. Advanced automation and AI-powered bots can now solve image-based CAPTCHAs faster and more accurately than humans. That means traditional CAPTCHA isn’t just frustrating – it’s also failing. We need better, layered defenses that distinguish humans and good bots from malicious ones with minimal friction to the user and harness the power of AI to fight the threat of AI.

<br>

Let’s look at how Auth0 and AWS together help you do that.

### How Auth0 fights back against malicious bots

#### Auth0 bot detection – a first line of defense for automated attacks 

As AI-powered attacks evolve, we’ve re-engineered our fourth-generation Auth0 Bot Detection engine to strengthen protection against malicious traffic without compromising the user experience. Auth0 Bot Detection continuously monitors Identity threats across hundreds of millions of users, enabling us to detect bad bots and respond in real time. It features advanced machine learning models, making it even more effective at spotting and stopping bots.

- Detect automated attacks like fake signups and credential stuffing, and respond with user-friendly challenges like Auth Challenge or out-of-the-box third-party bot challenge integrations like Google reCAPTCHA, hCaptcha Enterprise, or Friendly Captcha.

- Leverage machine-learning models, including a model designed for signup attacks. Tailored models greatly improve detection and prevention of bots across the user journey, while reducing bot challenges presented to real customers.

- Auth0 Bot Detection, on average, is shown to block less than 1% of legitimate users (based on overall Auth0 customer traffic). 

#### Layer in these additional Auth0 defenses to defend against automated attacks: 

- Passkeys offer a passwordless login option that lets users log in to apps, platforms, and devices quickly and helps prevent phishing. In theory, passkeys mean bot detection, and CAPTCHA could be skipped, but bot detection remains the most viable first level of defense for the login box as not all users or organizations add MFA (multi-factor authentication)  in every app. 

- Adaptive MFA reduces MFA fatigue by only prompting extra verification with risks like untrusted IPs, new devices detected, or ‘Impossible Travel' (detects suspicious login attempts by analyzing the distance and time between consecutive sign-ins). If an automated attack succeeds in guessing a user’s username and password, MFA is the second line of defense in preventing an incident.

- [Breached Password Protection](https://auth0.com/features/breached-passwords) blocks known breached credentials at sign-up, login, or password reset. It detects the use of compromised credentials, and then blocks and notifies the user in real-time. 

- [Credential Guard](https://auth0.com/features/breached-passwords) allows up to 10x faster detection of compromised credentials with a dedicated security team and support for 35+ languages and 200+ regions. Cut detection time from months to hours. Our dedicated security team infiltrates criminal undergrounds and the dark web to find compromised credentials.

- Brute Force Protection and Suspicious IP Throttling block high-velocity attacks on accounts inflicted by bots. 

- Security Center enables faster detection and response to attacks with a dashboard of near real-time observability tools. Get intelligent insights into identity events, anomalies and efficacy. Set custom threshold alerts. Easily Integrates with SIEM tools.

- Log Streaming allows streaming relevant Auth0 activity to 3rd party SIEM and SOAR tooling to enable faster detection and response. Automate response to security threats, outages, new sign-ups, and more with custom business logic.

### Combine Auth0 with AWS for defense in depth 

Auth0’s bot protection and Identity security capabilities, together with AI-powered threat detection from AWS, bolster your organization’s defenses even further. 

AWS provides a suite of services to detect anomalous behavior throughout your GenAI stack, whether you’re building business apps that use generative AI or protecting your systems against generative AI threats. Here are some of the solutions available from AWS: 

#### Auto Scaling Groups
Auto Scaling Groups in AWS automatically adjust the number of AWS instances based on traffic demand – but it also helps mitigate bot attacks by scaling resources to handle unexpected surges caused by malicious bot traffic.

#### AWS WAF (Web Application Firewall)
AWS WAF provides bot detection by analyzing incoming traffic. It helps protect web applications by filtering out harmful bot traffic before it reaches critical resources, reducing the risk of credential stuffing, scraping, and other automated attacks.

#### AWS Shield
AWS Shield defends against distributed denial-of-service (DDoS) attacks, including bot-driven attacks. AWS Shield Advanced offers enhanced protection by integrating with AWS WAF to detect and block sophisticated bot traffic targeting your applications.

### Wrapping up

While AI is exacerbating the threat of bot attacks, it can also be leveraged in the fight against them.

That’s where Auth0 and AWS come in. Together, we provide a multi-layered security approach utilizing AI to protect every aspect of your user journey, ensuring only legitimate users gain access to your systems while blocking malicious automated activity. All in a way that minimizes user friction and reduces the load on DevOps and SecOps teams.

Learn more about how Auth0 and AWS [here](https://auth0.com/partners/aws).


The Future of Bot Protection: Smarter Attacks Demand a Layered Approach

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Build the future of identity: join developers around the world at Oktane Online 2024

**Oktane 24** is just around the corner, happening from October 15-17, 2024, with a lineup built specifically for developers. Whether you're joining us in person or virtually, we've designed an experience tailored to your needs.

Can’t make it to Las Vegas? No problem! **Oktane Online** on October 16 delivers a full day of live-streamed keynotes, deep technical sessions, and hands-on demos to help you stay ahead in identity and access management.

As a developer, you understand how crucial identity is to building secure, scalable, and seamless applications, whether it’s for B2B, B2C, or internal users. That’s why Oktane Online is your perfect chance to learn from the experts, gain hands-on insights, and see how Okta’s solutions can elevate your development process.

## Why Should Every Developer Attend?

You’ll hear directly from engineers, developer advocates, and product leaders who will guide you through real-world use cases, cutting-edge identity solutions, and the latest innovations. Plus, you’ll get the chance to ask questions, join live demos, interact with other developers, and enjoy some surprises along the way!

## Agenda Overview

Here are a few developer sessions you won’t want to miss:

### 🗓 Wednesday, October 16

**🕗 8:05 AM PDT - Navigating the Path to Packaged Business Capabilities**

Learn from Cigna Group's journey of simplifying health data access with Okta's Customer Identity Cloud (CIC), showing how developers can build packaged business capabilities to streamline customer identity and onboarding experiences.

**🕘 9:00 AM PDT - Keynote: The Future of Identity Security**

Join this keynote to explore how developers can play a critical role in securing today’s complex identity ecosystems. From passwordless authentication to unified identity, see how Okta’s product innovations are shaping the future.

**🕙 10:15 AM PDT - The Art of Zero Trust Identity: A Unified Approach Towards Secure Access Management**

Zero Trust starts with identity. In this session, you’ll learn how to shape security measures from initial access to ongoing threat mitigation. This talk is a must for developers focused on securing applications and infrastructure.

**🕛 12:15 PM PDT - Keynote: Reaching New Heights with Alex Honnold**

Get inspired by rock climbing legend Alex Honnold as he talks about overcoming challenges, taking risks, and his mission to advance solar energy. A motivational session every developer will appreciate!

**🕛 2:30 PM PDT - Keynote: Secure, Engaging, Developer-Friendly Customer Identity. It’s Possible.**

This keynote will dive into how Okta's **Customer Identity Cloud** is transforming the way developers build secure, seamless customer experiences. Discover how Okta’s latest innovations help you build apps faster and better while ensuring world-class security for your users.

**🕓 3:45 PM PDT - Insights on Delivering IT Modernization for Enhanced Security**

Join Chemist Warehouse as they discuss their journey with IT modernization and how developers can leverage identity solutions to streamline workflows and secure their infrastructure.

**🕔 4:30 PM PDT - Get Started with Using GenAI for Efficient Okta API Integration**

In this session, you’ll see how to harness the power of Generative AI and Okta APIs together to fast-track your integration process. Learn how to go from concept to working code in record time.

Want to see the full agenda? Check out all the sessions [**here**](https://www.okta.com/oktane/online/#:~:text=up%20to%20you.-,See%20all%20sessions,-Channel%201%20I).

## Don’t Miss Out – Register for Free!

Oktane Online is completely free to attend and provides great opportunities to enhance your knowledge, sharpen your skills, and build better, more secure applications. With access to live sessions, on-demand content, and real-time interaction with Okta experts, it’s the event of the year for developers working with identity or willing to learn more about identity.

Register now [**here**](https://reg.okta.com/flow/okta/oktane24/reg/) and get ready to take your identity management skills to the next level.


Why Developers Should Attend Oktane Online

jon-elliott

Hi, I'm a Software Engineer and lifelong learner with a passion for cryptography. I've been with the IAM-Core-Crypto team in Auth0 since 2021, but have been working on applying applied cryptography to systems and applications since 2015


Senior Software Engineer

Jon Elliott

Quantum computers may not be here yet, but we still need to prepare for them.

There’s a joke about Quantum Computing where a Computer Science Professor predicts to a rapt classroom that it’s just 10 years away, and the punchline is that they’ve been saying it for the last 50 years or so. The actual number of years in the future changes from telling to telling, but the point is always that it remains within sight but out of reach. Quantum Computing as a usable tool is definitely still out of reach, but you wouldn’t know it by the amount of discussion there is around it. We’re not going to go into the basics of Quantum Computing as there are plenty of articles already about that. 

Instead, we’re going to focus on how we actively need to prepare for it, whether it will be a reality soon or not. Post-Quantum Cryptography (PQC) refers to cryptographic algorithms that can be run on classical computers, but are believed to be secure enough to withstand a cryptoanalytic attack by a Quantum Computer. Don't get me wrong, I’m not saying that you need to go and ditch your brand-new laptop straight away. When they do reach maturity, Quantum computers probably aren't going to be relevant for every use case out there. The ones we have just now can’t even run that ultimate test of computing power, Doom. [Seriously](https://digitalcommons.denison.edu/cgi/viewcontent.cgi?article=1242&context=synapse).

## How Quantum Computing Impacts Security

However, Quantum Computing is of particular concern when it comes to cryptography, specifically end-to-end encryption. This is where the information is encrypted on the sender's device before transmission and is only decrypted when it reaches the intended receiver's device. This is how we use cryptography every day, in more ways than you can imagine. It’s not just when you log in to your computer to check your bank account; it’s when you message a friend to arrange to meet for lunch, it’s when you tap your card to pay for that lunch, and it’s when you’re reading this article. Take a look at the browser bar, and chances are you will see ‘https’ at the start of the web address rather than just ‘http’. That ‘s’ at the end means that no one online can tamper with what you are reading. The web page is being sent securely to your device via a protocol called TLS, encrypting all communication between your computer and this site.

So why is it such a concern for end-to-end encryption? Well Public Key Cryptography or Asymmetric Cryptography is built around the idea of certain problems being hard to solve, and one of these is what’s called the Integer Factorization Problem. Now, this is a bit counterintuitive but it’s based on the premise that while two numbers are very easy to multiply together, it is surprisingly difficult to divide that result back into its prime factors without first knowing them. The difficulty in calculating the two factors in computing terms equates to Computational Hardness. And Public Key Cryptography is a big part of end-to-end encryption.

> Public Key Cryptography is where a publicly available key is used to encrypt a message and a privately stored key is used to decrypt it. The maths behind it is that this is what is called a one-way function, i.e., very easy to compute in one direction but substantially more difficult to reverse, provided you pick two sufficiently large prime numbers. Examples usually revolve around RSA as it is relatively easy to explain and understand, but the more common Public Key algorithm used is Elliptic Curve, which is built around something called the Discrete Logarithm Problem. At a low level, it’s possible to prove that the Discrete Logarithm Problem and Integer Factorization Problem can be mathematically reduced to the same problem, but for the moment it’s best to think of RSA being based on the Integer Factorization Problem and Elliptic Curves being based on the Discrete Logarithm Problem.

So, how does quantum computing fit into this? Well, one of the earliest quantum algorithms is called [Shor's Algorithm](https://en.wikipedia.org/wiki/Shor%27s_algorithm) and is designed to, well, efficiently divide a number back into its prime factors.  In real-world terms, Shor’s Algorithm is currently a while away from meeting this goal in any meaningful manner. The largest number reliably factored is 21 (that’s 7 x 3 for anyone needing a hand) back in 2012,  but when the infrastructure exists to support fully developed implementations, then it’s not too hyperbolic to say that it will be a bit of a game changer.

[Grover's Algorithm](https://en.wikipedia.org/wiki/Grover%27s_algorithm) is a search algorithm that does the same for symmetric encryption but the solution is much simpler, which we’ll go into a little later on.

![Quantum Computing](https://images.ctfassets.net/23aumh6u8s0i/7L8e9elBfIZonTzxZDhPxh/4b95a9a75f7d82da0d43e29dc2ff330f/quantum-sep3.jpg)

One of the driving forces behind developing Post-Quantum Cryptography, or PQC, is the concern that with storage currently being so cheap, it is easy for criminals to stockpile data harvested from security breaches in preparation for when Quantum Computers are available, an approach known as Harvest Now, Decrypt Later, or Retrospective Decryption. Whilst some would argue against preparing for a technology that is a while away from maturity, these attacks are certainly technically feasible. All they involve is the intercepting and (more importantly) storing of a large amount of data that will still have value in 5/10/20 years time. It might not sound plausible that criminals would be that far thinking, however given the longevity of identifiable information, it's easy to see that captured data may still have value, and with storage being very affordable, it doesn’t require too much outlay on the chance that it will. Some predict that Quantum computers will be able to break classical encryption by 2030. Think back to where you were in 2018. Six years isn’t that long, is it? So, ultimately, the concern has changed: it’s not just what is to be kept secret, it’s also how long it needs to stay secret.

## Post-Quantum Cryptography Solutions

No great change is required to the core of asymmetric cryptography in order to make it Quantum secure. It’s still based on the difficulty of solving certain mathematical problems. So, if we want to make an encryption algorithm Quantum secure, we must ensure that the problem it is built around is sufficiently hard. This has a knock-on effect on verifying the security of the algorithms, as cryptography algorithms are validated by cryptographers rather than mechanical means, and the hardness of the problems means that there are fewer cryptographers qualified to do so.

There are six different approaches currently being worked on in Post-Quantum Cryptography:

- Lattice-based cryptography
- Multivariate cryptography
- Hash-based cryptography
- Code-based cryptography
- Isogeny-based cryptography
- Symmetric key Quantum resistance

Out of all of them, symmetric keys are the easiest to harden for Quantum Computing attacks, relatively speaking. In fact, in order to meet the same level of security strength (based on computational hardness) for a Post-Quantum algorithm as for a classical one, the key size can simply be doubled. This is because the computational hardness of symmetric key algorithms is based on the size of the keyspace rather than the difficulty of any problem to solve. So, to meet the same level of security currently offered by AES-256, you will need to use 512-bit keys.

Lattices are a mathematical construct based around matrices, which are arrangements of numbers in rows and columns. One of the more popular algorithms is called [Learning With Errors](https://en.wikipedia.org/wiki/Learning_with_errors), where the Error (a row of values) is added to the result of two matrices, providing the ‘difficulty’ in retrieving the result from the first factor. This can be represented formulaically as `ax+e = b`, where `a` and `b` make up the public key, and `x` and `e` make up the private key.

Hash-based cryptography involves using cryptographically secure hash functions to generate a private and public key for signing and is considered one of the more fully understood approaches. Lattice-based cryptography and Hash-based approaches have proved to be the most fertile ground for asymmetric solutions, leading to them making up the majority of the submissions for standardization by NIST.

## NIST Recommendations

The body that decides which encryption algorithms become standards isn't the NSA or one of the other three-letter agencies you might think of. Instead, it’s the National Institute for Standards in Technology, a subsection of the U.S. Department of Commerce whose job it is to cover both the algorithms and the key strengths recommended for guaranteeing high security. Established in 1901 as the National Bureau of Standards, NIST is responsible for fostering technological innovation and economic competitiveness in the United States. They first became part of the cryptography landscape as part of the first Government project to develop a publicly available cryptographic standard to satisfy a broad range of requirements and use cases, rather than leaving it to the military as had previously been the case.

An open call was made in the early 1970s for people and companies to submit candidate algorithms, and after receiving a submission from IBM called Lucifer, NIST chose that algorithm as the basis for its proposed [Data Encryption Standard (DES)](https://en.wikipedia.org/wiki/Data_Encryption_Standard). Offering only 56 bits of encryption, it wasn’t long before this proved to be wanting in overall security terms, as the hardware needed to crack DES encryption started to become less cost-prohibitive as time went on, and several public competitions were held in the late 90’s with the express goal of breaking DES. It was reconfigured as Triple DES in an attempt to extend its shelf life (literally just running the DES algorithm three times to give 112 bits of security), but it soon became clear that a new standard was required. This was followed up with the replacement, [Advanced Encryption Standard (AES)](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) in 1997, an implementation of the Rijndael Encryption Algorithm, selected from a list of viable candidates from another public competition.

![Data Encryption Standard](https://images.ctfassets.net/23aumh6u8s0i/1459k5sEGn3nETjOL2CIVP/8d1b15fe4602127fb343c8fe727c3152/quantum-sep2.jpg)

Encryption doesn’t stand still though, so NIST needs to keep updating its standards to meet the evolving security requirements. Since 2016, they have been running rounds of evaluation as part of their PQC Standardization Process, asking cryptographers to devise and vet encryption algorithms that could resist attacks from a Quantum computer. This has been done in the open to allay any concerns of the algorithm being tampered with, such as in the case of [Dual EC DRBG](https://en.wikipedia.org/wiki/Dual_EC_DRBG), a random number generator that was believed to have a backdoor inserted by the NSA.

Nist started with 82 candidate algorithms nominated. 69 of these were chosen to progress, and through four rounds of judging this was whittled down to the four current standardized algorithms in 2022.

### CRYSTALS-Kyber

Renamed by NIST as the Module Lattice-Based Key Encapsulation Mechanism (ML-KEM), this is based on the Learning With Errors (LWE) Lattice problem and is intended to be used for general encryption. It replaces Quantum vulnerable algorithms such as Elliptic Curve Diffie-Hellman (ECDH), i.e., any which use a public/private key pair to share a key that can then be used for symmetric encryption.

There are three parameter sets defined by the standard:

- Kyber-512, offering security equivalent to AES-128
- Kyber-768, offering security equivalent to AES-192
- Kyber-1024, offering security equivalent to AES-256

### CRYSTALS-Dilithium

Renamed by NIST as Module Lattice-based Digital Signature Algorithm (ML-DSA), this is a digital signature intended to offer a Quantum-secure replacement for ECDSA and RSA, i.e., any use case which involves using a public/private key pair to authenticate data.

There are three parameter sets defined by the standard:

- ML-DSA-44, offering security equivalent to SHA3-256
- ML-DSA-65, offering security equivalent to AES-192
- ML-DSA-87, offering security equivalent to AES-256

### SPHINCS+

Renamed by NIST as Stateless Hash-based Digital Signature Algorithm (SLH-DSA). Unlike all the other algorithms, this is the only non-Lattice-based solution and is instead a Hash-based approach.

There are twelve parameter sets defined by the standard. These are based on using either SHA2 or SHAKE as the hash algorithm and 128, 192, or 256 bits of security, eg SLH-DSA-SHA2-128s uses the SHA2 hash algorithm and offers security equivalent to AES-128.

### FALCON

This is a Lattice-based solution but is still to receive a draft standard. This is taking longer due to the difficulty of implementing it, but it is due later this year (2024).

Three additional algorithms are still under consideration: BIKE, Classic McEliece, and HQC, all code-based cryptography. The popular SIKE (Supersingular Isogeny Diffie–Hellman Key Exchange) was originally in this list but was found to be classically broken by a group of Belgian researchers, who were able to recover a key within 62 minutes running on an [Intel Xeon computer](https://eprint.iacr.org/2022/975.pdf). NIST unsurprisingly decided not to standardize SIKE. This was built around the Supersingular Isogenies Problem, which seems to have been enough to dissuade further development around this particular problem.

## Conclusion

Hopefully, you’re all a little clearer by now on why this is important and also why it has taken a long time to get here. Taking the joke from the start of this post as a warning, the U.S. is aiming to transition its cryptographic systems to Quantum-resistant algorithms by 2035, and recently, both Apple iMessage and Signal have upgraded their protocols to incorporate the CRYSTALS-Kyber algorithm and become Quantum-resistant. So, while this is a complex area and there are too few people around who understand it, the progress made is promising, and the joke is slowly becoming a reality.

### References

- [NIST: PQC Standardization Overview](https://csrc.nist.gov/projects/post-quantum-cryptography)
- [NIST: PQC Standardization Call for Proposals](https://csrc.nist.gov/CSRC/media/Projects/Post-Quantum-Cryptography/documents/call-for-proposals-final-dec-2016.pdf)
- [Wikipedia: Hidden Subgroup Problem](https://en.wikipedia.org/wiki/Hidden_subgroup_problem)
- [CACM: NIST Post-Quantum Cryptography Candidate Cracked](https://cacm-preview.acm.org/news/nist-post-quantum-cryptography-candidate-cracked/)

Post-Quantum Cryptography: Preparing for the Future of Security

deepu-sasidharan

Deepu is a polyglot developer, Java Champion, and OSS aficionado. He mainly works with Java, JS, Rust, and Golang. He co-leads JHipster and created the JDL Studio and KDash. He's a Staff Developer Advocate at Okta. He is also an international speaker and a published author.

Staff Developer Advocate

Deepu K Sasidharan

Passkeys and WebAuthn for developers. Learn how passkeys work and the benefits they provide.

A Passwordless Future: Passkeys for Developers

I stream, blog, and make youtube videos about tech stuff. I love coding, I love AI, and I love building stuff!

Juan Cruz Martinez

This Valentine’s Day ditch passwords and fall in love with passkeys, the future of authentication!

This Valentine’s Day story is a love story, but like many love stories, it starts with a tragic breakup. Just yesterday I was writing a [breakup letter with passwords](https://auth0.com/blog/a-farewell-letter-to-passwords), it wasn’t easy, but necessary. Our relationship was going nowhere, and long gone were the days of butterflies and passion.

With my heart cautiously open, I decided to take a leap of faith. I'm embarking on a new love story, one built on trust, convenience, and affection, a relationship where I feel safe, where I can be myself, my face, my fingerprints, and not a random string.

My new love is passkeys, and maybe it’s again those butterflies in my stomach doing the thinking, but what’s not to be loved about passkeys?

As I write these words down, I want to celebrate what passkeys bring in for me, to our relationship, to my online identity, and to my protection:

- **An Unbreakable Bond**: Passkeys, through the magic of public-key cryptography, forge an unbreakable connection between me and my data. It’s like a padlock secured by something uniquely mine, like my fingerprints, my face, or one of my secure devices.

    A bond so strong that it can resist brute-force attempts, a bond so unique that it is breach safe, and a bond so close that it is phishing resistant.
- **Effortless Access**: I remember the frantic searches, the cold sweat dripping down my forehead as I desperately tried every password combination? With passkeys I can say goodbye to such anxieties! using a simple tap, a fingerprint, or a facial scan. Just like effortlessly unlocking my partner’s heart with a shared understanding.

- **Always By My Side**: No more worrying about forgotten passwords or locked accounts. Passkeys work across different platforms and devices, ensuring I’m always connected to my loved ones, just like an invisible link that keeps us together.

- **Sharing is Caring**: I can easily share my passkeys across my devices without compromising security. Passkeys offer seamless login experiences across devices and secure and convenient ways to grant access, just like sharing experiences in a healthy relationship.

- **Uniquely Yours**: Since I can’t reuse a passkey, they are unique per online service and account. When I create a new passkey, it’s tied to that specific domain.

I’m sharing my love story, in hopes it will inspire others. If you ever felt like me, and you think it’s time to ditch passwords and move on, [learn and adopt passkeys today!](https://a0.to/passkeys_blog).

<include src="LearnPasskeysCTA"/>

Reasons to Fall in Love with Passkeys

Passkeys and WebAuthn for Java developers. Learn how to get started with passkeys for your Java and Spring Boot applications.

A Passwordless Future: Passkeys for Java Developers

shiven_ramji

Shiv is an experienced product executive and builder obsessed with creating beautiful products. He is the President of Auth0 at Okta, managing a $1B ARR business and overseeing the company’s product, data, security, and technology strategy and execution. Before Auth0 and Okta, Shiv was the SVP of Product at DigitalOcean, leading DigitalOcean’s products, pricing, and partnerships. Additionally, Shiv has held product leadership positions at global brands, including Amazon, NBCUniversal, LiveIntent, and The Nielsen Company. Shiv was the recipient of the 2023 Top Global CPO Award by the Products That Count community.

Beyond his current corporate focus, Shiv is deeply committed to fostering entrepreneurship and innovation, particularly in Africa. He is an active angel investor and startup advisor and also serves on the boards of [**Products That Count**](https://productsthatcount.com/) and [**Aiven.io**](http://Aiven.io).


President, Auth0

Shiven Ramji

Over the last 6 months, Okta has delivered capabilities designed with security, scalability, and resiliency in mind. Read about what we delivered and our future roadmap.

Our teams have been heads down and focused on delivering capabilities that empower our customers to continue to provide seamless customer experiences and power their SaaS ambitions. As we are now halfway through the calendar year, I wanted to reflect on the capabilities we have delivered and give you a glimpse of what's to come next. 

## Unveiling New and Improved Product Features

We strive for innovation and resiliency in our work since we know it translates into direct value for our customers. Over the past six months, our teams have worked across domains to deliver capabilities meticulously designed with security, scalability, and resiliency in mind.

### Flexibility Focus

We continue to double down on improving our customers' ability to build great user experiences within consumer apps. The team has persistently strived to provide a flexible way to build identity flows. In the past few months, we've launched a few enhancements to support this goal further.

* [Passwordless support on New Universal Login](https://auth0.com/docs/authenticate/login/auth0-universal-login/passwordless-login) allows users to provide an email address or phone number and receive a one-time password (OTP) to complete authentication.
* [Additional email provider support](https://auth0.com/changelog#3yVUYwYINRo7edOw8tP7kG) (Azure Communication Service & Microsoft Modern Auth) enables customers to use Outlook on Microsoft 365 or the recently released Azure Communication Services as preferred authentication methods.

### SaaS Excellence

With a keen eye for enhancing user experiences and elevating customer satisfaction, we continue to make strides that redefine and advance SaaS excellence. To that end, the teams have released several new features:

* [PKCE and attribute mapping are available on OIDC and Okta Workforce Connections](https://auth0.com/docs/authenticate/identity-providers/enterprise-identity-providers/configure-pkce-claim-mapping-for-oidc), allowing customers to build more secure connections between Auth0 and your connected identity provider. With attribute mapping, you can sync more attributes from your IDP into your Auth0 tenant.
* [Improved Login Flow for SaaS Users](https://auth0.com/docs/manage-users/organizations/login-flows-for-organizations) includes options for tying identifier first Home Realm Discovery to Connections with IdP domains associated with Organizations and a New Universal Login Prompt that displays when configured for end users with multiple organization memberships. 
* [Organization Name support for launching Login flows](https://auth0.com/docs/manage-users/organizations/configure-organizations/use-org-name-authentication-api), making Organizations easier to use by enabling the Organization Name to launch login flows via the Authentication API.

### Making Security Easy

At the core of everything we do is the desire to make security seamless and straightforward. Safeguarding data should be uncomplicated yet foolproof. Our latest releases offer protection and make it intuitive, empowering our customers and their users to navigate the digital world without compromise.

* [Security Center is now available on Converged Platform](https://auth0.com/docs/secure/security-center), a new security feature that provides real-time monitoring of potential security events.
* [Bot Detection Slider for Bot Detection](https://auth0.com/docs/secure/attack-protection/bot-detection#use-bot-detection-slider) provides the ability to adjust the level of friction of the "When Risky" setting on our Bot Detection model.
* [Bot Detection is Now Integrated with Friendly Captcha and hCaptcha](https://auth0.com/docs/secure/attack-protection/bot-detection#configure-bot-detection), supporting additional Captcha Providers and their capabilities. 
* [Teams: Security Policies - SSO Enforcement Early Access](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), providing the option to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Developer Experience

Our Developer Experience teams built the following enhancements with intention, care, and a complete developer experience in mind. With streamlined workflows and a suite of tools, developers quickly translate their application experience vision into reality.

* [Node 18 is now available for Actions, Rules, and Hooks](https://auth0.com/changelog#2xzzvhZDXiRbThfc7XsfO). You can start using Node 18 in your tenants' settings and/or when creating new Actions in the Auth0 Manage Dashboard.
* [Auth0 Terraform Provider V1 - BETA](https://auth0.com/changelog#515sGCwZW2u6bD06rzS1uC), with the v1 release, managing your Auth0 resources using Terraform has never been easier. 
* [Auth0 Management API](https://auth0.com/docs/api/management/v2) launched, which includes numerous new features and enhancements for the UI experience.
* [Teams: Security Policies - SSO Enforcement](https://auth0.com/docs/get-started/tenant-settings/auth0-teams#configure-security-policies), allowing you to mandate login to Teams and Manage Dashboard through the organization's enterprise IdP.

### Customer Delight

We obsess over giving customers the complete capabilities to deliver a delightful customer experience. Every interaction and every touchpoint is an opportunity to elevate the customer journey. Our latest achievements stand as a testament to our dedication to not only meeting but exceeding the expectations that define customer delight.

* [Guardian App Localization](https://auth0.com/docs/secure/multi-factor-authentication/auth0-guardian): The Guardian app is available as an authenticator to deliver push notifications to a user's pre-registered device (mobile phone or tablet) and supports English - US (en-us), French - Canada (fr-ca), French - France (fr), Portuguese - Brazil (pt-br), and Spanish - Argentina (es-ar).
* [Universal Login: New Language Support](https://auth0.com/docs/customize/internationalization-and-localization/universal-login-internationalization): Six new languages are now available as supported translations for Universal Login: Basque: eu-ES; Catalan: ca-ES; Galician: gl-ES; Norwegian: no; Norwegian Nynorsk: nn; and Welsh: cy.
* [Custom Domains in Guardian SDKs](https://auth0.com/changelog#7brExNHNLtHshVHvayBm6L), building your users' confidence that they are providing their credentials to the proper party. Custom Domains allow authentication to happen within the context of your brand.

The [Auth0 Changelog](https://auth0.com/changelog) has the full details and documentation on these updates and serves as the real-time release center. 

## Looking Forward to the Next Half

We've made good progress on delivering our roadmap and have steadily released capabilities that help our customers deliver seamless and secure experiences for their customers. 

A big thank you to all of our teams, and looking forward to penning another post full of releases in the next six months. 

[Oktane](https://www.okta.com/oktane/) is just around the corner, where we'll pull back the curtain on what's still to come! Registration is now open, and we hope to see you there.

Unveiling New and Improved Product Features — 6 Month Lookback

evan-sims

Evan is a software engineer on the DX-SDKs team at Auth0, and his pronouns are He/Him. He's passionate about helping developers build great (and secure!) software, a big fan of PHP, Laravel, Symfony, and WordPress, and an avid FOSS contributor. Before joining Auth0, he created free and open-source software supporting humanitarian aid and citizen journalism efforts. Once upon a time, he worked as a technical designer in the video games industry; he's more focused on playing them these days. He loves reading, traveling, spending time outdoors with his partner, and writing his blog autobiographies in the third person.

SDK Engineer

Evan Sims

Integrate Auth0 in your Laravel applications with no code by using the new Laravel SDK.

[Laravel](https://laravel.com/) is a tremendously popular web application framework — with good reason! Now in its 10th generation, the framework has built up a robust and mature foundation that’s not just battle-tested but genuinely delightful to build applications with. Laravel has elevated the entire PHP experience to a new level thanks to its incredibly passionate developer community. These days it’s nearly become as synonymous with PHP as Rails has with Ruby. And with PHP running on [at least 80% of web servers](https://kinsta.com/blog/is-php-dead/), that’s a big deal. For a good reason, companies like Disney, Warner Brothers, Twitch, and The New York Times have embraced Laravel.

Auth0 has offered a Laravel SDK for many years — our first release dates back to 2014! A lot has changed since then, and like all our SDKs, we’ve evolved to fit the times and the community’s needs. Every new release is an opportunity to iterate, improve, and create a better developer experience.

Early last year, [we released v7 of our Laravel SDK](https://github.com/auth0/laravel-auth0/), which was a big one. We rewrote the SDK from the ground up to take advantage of [PHP 8](https://stitcher.io/blog/new-in-php-8) and [Laravel 9](https://kinsta.com/blog/laravel-9/) and restructured everything on top of our massively upgraded core [PHP SDK v8](https://github.com/auth0/auth0-php). For the first time, developers could integrate authentication with Auth0 in their Laravel apps in less than ten lines of code, and it was great!

But we wondered — what if you could do it with zero lines of code?

Over the last few months, we’ve been striving to create that experience for our Laravel developers, and as of [v7.8 release](https://github.com/auth0/laravel-auth0/releases/tag/7.8.0), we’ve reached that milestone (and so much more).


## With Great Power...

Laravel is a robust framework created to support practically any kind of application developers might want to build. It’s one of those rare frameworks that has managed to strike a harmonious balance between powerfully customizable and highly opinionated. And when it comes to something as critical to an application as authentication, if you’re going to tackle the subject, you better be sure you’re striking that same balance successfully. It should “just work” while also being flexible enough to mold to the most niche scenarios.

Admittedly in the past, our Laravel SDK has not always hit that mark on addressing those niches, particularly in supporting monolithic apps; that is, apps that serve JSON APIs with token-based authorization as well as modern frontends with session-based authentication, in the same codebase. The community asked us to create a better solution, but there were some technical hurdles to work through first.

Traditionally, our SDK exposed authentication through a single API, which made integration super simple but meant that, on occasion, developers had to figure out how to support some exotic use cases using just a single SDK configuration. It simply didn’t always work as elegantly as one would hope.

With v7.8, we went back to the drawing board to address this. We took a deep dive into the core of Laravel’s Authentication APIs, drilling into the framework’s source code, and began laying the groundwork for a whole new approach that let us support every type of application (yes, even those tricky monolithic apps!) in exciting new ways. We even learned some new tricks along the way!


## Real Artists Ship

Efforts toward these ends [began with 7.2](https://github.com/auth0/laravel-auth0/releases/tag/7.2.0), where we started working on the foundation of our new approach. We started by building the support we needed to do this right. We began by releasing support for native Laravel sessions, persistent session storage, and support for Laravel’s native caching APIs. We built experimental [Octane](https://laravel-news.com/laravel-octane-for-scale) support for supercharged applications. We improved reliability by achieving 100% code coverage and implemented mutation testing and triple-filtered static analysis to ensure we caught as many edge cases as possible. We cut a new release each month, bringing us closer to our new goal: a no-code solution that addresses all our customers' requests.

And today, finally, with 7.8, we’ve reached our goal. There’s so much to share, but we’ll distill it down to the headline features:


### Changing of the Guard(s)

With 7.8, we released two completely new Guards that leverage every aspect of Laravel’s powerful Authentication API. These new Guards — one for session-based authentication and the other for token-based endpoint authorization — enable support for applications of all types and use cases, finally addressing the demands of those monolithic app developers.

Previously, you had to write the following code:

```php
Route::middleware(['guard:auth0', 'auth0.authenticate'])->get('/messages', function () { 
    // ...
});
```

Today you just write as follows:

```php
Route::get('/messages', function () {
    //...
} })->middleware('auth'); 
```

We created a suite of new middleware and services that support using these Guards without any integration work within the application. There are no editing files, defining middleware, or Kernel changes; it just works. Authentication is immediately available, and any routes configured to use Laravel’s native `‘auth’` middleware for limiting access to authenticated sessions instantly work with Auth0. **Zero lines of code!**

Previously, you had to define your guards and provider...

```
// config/auth.config: 
return [ 
    'guards' => [ 
        'auth0' => [ 
            'driver' => 'auth0.guard', 
            'provider' => 'auth0-provider', 
        ]
    ],
    'providers' => [ 
        'auth0-provider' => [ 
            'driver' => 'auth0.provider', 
            'repository' => \Auth0\Laravel\Auth\User\Repository::class, 
        ]
    ],
];
```
...and modify the Kernel:

```php
// app/Http/Kernel.php: 
use Illuminate\Foundation\Http\Kernel as HttpKernel; 

class Kernel extends HttpKernel 
{
protected $middlewareGroups = [ 
    'web' => [ 
        \App\Http\Middleware\EncryptCookies::class, 
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, 
        \Illuminate\Session\Middleware\StartSession::class, 
        \Illuminate\View\Middleware\ShareErrorsFromSession::class, 
        \App\Http\Middleware\VerifyCsrfToken::Class, 
        \Illuminate\Routing\Middleware\SubstituteBindings::Class, 
        \Auth0\Laravel\Auth\Guard::class, 
    ]; 
} 
// routes/web.php: 
use Auth0\Laravel\Http\Controllers\{Callback, Login, Logoutl}; 
Route::group(['middleware' => ['web', 'guard:auth0'], static function (): void {
    Route::get('/login', Login::class)->name('login'); 
    Route::get('/logout', Logout::class)->name('logout'); 
    Route::get('/callback', Callback::class)->name('callback');
    }); 
```

Today, this is all you need to do:

```php
// Nothing! 🎉
```

And for the first time, we now support Laravel’s powerful native Authorization API, which enables developers to write permissions-based gates and policies that can use Auth0’s RBAC with APIs for fine-grained access control.

This is what you had to write previously:

```php
Route::middleware(['guard:auth0', 'auth0.authenticate'])->group(function () { 
    Route::get('/messages', function () { 
        return response("You're authorized to read messages."); 
    })->can('auth0.authorize:read:messages'); 
}); 
```
Here is what you have to write today:

```php
Route::get('/messages', function () { 
    return response("You're authorized to read messages."); 
})->middleware('auth')->can('read:messages'); 
```

### Auth0 CLI: First-Class Configuration

To support these new guards, we completely reinvented our SDK configuration API — and ended up building something profoundly flexible and capable. Our new configuration API enables us to support an infinite number of Guard instances in memory at any given time, supporting every conceivable need a developer might have for their application’s authentication needs — which is particularly important for Octane applications.

Our goal with the new configuration API was to simplify the integration experience dramatically, taking a sometimes lengthy explanation process involving application configuration instructions and `.env` file editing down to just a few error-proof steps.

What we arrived at was a whole new configuration experience powered by the Auth0 CLI. The CLI is an exciting tool that guides developers in managing their tenants through an elegant command-line interface. It was a perfect fit for simplifying one of the biggest challenges of getting started with the SDK, so we baked in native support for the CLI. Now, the JSON expressed by the CLI can be used to directly configure an application’s Auth0 SDK integration. **For the first time, you can configure your tenant and SDK in a single command.** It’s pretty awesome!


### The Quickest of Quickstarts

We’re always looking for ways to improve a developer’s first experiences with our SDKs, and that all begins with the quickstart. These starter applications demonstrate how a developer can integrate base applications with fully functional authentication as efficiently as possible — ideally resulting in a working app in 5 minutes or less.

Now that we’ve achieved no-code and integrated the Auth0 CLI, developers can do this with their Laravel application in **less than a minute**.

We re-wrote our Laravel quickstarts from the ground up to showcase this new configuration approach and demonstrate these new features, which cut the length of our quickstart in half. We also reworked the GitHub repository so developers can use it as a starting template for new Laravel applications with a single command.

Want a fully functional Laravel 9 application with Auth0 authentication out of the box? You got it!

```
composer create-project auth0-samples/laravel
```

Ready to configure it? Done!

```
./auth0 apps create \ 
--name "My Laravel Application" \ 
--type "regular" \ 
--auth-method "post" \ 
--callbacks "http://localhost:8000/callback" \ 
--logout-urls "http://localhost:8000" \ 
--reveal-secrets \ 
--no-input \ 
--json > .auth0.app.json 
```

You have a ready-to-ship app with completely functional authentication and access control.

## Integration Comparison

Let's compare how you would have integrated Auth0 previously with how you do it today.

### The old-days integration

Previously, you should have started with the installation:

```
$ composer global require laravel/installer 
$ laravel new example-app 
$ cd example-app 
$ composer install 
$ composer require auth0/laravel 
```

Then, you should have created an application in the [Auth0 dashboard](https://manage.auth0.com/)...

![Setup — Auth0 Application Creation](https://images.ctfassets.net/23aumh6u8s0i/4QoFmUwS0wdwyaHrQe5Ynr/444d87da9a8fabb23ad449dbc83de48b/09_-_Setup___Auth0_Application_Creation.png)

...and configured it:

![Setup (Continued) — Auth0 Application Configuration](https://images.ctfassets.net/23aumh6u8s0i/S2eVoxkVBulc96Ei8KrOn/1f2c5d6eedcbea27533337c60ccfd644/10_-_Setup__Continued____Auth0_Application_Configuration.png)

Back to your application, you should have configured it with the Auth0 registration data:

```
AUTH0_DOMAIN="..." 
AUTH0_CLIENT_ID="..." 
AUTH0_CLIENT_SECRET="..." 
AUTH0_COOKIE_SECRET="..." 
AUTH0_AUDIENCE="..." 
```

You should have defined your Guards and provider:

```php
// conflg/auth.config: 
return [ 
    'guards' => [ 
        'auth0' => [ 
            'driver' => 'auth0.guard', 
            'provider' => 'auth0-provider', 
        ]
    ], 
    'providers' => [ 
        'auth0-provider' => [ 
            'driver' => 'auth0.provider', 
            'repository' => \Auth0\Laravel\Auth\User\Repository::class,
        ]
    ], 
];
```

You should have defined your middleware in the Kernel:

```php
// app/Http/Kernel.php: 
use Illuminate\Foundation\Http\Kernel as HttpKernel; 

class Kernel extends HttpKernel 
{
    protected $middlewareGroups = [ 
        'web' => [ 
            \App\Http\Middleware\EncryptCookies::class, 
            \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class, 
            \Illuminate\Session\Middleware\StartSession::class, 
            \Illuminate\View\Middleware\ShareErrorsFromSession::class, 
            \App\Http\Middleware\VerifyCsrfToken::Class, 
            \Illuminate\Routing\Middleware\SubstituteBindings::class, 
            \Auth0\Laravel\Auth\Guard::class,
        ];
} 
```

You should have added support for authentication...

```php
// routes/web.php: 
use Auth0\Laravel\Http\Controllers\fCallback, Login, Logout}; 

Route::group(['middleware' => ['web', 'guard:auth0'], static function (): void {
    Route::get('/login', Login::class)->name('login'); 
    Route::get('/logout', Logout::class)->name('logout'); 
    Route::get('/callback', Callback::class)->name('callback');
    }); 
```

...and optionally configure the application's routing:

```php
Route:middleware('guard:auth0', 'auth0.authenticatel)->group(function () { 
    Route::getr('/messages', function () { 
        return response("You're authorized to read messages."); 
    })->can('auth0.authorize:read:messages'); 
});
```

### Today's integration

With the new SDK, you integrate Auth0 in your Laravel application in two easy steps.

First step, create a new application:

```
$ composer create-project auth0-samples/laravel
```

Second step, configure your application through the Auth0 CLI:

```
./auth0 apps create \
--name "My Laravel Application" \
--type "regular" \
--auth-method "post" \
--callbacks "http://localhost:8000/callback" \
--logout-urls"http://localhost:8000"\
--reveal-secrets \
--no-input
--json > .auth0.app.json
```

Optionally, configure its routing this way:

```php
Route::get('/messages', function () { 
    return response("You're authorized to read messages."); 
})->middleware('auth')->can('readmessages'); 

```

## Conclusion

At Auth0, we never stop innovating, and our SDKs are absolutely no exception. With v7.8, we’ve achieved a powerful no-code integration, an incredibly streamlined configuration scheme powered by the Auth0 CLI, and we now offer our quickest quickstarts ever. We’re proud of our latest Laravel release, but more importantly, we’re excited to see what developers build with it. We wouldn’t have gotten here without the valuable feedback of our developer community, and we’re excited to continue building the future of authentication in Laravel together.


Authentication with Laravel: Raising the Bar with a No Code Future

carla_urrea

I've been working as a software engineer since 2014, particularly as a backend engineer and doing system design. I consider myself a language-agnostic developer but if I had to choose, I like to work with Ruby and Python.  

After realizing how fun it was to create content and share experiences with the developer community I made the switch to Developer Advocacy. I like to learn and work with new technologies. 

When I'm not coding or creating content you could probably find me going on a bike ride, hiking, or just hanging out with my dog, Dasha. 

Senior Developer Advocate

Carla Urrea Stabile

People are saying Ruby is dead, while others use it widely in their companies. Let's dive into the history of Ruby. From its birth to how it's doing today and to what the future holds.

[Ruby](https://en.wikipedia.org/wiki/Ruby_(programming_language%29) is an interpreted, open-source programming language with a focus on simplicity and productivity. **Ruby is already 30 years old**, and it has become one of the most used programming languages. 

Some claim Ruby is dead; others use it widely in their companies. Join me in this blog post as we learn about Ruby's history and where it stands today. 

## How It Started

[Ruby was born on Feb. 24th, 1993](https://youtu.be/gTNC26BtRFc?t=85). This was the day when [Yukihiro Matsumoto](https://en.wikipedia.org/wiki/Yukihiro_Matsumoto), also known as **Matz** and creator of Ruby, decided along with his colleague Keiju Ishitsuka what the name of the language was going to be during a chat conversation: 

```plain-text
matz> Let us decide the codename now
matz> tentative one.
keiju> Ok.  
matz> What is your best up to now?
keiju> I'm content with coral.  
matz> I thought ruby is cool as a codename, isn't it
keiju> Well. Ruby is also good.  
matz> But, coral is also good
matz> arrr
```
<center>*[Extract from the chat between Matz and Keiju back in Feb 1993](https://blade.ruby-lang.org/ruby-talk/88819)*</center>
<br/><br/>

They knew they wanted to name the programming language after jewels, so they were considering *Ruby* and *Coral*. As Matz explains in his talk [Ruby After 25 Years](https://youtu.be/gTNC26BtRFc?t=286), Coral was longer by one character making it more annoying to write multiple times. *Ruby was shorter and more beautiful*.

Matz created Ruby because he wanted a simple object-oriented, easy-to-use scripting language. He added the features he loved the most, such as iterators, exception handling, and garbage collection. 

Ruby is a clean, simple, and powerful object-oriented programming language. There are no curly braces; scopes are clearly defined by blocks, and overall makes you happy to use it. This was, in fact, one of Matz's goals when creating the language:

> "I hope to see Ruby help every programmer in the world to be productive, enjoy programming, and be happy. That is the primary purpose of Ruby language."
&mdash; <cite>[Matz on Ruby 1.9, Google TechTalks 2008](https://youtu.be/oEkJvvGEtB4?t=1795)</cite>

I mean, look at this thing: 

```ruby
class Numeric
  def plus(x)
    self.+(x)
  end
end

y = 5.plus 6
# y is now equal to 11
```

I can't imagine a more beautiful thing 🤩. 

This code creates a new class, `Numeric`, with a `plus` method. Because everything is an object in Ruby, you can call this method with anything, even a number! We do this in the example `y = 5.plus 6`. The `Numeric` class is just a small example of what Ruby can do, but I'm sure it gives you an idea of its power.  

But Ruby has come a long way from the first version to the current one. After naming the language in 1993, `ruby-0.95` was released to the Japanese domestic newsgroups on Dec. 21st, 1995. In 1996 `ruby-1.0` was released, and in July 1997, Matz announced that **he had been hired by [netlab.jp](https://www.netlab.jp/), a Japanese open source company, to be a full-time Ruby developer**. This only helped accelerate the implementation of Ruby, so on Aug. 13th, `ruby-1.1` was released, and on Sept. 22nd, 1997, the first article about Ruby was published. I did my best to find it, but it is not available anymore 😭.

The popularity of Ruby was growing every day in Japan, and as more and more developers started to use Ruby, the first Ruby books were published to support the community's continued learning. The first was "The Object-Oriented Scripting Language Ruby" by Matz himself.

![The Object-oriented Scripting Language Ruby 1999 edition book cover](https://images.ctfassets.net/23aumh6u8s0i/5qtUsDS2rpmpR3AIZABxgc/f06c643901227a3a2fb449223415aba9/amazon-ruby-book.jpg)


In 2000 [Ruby was more popular than Python in Japan](http://ruby-doc.com/docs/ProgrammingRuby/html/foreword.html), and the acceptance and growth of the language were starting. In 2004, a new server-side web application framework was born: [Ruby on Rails](https://rubyonrails.org/). The launch of Rails, together with the fact that [Apple announced that it would ship Ruby on Rails with Mac OS X v10.5 "Leopard"](https://rubyonrails.org/2006/8/7/ruby-on-rails-will-ship-with-os-x-10-5-leopard) helped Ruby to become the [Language of the Year in 2006](https://www.tiobe.com/tiobe-index/ruby/) and to be used mainly for web development. 

Fast-forward to 2016, Ruby reaches the highest position (since 2001) in the TIOBE index at number 8, and its usage is peaking. Between 2013 and 2020, we went from `ruby2.0.0` to `ruby3.0.0`, and the community and the language were more and more mature. 

But where is Ruby now? 

## How It's Going 

Ruby is at version [`ruby3.2.1`](https://github.com/ruby/ruby/releases/tag/v3_2_1) as of the date of publishing this article, and by the end of 2022, there were [2.4 million Ruby developers](https://www.slashdata.co/free-resources/state-of-the-developer-nation-23rd-edition?) out there.

At the beginning of this article, I mentioned that some people say Ruby is dying, and I'm afraid I have to disagree with this statement. Ruby, as technology, still creates value nowadays, which is essential to remember. When technology creates value, it also creates jobs, opportunities, and money. 


Now let me tell you why Ruby is still creating value:

### Ruby lives to its purpose: *programmer happiness*

You can take it from me, or you can take it from [other people in the industry.](https://jetrockets.com/blog/is-ruby-still-alive-in-2023) The reality is programming in Ruby is truly joyful, and if you still need to do it, I highly recommend you try it. 

<div class="alert alert-info alert-icon">
  <i class="icon-budicon-487"></i>
<strong>We have created step-by-step guides to help you integrate Auth0 with your Ruby on Rails application. Check out the 
<a onclick="window.metricsLib.track('from_blog_to_devres')" href="https://developer.auth0.com/resources/guides/web-app/rails/basic-authentication">Rails Authentication By Example</a> and the <a onclick="window.metricsLib.track('from_blog_to_devres')" href="https://developer.auth0.com/resources/guides/api/rails/basic-authorization">Rails Authorization By Example</a> guide, which also covers the concept of <a onclick="window.metricsLib.track('from_blog_to_devres')" href="https://developer.auth0.com/resources/guides/api/rails/basic-authorization#set-up-role-based-access-control-rbac">Role-Based Access Control (RBAC)</a> and let yourself fall in love with Ruby😍.</strong>
</div>

### Ruby is widely used in big companies 🧑‍💻

[Ruby is widely used in the tech industry](https://toprubycompanies.info/) by some of the biggest companies like Airbnb, Shopify, Coinbase, and Gitlab. Some are significant contributors to Ruby's source code and Ruby on Rails. 

### Ruby makes money 🤑

In 2022, Ruby and Ruby on Rails are still listed as [the top-paying technologies](https://survey.stackoverflow.co/2022/#top-paying-technologies) for developers, with a median yearly salary of about $90,000. 

Also, because big publicly-traded companies are using Ruby, [the total market cap of only 46 (!) of them is currently at about $284 Billion.](https://toprubycompanies.info/)

### Ruby has a great community

The [Ruby community](https://www.ruby-lang.org/en/community/) is highly active, and many projects contribute to it. One of them is the [Rails Foundation](https://rubyonrails.org/foundation) which aims to improve the documentation, education, marketing, and events to benefit all new and existing Rails developers. 

Also, Ruby is open source, and everyone can contribute to its development; this also means it can quickly evolve to fit developers' needs in the future. 

## What’s Next?

[Ruby 3.0](https://www.ruby-lang.org/en/news/2020/12/25/ruby-3-0-0-released/) was released in 2020 with many improvements and new features, so the plan to keep improvement remains. 

Some of the improvements, ambitions, and features that Ruby will be working on are the following: 

- **Ruby 3x3**: 
  - It started as "Make Ruby 3.0 run 3 times faster than Ruby 2.0", but it [has been revisited in 2021](https://youtu.be/Dp12a3KGNFw?t=2757) and changed to *"Ruby 3.x will be 3 times faster than Ruby 3.0 "* so we will see more and more performance improvements!
- **Performance**: 
  - Ruby 3.2 adds a lot of performance improvements, such as re-implementing the [MJIT](https://www.rubyguides.com/2018/11/ruby-mjit/) compiler in Ruby and executing it under a forked process instead of using a native thread. 
  - [YJIT](https://github.com/ruby/ruby/blob/master/doc/yjit/yjit.md) is now production-ready, and there will be more performance improvements coming as shown by [Alan Wu in RubyKiagi 2022](https://youtu.be/EMchdR9C8XM?t=1910).
- **Concurrency / Parallelism**:
  - Ruby 3.0 introduced [Ractors](https://ruby-doc.org/core-3.0.0/Ractor.html), an [actor-model abstraction](https://en.wikipedia.org/wiki/Actor_model) that provides a parallel execution feature without thread-safety concerns. Ractors have improved since they were first released and will continue their development to ensure Ruby is more *thread-safe* than ever. 
- **Static Analysis with [RBS](https://github.com/ruby/rbs) and [Typeprof](https://github.com/ruby/typeprof)**: both of these tools were released with Ruby 3.0 are still being improved in new versions. 
  - RBS allows you to add type annotations to your Ruby code in files with a new extension called `.rbs`.
  - Typeprof is a type analysis tool that reads plain (non-type-annotated) Ruby code, analyzes what methods are defined and how they are used and generates a prototype of type signature in RBS format.

## Conclusion 

Ruby is an object-oriented and interpreted programming language created by Yukihiro Matsumoto in 1993. Ruby was quickly adopted in Japan and then expanded to the rest of the world; it gained popularity when the Ruby on Rails framework was released. Ruby has peaked in popularity over the years and remained relatively stable. 

Ruby is still widely used in big companies like Shopify, AirBnb, and Github, which also contribute to the source code and investment and language development. 

Programming languages' popularity and the features that developers seek come and go. A few years ago, developers didn't want to deal with static typing; now, they do, for example. It is hard to predict whether Ruby will become extremely popular, but surely Ruby is still alive, and it will live as long it continues to create value for the community and companies but also while it makes developers happy. 

A Brief History of Ruby

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Extensible building platform for customizable identity enables enterprises to adapt to any current and future need.

**BELLEVUE, Wash. – May 12, 2021 –** [Auth0](https://auth0.com/), a product unit within Okta (NASDAQ: OKTA), today announced the Auth0 Identity Platform, a cloud-native, adaptable platform for development teams. Built with extensible building blocks, the Auth0 Identity Platform enables organizations to manage the complexities of today’s identity management while also prioritizing the security, privacy, and convenience of their end users. 

Striking the perfect balance among these priorities requires identity to integrate a myriad of different services and creates a significant integration hurdle. Identity ecosystem operators can now manage these complex integration needs with the flexibility of full spectrum code (pro-code, low-code, and no code solutions). Customizing to the requirements of different development teams removes their need to focus on identity infrastructure when building differentiated applications. This level of adaptability is a huge benefit for enterprises that are confronted with converging use cases and managing the eroding lines between identity for employees, business partners, and consumers. 

New features that support this adaptability are: 

* **[Auth0 Actions](https://auth0.com/actions)**: An extensibility framework that executes serverless functions on triggers in a highly configurable way to meet the unique needs of each developer. Auth0 Actions offers more tooling and an improved experience to easily extend and customize Auth0, providing development teams with the ability to solve identity problems more quickly.
* **[Auth0 Organizations](https://auth0.com/organizations)**: An enhanced way for enterprise app teams to manage customers and partners in any multi-tenant, B2B, or SaaS application. With Auth0 Organizations, B2B implementations are less complex, enabling faster speed-to-market and a better overall experience for Business Customer Identity use cases. 
* **[Auth0 Identity Maturity Framework (IMF)](https://auth0.com/imf-form)**: An Auth0 tool that visualizes a customer’s entire identity journey. Developed in collaboration with Auth0’s largest customers, the Auth0 Identity Maturity Framework provides a toolkit to benchmark current identity maturity, create a plan for an organization’s identity journey, and visualize how the Auth0 Identity Platform can identify and move practices from good to great.

<br>

“We believe the companies that succeed in the next five years will not only meet but exceed the ever-growing expectations for security, privacy, and convenience,” said Shiv Ramji, Chief Product Officer at Auth0. “Traditional identity platforms are inflexible to customization, which makes exceeding these expectations nearly impossible. The modern identity platform of the future — the Auth0 Identity Platform — is adaptable. An integration bridge, a bridge between use cases, and a bridge for user experience is now critical for accelerating an enterprise’s scale and growth.”  

[Auth0, recently acquired by Okta](https://auth0.com/blog/okta-acquisition-announcement/), believes in solving the breadth of identity needs for every customer and end user. The Auth0 Identity Platform can be the powerhouse of an identity cloud, driving any combination of policies, configurations, full-spectrum code, APIs, and protocols to flexibly address any use case.

Please visit [Auth0 Identity Platform](https://auth0.com/identity-platform) for more details on its capabilities and how its differentiated adaptability can help enterprises better prepare for the future. 

<include src="asides/AboutAuth0" />
### Media Contacts
Global Communications<br />
Auth0 <br />
[press@auth0.com](mailto:press@auth0.com)<br />

Matter for Auth0<br />
[auth0@matternow.com](mailto:auth0@matternow.com)<br />

Auth0 Offers Ultimate Flexibility in Identity Management

ben-dechrai

A technologist with a staunch focus on security and privacy. I love helping developers find the joy of experimentation, and designing unconventional solutions for the purposes of learning something new.

Developer Advocate

Ben Dechrai

What is Developer Day? Developer Advocate, Ben Dechrai, explores the lineup and shares his thoughts from a delegate's perspective.

You’ve probably heard by now that [Okta and Auth0 have joined forces](https://auth0.com/blog/developers-explore-okta-auth0/). As a developer advocate for Auth0, I’m really excited to see how we can combine our forces to make identity even better for the developer community.

You might not be aware that I’m a huge fan of creating events that directly address the needs of developer communities. From the first conference I ran in 2004 to the user group meetings that are still going to this day, you can imagine my excitement when I heard we (Auth0 and Okta) were going to run an online event together!

This time, members of my team are taking the lead, so I'll be in the same boat as many of you experiencing Developer Day as it happens, so I thought it might be helpful to share my thoughts on the event and what I’m looking forward to the most.

Hit up the [community forum](http://community.auth0.com/) if I miss something that’s important to you &mdash; there’s so much for everyone, I’m sure you’ll help others out too.

## What Is Developer Day?

[Developer Day](https://www.okta.com/developerday/) creates a space for all developers to discover how the identity space is evolving, learn best practices in privacy and security, and gain insights from developer experiences. It brings speakers from across these sectors right to your desktop, and best of all &mdash; it’s free!

> Speaking of free, did you know you can also <a href="https://auth0.com/signup" data-amp-replace="CLIENT_ID" data-amp-addparams="anonId=CLIENT_ID(cid-scope-cookie-fallback-name)">sign up for a free Auth0 account</a> at any time? Why not try it out today?

![Developer Day speakers Cassidy Williams, Alyssa Miller, and Kapehe](https://images.ctfassets.net/23aumh6u8s0i/12g1Ga4gP8X04Xn0H0nnFt/5b4ae4b06847a028d9a784a46ec48b26/cassidy-alyssa-kapehe.png)

More specifically, it’s a one-day, single-track, virtual event, and while I’m proud to see some of my colleagues’ names in the speaker list, the lineup also features the likes of **Cassidy Williams** (Director of Developer Experience at Netlify), **Alyssa Miller** (Hacker, Researcher, and Security Advocate), and **Kapehe** (Developer Relations at Sanity.io, and yes, you might remember she used to [work at Auth0](https://auth0.com/blog/authors/kapehe-jorgenson/) too).

## What Can I Learn?

The first place I tend to go when looking at an event is the agenda, and skimming over this one, we’re in for a breadth and depth of information.

The keynote is where the day’s journey starts, and Alyssa’s **updates from the world of cyber security** are sure to offer a great insight that sets the foundation for the day. I’m a huge advocate for helping all developers understand security principles and states of play. Even if you never have to deal with part of it yourself, you’ll always benefit from knowing why something is done and how you’re being protected.

## From APIs to IoT: Live Demos and Security Fundamentals

From there, we meander down a path from securing Python APIs to securing your Home Automation and IoT devices. Personally, I’m a sucker for anything IoT-related, so I’ll be paying attention to this one.

![Developer Day speakers Aaron Parecki and Vittorio Bertocci](https://images.ctfassets.net/23aumh6u8s0i/hd4kE3aQJFlX45nvwu3xF/6496580a2a7c7da50a6591f781035097/aaron-vittorio.png)

Having grown up on YouTube videos (okay, I’m not that young...) about identity from both Aaron Parecki (or as I like to call him, Mr OAuth, but don’t tell him I told you) and Vittorio Bertocci (the man whose identity knowledge is dwarfed only by his magnificent hair), what better than a talk from both of them? The talk will not only cover where we’ve come from, but what the future of OAuth has in store for us.

## Advanced Topics like Verifiable Credentials and Integration with Third Parties

But identity isn’t just about logging in and loading your glamour shot from Gravatar. I just recently learned about verifiable credentials, and wow - it’s such a powerful concept with so many use cases, I just can’t even! The topic deserves its own article, but one example is around payments, and Uchi Uchibeke’s talk is going to be fascinating, to be sure.

![Developer Day speaker Uchi Uchibeke](https://images.ctfassets.net/23aumh6u8s0i/71FxWB7JqseFrDM9mF63Go/bd98bfcda1f9662b1c7de0bfab486599/uchi.png)

Uchi is flanked by demos on integrating Auth0 with NextJS for securing your webapps and Okta with Kong for securing continuous integration, delivery, and deployment. I think this highlights that the team who worked on the agenda really put a lot of thought into the balance between talks that can have immediate benefit to us developers, as well as enough advanced topics to keep our creative juices flowing.

Talking of immediately applicable information, if you want to learn how to validate REST API authentication and authorization, the JFrog talk is for you.

## Authentication in Gaming and Extended Realities

If you thought the IoT talk was a bit out of the box, the Gaming and XR talk might just be in a whole other room! Not literally. I mean &mdash; it’s a virtual event. There aren’t any rooms. There aren’t any boxes either, for that matter. I digress.

I won’t admit to being a huge gamer. I load up Poly Bridge 2 every now and then. Does Minesweeper count? One thing I do know, though, is that the authentication experience in games can be awful, and when you get into any extended reality (XR), well. Let’s not go there.

![Developer Day speaker Nick Gamb](https://images.ctfassets.net/23aumh6u8s0i/2REEADn8ARvYmok2WNAt5O/9185928ac397dced701f3cb2d252e4b9/nick.png)

We’ll let Okta's Nick Gamb go there instead, as he tells us about the propensity for this industry to be targeted by hackers. Follow his advice, and maybe we can all keep playing in the knowledge that our Minedimes are safe. (See &mdash; I told you I’m not a huge gamer.)

## Adding Pixie Dust to Enhance Security

![Developer Day speaker Milecia McGregor](https://images.ctfassets.net/23aumh6u8s0i/2tBAGZHtBlb4Dt1P21WzAS/2cd4c6438265b64c39bb39b89e6945b9/milecia.png)

With two talks left for the day, I’m personally keen to catch Milecia McGregor from Mediavine talk about pixies! Stop it, autocorrect. PKCE! While most SDKs magically hide away much of the implementation, it’s still worth understanding how authentication flows work and how they can be improved. The most common OAuth flow is debatably the Authcode flow, but PKCE makes it even better! Come along to find out how. I’ll be at the front taking notes.

## Closing Keynote

It’s a packed event &mdash; thank goodness there are a couple of breaks during the day &mdash; and we finish with a closing keynote from Cassidy Williams. The agenda teases us with the mere existence of this session, and perhaps we’ll find out more before the event. In any case, I’ll not be missing it.

Tell us in the [community forum](http://community.auth0.com/) what you’re looking forward to the most, and I hope to see some of you in the chat room on the day!

Developer Day Helps Developers Build the Future of Identity

pamela-van-meter

Pam Van Meter is a Senior Solutions Engineer helping solve identity challenges for healthcare and financial services organizations. Prior to Auth0, she was a Systems Engineer at various companies including Duo Security, Aruba Networks, and Juniper Networks.  She has experience in technical training and exam proctoring for multiple vendors and previously worked as an adjunct professor in the Electrical Engineering Department at George Mason University in Fairfax VA.


Senior Solutions Engineer

Pamela Van Meter

Interoperability, liberating patient data, and the identity lynchpin

The delivery of healthcare services has gone through an unprecedented transformation during the COVID-19 pandemic. COVID-19 has accelerated the move to a digital-forward model and elevated trends that were previously slow to be adopted. In addition, the final rule of the 21st Century Cures Act, effective June 30, 2020, implements provisions to “advance interoperability and support the access, exchange, and use of electronic health information”.

Technology leaders in the healthcare industry will drive positive business outcomes by continuing to innovate in ways that meet the demands of consumers while also meeting security compliance requirements. Healthcare companies have an opportunity to leverage the current momentum to capture more market share by providing cutting-edge, secure experiences for patients, providers, payers, and insurance companies.

## Consumer Demands

Consumer habits have permanently changed across industries over the past 18 months. Healthcare companies providing the best digital experiences will be the ones to attract consumers. In healthcare, consumers include the patients themselves, but could also be caregivers, parents, or patient representatives. Consumers are also the medical staff providing care. A digital experience that makes it easy to share data, retrieve lab results, check coverage, pay bills, etc. will make a big difference to all of these kinds of consumers. It’s likely that in healthcare, consumers will follow the best user experience, as they have in other industries.

A [survey](https://www.healthcaredive.com/news/convenience-more-important-to-patients-than-quality-of-care-survey-finds/545365/) of healthcare consumers found that 51% said convenience and access to care are the most important factors in their decision-making. Convenience ranked above insurance coverage (46%), doctor/nurse conduct (44%), brand reputation (40%), and quality of care (35%). Healthcare companies that continue to require patients and providers to use antiquated and disconnected methods to share information with hospitals, specialists, and insurance companies will become less compelling, leading consumers to choose something else. The same applies to providers that stop offering telehealth options for patients. Although the personal experience of an in-person visit cannot be replicated via Zoom, most consumers and providers enjoy having the option when needed.

The intersection of factors such as COVID-19 driving the rise in telehealth services, consumer demand for improved digital access to healthcare data, and recent regulatory mandates creates a shifting technology landscape in healthcare.

## Enabling Patient Control over Data: Interoperability with SMART on FHIR

[SMART on FHIR](https://auth0.com/blog/what-smart-on-fhir-means-for-the-future-of-healthcare/) is an API that facilitates the exchange of healthcare data. It is part of the 21st Century Cures Act certification requirements. SMART on FHIR is built on open standards including HL7’s FHIR, OAuth2, and OpenID Connect. Developers have the ability to write apps that will run anywhere in the healthcare system. The SMART on FHIR Patient Access API and Provider Directory API came into force on July 1, 2021. The Payer-to-Payer Data Exchange is applicable from January 1, 2022.

SMART on FHIR creates the potential for interoperability and will enable patients, providers, payers, and any other healthcare-related organizations to securely share information, giving patients control over their healthcare data. Patients will no longer have to request records and wait to have them mailed or picked up. Patient control over how and when information is shared will lead to a smoother experience for all parties.

## Unlocking Interoperability: Identity as the Key to the Digital Front Door

### ID linking

Identity is the key to the digital front door for any healthcare transaction, and also provides the backbone to securely interconnecting systems. Many users have multiple identities that they use to log in to various applications. Frequently, patients will have to reenter credentials to access every application or portal. This approach is frustrating for patients and increases the risk of phishing attacks and other security breaches. The ability to link disparate identities through a common platform can reduce user friction and increase security.

Centralizing patient identity and providing a seamless SSO experience between all of those identities helps consumers reduce the number of login credentials they need to access their data. Each login attempt can be evaluated for malicious or risky behavior and properly blocked or logged. This protects the user, resources, and the applications or platforms they use. Using this approach creates a patient-focused ecosystem leading to better service and outcomes.

### Managing identity

Many healthcare companies have developed in-house custom solutions for managing identity and access to their applications. This traditional stovepiped approach worked when there were limited numbers of users and much of the data remained in-house. Custom solutions don’t easily scale or integrate with other systems. They also require a significant amount of maintenance and IT costs. This can lead to end-user friction in the form of multiple passwords to manage, an inconsistent experience, and a lack of adoption.

With these in-house solutions, organizations are also responsible for supporting end-users with account management activities, such as password reset and account recovery and handling costly help desk tickets. Poor identity management creates a poor user experience. Automating user account functions, such as signup, password reset, and self-enrollment in MFA greatly reduces friction and inefficiency.

### Data security

Securing patient data should be the top consideration for any solution, yet based on a recent [survey](https://marketing.rsvpportal.com/acton/attachment/3648/f-49df9907-d20f-4de6-87f4-ac7736211d20/1/-/-/-/-/Okta_Healthcare_Pulse_Survey_Whitepaper.pdf?sid=TV2:fx7gELoz4) of 100 healthcare executives, speed was prioritized over security with the move to telehealth during COVID-19. Even more worryingly, 95% of these leaders admitted that confidential patient records are only secured with a password. Providing built-in security features, such as multi-factor authentication, bot detection, breached password detection, suspicious IP throttling, and brute force detection can significantly increase the security posture of protecting critical data. Cyber attacks are increasingly common, and the cost of a breach can be devastating. In addition, new security threats are constantly exposed.

### Secure identity and focus on core competencies

Most healthcare organizations are and should be, focused on their core business pursuits, such as patient care or processing insurance claims. Information security and identity management is not their core business, yet is a critical factor in compliant, secure business operations. Focusing on core competencies while ensuring secure identity management doesn’t mean giving up control of identity management but instead places the responsibility for the technical aspects of identity building and protection in the hands of experts who work with identity every day.

Identity and security are complex and require a particular skill set to ensure that data is properly handled and protected. As the industry moves to meet the compliance requirements for interoperability, this leaves the systems dependent on each other to properly secure and protect user data, including usernames and passwords. Choosing an identity provider that focuses on security as their core business can greatly reduce the burden and risk for healthcare companies.

Auth0 has helped many healthcare customers provide their users with a highly customized, secure, seamless user experience while driving down costs and reducing risk. To learn more, [reach out to the team at Auth0](https://auth0.com/contact-us).

The Future of Healthcare Relies on Adaptation

liz-rivera

At Auth0 I'm responsible for clearly and concisely communicating the value of our CIAM platform. What a great role to be in as digital technologies and applications increasingly become ingrained in our everyday lives. I also oversee the Healthcare vertical, which I'm super passionate about, as digital advances are already recreating the way we receive care.

Senior Product Marketing Manager, CIAM

Liz Rivera

SMART on FHIR is poised to transform data interoperability — here's how it will improve healthcare.

Most health systems know that seamless omnichannel customer engagement (a “digital front door”) is essential in order to deliver the personalized, value-based [healthcare today’s consumers expect](https://www2.deloitte.com/us/en/insights/industry/health-care/consumer-health-trends.html). In practice, however, implementing this digital front door strategy is challenging for [most healthcare systems](https://www.healthit.gov/sites/default/files/page/2021-02/Use-of-Certified-Health-IT-and-Methods-to-Enable-Interoperability-by-U.S.-Non-Federal-Acute-Care-Hospitals-2019.pdf), due to the [fragmented nature](https://www.chiefhealthcareexecutive.com/view/consequences-of-fragmented-healthcare-information-systems) of healthcare information.

The Substitutable Medical Applications and Reusable Technologies (SMART) platform promises to solve these data fragmentation challenges by standardizing how patient data is accessed and shared. And given SMART’s inclusion in the [21st Century Cures Act](https://www.federalregister.gov/documents/2020/05/01/2020-07419/21st-century-cures-act-interoperability-information-blocking-and-the-onc-health-it-certification), the platform will become the standard protocol for accessing electronic health records (EHRs) in the near future.

Below, we explain what SMART means for the healthcare ecosystem and how it will improve both health data interoperability and the value of healthcare technology as a whole.

## What is SMART on FHIR?

[SMART](https://smarthealthit.org/) is an open-source, standards-based [API](https://auth0.com/blog/what-is-an-api-how-apis-work-for-non-developers/) that leverages the [OAuth 2.0](https://auth0.com/intro-to-iam/what-is-oauth-2/) standard to provide secure, universal access to EHRs. The SMART platform builds on the existing Fast Health Interoperability Resources (hence the name "SMART on FHIR").

Together, these two standards contain everything developers need to build applications that will work anywhere within the healthcare ecosystem:

1. **Open standards** for protocols for authentication, authorization, and UI integration that define how to build applications with universal access to EHRs
2. **Open-source tools and libraries** for developers that make it easier to use SMART standards during application development. The platform also offers a free sandbox that helps developers test their apps before deployment
3. **An application gallery** that highlights all of the existing healthcare applications and software that currently uses SMART on FHIR's platform

<br>
The original idea behind SMART was first introduced in [an article](https://www.nejm.org/doi/full/10.1056/NEJMp0900411) in the New England Journal of Medicine back in 2009. With the help of federal funding in 2010, SMART developed into the platform it is today, which is currently used by both [Microsoft Azure](https://azure.microsoft.com/en-us/blog/azure-api-for-fhir-moves-to-general-availability/) and [Apple](https://www.apple.com/ios/health/).

## How SMART Improves Healthcare Interoperability and Delivery

SMART improves healthcare interoperability in the same way standard electrical sockets and plugs simplify the process of powering different devices in your home.

Today, most EHR databases use a proprietary API (their own unique plug and socket configuration). As a result, tech companies have to build a custom connection to each database in order to access medical data. Not only is this costly, but it also hinders the ability of healthcare providers and patients to access their data with the technology that works best for them.

SMART, on the other hand, provides a standard, universal API for accessing EHRs. Any technology built with SMART works with any EHR database that uses SMART as well. As a result, healthcare technology becomes interchangeable, allowing health systems and patients to access medical data on the applications that best suit their needs, rather than only the ones that work with the EHR database they use.

## How Improved Interoperability Improves The Value of Healthcare Technology

Interoperability is valuable for healthcare tech companies because it "ensures \[their\] innovations can be broadly understood and developed," as Dave Pickles, Founder and CTO of The Trade Desk, tells [Forbes](https://www.forbes.com/sites/forbestechcouncil/2019/08/08/interoperability-and-the-future-of-software-development/?sh=2b59504d4767). And since SMART improves interoperability, it also encourages healthcare technology innovation.

For example, SMART decouples the protocols for accessing EHRs from a piece of software itself. So it allows healthcare technology companies to improve their products and services without worrying about how it will impact the way patients and providers access their data. The result is faster development of healthcare applications, which improves the quality of the entire marketplace (and care for consumers) as a whole.

SMART also simplifies app development for tech companies. Developers no longer need to build custom connections to each EHR database — they can develop their apps once using SMART, and those apps will work with any EHR databases built with SMART. As a result, their apps become more useful to a broader audience of health organizations and consumers.

## What SMART's Inclusion in the 21st Century Cures Act Means

The 21st Century Cures Act (passed in 2016) called for the adoption of a universal API that would "allow individuals to securely and easily access structured electronic health information using smartphone applications." The Office of the National Coordinator for Health Information Technology’s (ONC’s) [Final Rule on Interoperability](https://www.healthit.gov/curesrule/) (published in 2020) later named SMART as that universal API.

For [ONC-certified health IT](https://www.healthit.gov/topic/certification-ehrs/about-onc-health-it-certification-program) (primarily government applications), this means SMART's API is now a requirement. However, since the ONC certification program is voluntary for the private sector, SMART's API isn't legally required for companies whose technologies are not used in government applications.

The Centers For Medicare and Medicaid Services (CMS) also includes policies in their regulations “which require or encourage payers to implement Application Programming Interfaces (APIs) to improve the electronic exchange of health care data.” SMART on FHIR is [named as the preferred technical standard](https://www.cms.gov/Regulations-and-Guidance/Guidance/Interoperability/index) for doing so, meaning any health system that accepts Medicare or Medicaid must also adopt SMART.

## SMART on FHIR is a Must For Healthcare Providers

Given the benefits, as well as its inclusion in the Cures Act, adopting SMART is practically a necessity for any health system. For this reason, major EHR players like [Epic, Cerner, and Allscripts](https://smarthealthit.org/an-app-platform-for-healthcare/who-is-using-smart/) are already using SMART.

However, there are only 58 apps listed on [SMART's App Gallery](https://apps.smarthealthit.org/apps/featured) as of the writing of this article, meaning few companies have incorporated the standard into their tech at this time. As a result, SMART adoption could be a sales advantage for some tech companies.

Outside of mandates, early adoption of SMART could also help healthcare tech companies ensure their applications become more widely adopted in the long run. Learn more about utilizing SMART on FHIR's platform, tools, and API [here](https://smarthealthit.org/developer-resources/).

What SMART on FHIR Means for the Future of Healthcare

hunter-jensen

Hunter Jensen is CTO of Permission.io. Having launched his first website in 1998 and his first iOS app in 2008, Hunter has been at the forefront of the software design and development industry for over 20 years. He is a distinguished speaker, author, entrepreneur, and thought leader in the digital world, well-known for leading teams to release best-in-class web & mobile products, including for Samsung, Cisco, Salesforce, Avalara, and many more. Hunter joined Permission as CTO in early 2020 and helped guide the company to a successful launch of multiple digital products.

CTO of Permission.io

Hunter Jensen

Permission.io’s CTO Hunter Jensen on crypto regulation, advice for the crypto-curious, and blockchain

_EDITOR’S NOTE: Crypto (digital currency) is becoming more mainstream with crypto exchange [Coinbase’s IPO splash](https://www.ibtimes.com/whats-next-coinbase-coin-after-blockbuster-ipo-fintech-analysts-weigh-3184496) and the [creation of the cyber yuan](https://www.wsj.com/articles/china-creates-its-own-digital-currency-a-first-for-major-economy-11617634118). Permission.io’s business model uses Auth0 to protect its platform while delivering digital currency in exchange for permission-based advertising. We invited their CTO, Hunter Jensen, to pen a post to share his thoughts on crypto’s future._

Today crypto is highly volatile — investing can be a real roller coaster. But that’s changing. We just saw the first public valuation of a cryptocurrency company, with [Coinbase coming in at $86 billion](https://www.nytimes.com/live/2021/04/14/business/stock-market-today). [Governments are creating digital currency](https://www.barrons.com/articles/central-banks-are-trying-to-muscle-aside-bitcoin-what-investors-need-to-know-51618866586) or at least talking about it. Here’s why I think everyone will eventually be carrying a crypto wallet.

## What Is Cryptocurrency Anyway?

Cryptocurrency is a digital currency issued by blockchain software and regulated by a decentralized set of systems, software, and rules.

Blockchain is really just a decentralized accounting ledger that records transaction after transaction. What makes it interesting is that it's decentralized — in most cases, there's no central authority running it. Blockchain also uses really complex and complicated cryptography and algorithmic mechanisms to be able to verify each one of these transactions. If you believe in the technology, you don't need a bank to be an intermediary to know that the transaction is taking place.

It helps to contrast cryptocurrency with fiat currency, which is issued by a government decree (or fiat) and regulated by a central authority.

Fiat is stable and controlled, which means it works well as a store of value and a unit of account. You can transfer it from one place to another and have it be the same value in both places. If a country prints a lot of money, it risks hyperinflation and depression, but that takes a certain amount of time to happen. Money, as we know it, has been around for thousands of years.

It’s also expensive and time-consuming to do big complicated transactions with fiat currency. If you’ve ever tried to buy a house or send money from the U.S. to a country in Eastern Europe, for example, it can get very tricky and take a long time.

### Crypto pros and cons

Crypto is not without its pros and cons. It's much faster and cheaper and is often anonymous. You don't have to go through a trusted third-party to conduct a transaction. The benefit is that the transactions are generally faster, cheaper, and easier. But the ability to conduct peer-to-peer transactions sometimes relies on that anonymity for illicit purposes. 

Crypto is also extremely volatile. As such, it is not yet stable enough to be a unit of account. It can hold value, but the value will fluctuate dramatically. In the course of the 30 minutes I’ve been working on this post, my crypto portfolio might be down 10%, but it will come back up in another couple of hours. The main difference between crypto and Fiat currency is how it's regulated and how one transacts with it.

Like Fiat currency, cryptos can be listed on an exchange like Coinbase and be bought and sold and exchanged in a similar way to how stocks are bought and sold on the stock exchange. Currently, there are some 4,800 cryptos on CoinMarketCap, and my prediction is that number will keep going up for a while. But you can also issue crypto without listing it on an exchange. Technically it is still a token, but you can’t sell it. This means that it doesn’t have transferable value, only intrinsic value. If you’re getting into crypto, you need to be aware of what you’re really getting. More on that later.

## We Welcome Government Regulation — Really

The first thing that might surprise you about Permission.io and like-minded crypto-based companies is that we welcome government regulation. Right now, it’s the Wild Wild West out here. There’s just not a lot of predictability, which is tough on businesses.

We are seeing major companies like JP Morgan, Visa, PayPal, Tesla, and others with Bitcoin and other cryptos on their balance sheets. But it’s also not clear how a company like [Tesla is going to report Bitcoin on their taxes due to the lack of regulation](https://fortune.com/2021/04/27/tesla-tsla-bitcoin-btc-bet-how-much-has-it-made-elon-musk-profits/#:~:text=Result%3A%20Tesla%20still%20holds%20around%2038%2C300%20Bitcoin%20that%20cost%20%241.329%20billion). (Tesla no longer accepts Bitcoin for purchases, [other car dealers are still accepting the cryptocurrency](https://www.caranddriver.com/news/a36434628/tesla-bitcoin-wont-accept/). In the U.S., in particular, there’s a real patchwork of regulations that can make it hard for companies to comply or even conduct an ordinary business.

But that challenge isn’t making digital currency go away. As I said, the numbers are growing, and governments themselves are getting interested in digital currency. 

The global crypto market’s been estimated at $1.99 trillion according to my latest check of [CoinMarketCap](https://coinmarketcap.com/). China has already created the [cyber yuan](https://www.wsj.com/articles/china-creates-its-own-digital-currency-a-first-for-major-economy-11617634118). The U.K. has formed a task force to explore the creation of [‘Britcoin](https://www.reuters.com/business/finance/uk-launches-taskforce-potential-bank-england-digital-currency-sunak-2021-04-19/).’ In [Latin America](https://www.spglobal.com/marketintelligence/en/news-insights/latest-news-headlines/crypto-s-2020-boom-sparks-interest-from-latam-legacy-banks-61781257), legacy banks are also noting the need for regulation. In the U.S., the Biden administration put former investment banker and crypto professor [Gary Gensler](https://www.investing.com/analysis/secs-gensler-will-spur-next-leg-up-for-cryptocurrencies-market-crisis-ahead-200575268) in charge of the Securities Exchange Commission (SEC). Gensler’s strong opinions on crypto will likely drive clarity through regulation. In the United States, I’m expecting regulation later in 2021 or in 2022.

## Want to Get into Crypto? It’s Not for the Risk-Averse

Think of someone with high-net-worth. If that person has crypto in their portfolio, it’s probably their highest-risk asset unless they’re doing early-stage startup investing. With crypto, only risk something you’re ready to lose. This is not the place to risk your retirement savings. Crypto is extremely unpredictable and volatile. 

But if you’re still crypto-curious, here are some critical pointers:

* **Make sure you’re trading on a well-known and reputable exchange.** There are some dangerous exchanges that might run away with your coin. Make sure you’ve[ researched the exchange](https://www.investopedia.com/best-crypto-exchanges-5071855) for reputation and reliability, and make sure that you can safely trade in your country. Sometimes you might be allowed to buy crypto but then find that you can’t trade it due to your location.
* **Watch out for phishing attacks.** [Phishing](https://auth0.com/blog/phishing-goes-viral-covid-19-themes-in-cybercrime/) relies on tricking users into giving up information that gives malicious actors access to their accounts. While anyone who uses digital systems is a target, crypto can make you a tastier target. Stay up-to-date on the most common exploits. Pausing before you click can protect your coin.
* **Crypto timing is minutes, hours, days, weeks — not years.** When you're trading stocks, you're thinking in terms of days, months, or years. Crypto trading is in minutes or hours — sometimes days or weeks. There are people who are thinking in terms of years, but since crypto hasn’t really been around that long, that’s extremely unpredictable.
* **Trading happens 24/7.** In the U.S., the stock exchange runs Monday through Friday with holidays off. Crypto is 24/7, not a day off — always on. If you’re in the U.S., for example, when you get up in the morning, people in Asia have been trading all night. This can have a big impact on your crypto wallet.
* **Only risk what you’re willing to lose.** Repeating this point because it’s important. This is a highly volatile, under-regulated space. Take care to protect yourself.

## How Secure Is Crypto Really?

Bitcoin itself is incredibly beautiful in terms of how secure it is. Every line of code is wide open, which means that some of the smartest minds in the world have spent years trying to break in and haven’t succeeded yet.

But in the news, you’ve probably seen stories about “the Bitcoin Hack.” Bitcoin didn’t actually get hacked. Companies in the Bitcoin ecosystem got hacked. The [cryptocurrency hardware wallet Ledger](https://www.forbes.com/sites/billybambrough/2020/12/23/massive-hack-exposes-bitcoins-greatest-weakness/?sh=4730b594da7d) exposed data through a vulnerability in their site that exposed their e-commerce and marketing database. So the bad actors got people’s emails, phone numbers, and the last time they visited the site, which made it easy for phishing attacks. 

When you think of everyone using the internet, much of our data is already out there. If bad actors know someone has a crypto wallet, it can make them a focused target of phishing attacks designed to convince folks to give up their private keys.

So while you have a core system — Bitcoin — that is very secure, you still need to secure all the third-party systems that hold information about that data. Securing crypto needs to be like the American banking system — you need to create a strong ecosystem and remain vigilant. It wasn’t that long ago that Americans were dealing with card skimmers when they used their debit cards at the gas station. Banks had to respond by adding chips to cards. Any industry with sensitive data is going to need to remain vigilant.

Like a bank, Permission.io needs to know the true human identity of every single user in our system. We need to be able to transport that identity from system to system and to third-party systems and know that they haven’t been broken into. 

In the traditional banking financial system, you have to go into a branch and show somebody your driver's license and very clearly prove your identity. It's a lot harder to do that in the digital space, but identity management alongside other security measures is completely critical to the infrastructure of the entire cryptocurrency system.

## The Future of Crypto and Blockchain

Three years ago, blockchain was still an experiment for a lot of industries. That’s changed. A supply chain is probably the biggest adopter of blockchain after crypto. We see [Walmart](https://www.computerworld.com/article/3454336/walmart-launches-world-s-largest-blockchain-based-freight-and-payment-network.html) and other companies turn to blockchain to solve challenges. Blockchain’s also in use in the insurance industry, fintech, energy, and medical records. Because blockchain offers an immutable record, I expect we’ll see even greater adoption as the ecosystem of third-party support around blockchain uses continues to expand.

Crypto, like blockchain, is maturing. Recently, [Elon Musk sold off 10% of Tesla’s Bitcoin](https://www.bloomberg.com/news/articles/2021-04-26/musk-tesla-sold-bitcoin-to-prove-liquidity-as-cash-alternative) investment. On Twitter, Musk said he did it “to prove liquidity of Bitcoin as an alternative to holding cash on the balance sheet.” These actions will likely speed regulation. 

Five years from now, I believe we’ll have clear regulation. 

We will see a consolidation of coins. Those that don't have big backing financially and don't have utility will go by the wayside. I believe we will see a lot of national governments issuing their own digital currencies. We’ll have seen a consolidation of coins, and the ones that remain will be a stable way to transact.

In 10 years, I think the average person will start thinking about value in terms of bitcoin. Bitcoin itself will be a unit of account in a store of value.

There are three things that a currency needs to be mature and stable. It needs to be transferable, it needs to be a unit of account, and it needs to be a stable store of value. There’s still a lot of volatility right now, but as crypto matures, I think this is where we’re headed. Crypto will become a bigger part of businesses and governments, and life for average people.

The not-so-hidden bit is that I’m just not so sure that governments are going to be in charge of money for that much longer. The decentralization of economic and financial systems is scary for them. But if governments lean into it, they can make it work. If they fight it, then I believe that it's going to be even more problematic for them for the simple reason that you can’t control a banned currency. Instead, if governments choose to regulate and tax crypto, then the entire system becomes a more stable opportunity for everyone.

For further information, read the complete case study [here](https://auth0.com/case-studies/permission/).

The Future of Crypto

eugenio-pace-new-avatar

Pace co-founded Auth0 in early 2013 with CTO and “brother-in-arms” Matias Woloski while living 7,000 miles apart from each other. Since then, Pace has played an instrumental role in growing Auth0 into a leading identity management company that is loved by developers and trusted by global enterprises. He loves traveling and has visited more than 35 countries for business and pleasure. He currently lives in Redmond, Washington with his wife, two sons, and their labrador retriever. In his spare time, he enjoys the outdoors, rowing, riding bikes, spending time with his family, restoring his 1970 Karmann Ghia, writing his blog, and reading history and philosophy.

CEO and Co-Founder

Eugenio Pace

Okta and Auth0 address a broad set of identity use cases and the acquisition will accelerate the companies’ shared vision of enabling everyone to safely use any technology, shaping the future of identity on the internet



Okta, Inc. (NASDAQ:Okta) announced on 3/3/2021 that it has entered into a definitive agreement to acquire Auth0 in a stock transaction valued at approximately $6.5 billion. Together, Okta and Auth0 address a broad set of identity use cases, and the acquisition will accelerate the companies’ shared vision of enabling everyone to safely use any technology, shaping the future of identity on the internet. 

Auth0 will operate as an independent unit inside of Okta, and both platforms will be supported and invested in. As a result, organizations will have a wider breadth of identity solutions to fit their unique needs. Okta and Auth0’s comprehensive, complementary identity platforms are robust enough to serve the world’s largest organizations and flexible enough to address every identity use case, regardless of the audience or user.  

“Combining Auth0’s developer-centric identity platform with the Okta Identity Cloud will drive tremendous value to both current and future customers,” said Todd McKinnon, Chief Executive Officer, and co-founder, Okta. “In an increasingly digital world, identity is the unifying means by which we use technology — both at work and in our personal lives. With so much at stake for businesses today, it’s critical that we deliver trusted customer-facing identity solutions. Okta’s and Auth0’s shared vision for the identity market, rooted in customer success, will accelerate our innovation, opening up new ways for our customers to leverage identity to meet their business needs.”

“I started my career as a developer,” McKinnon added. “Over the years, I’ve seen developers become more important than ever. They are the ones building every experience on the internet. Auth0’s DNA is rooted in developers, and I’ve always admired their sharp focus and leadership in developer-led identity.”

With continued global market tailwinds of cloud and hybrid IT, digital transformation, and zero-trust security, an identity platform has become one of the most critical technology investments an organization will make. These trends have accelerated over the past year as companies of all sizes and across every industry had to pivot quickly to deliver engaging customer experiences online. Organizations everywhere are rapidly leveraging identity to streamline processes, reduce costs, maintain the highest levels of security, and improve customer experiences to drive business growth. Okta and Auth0 are both committed to delivering innovation and value to organizations navigating those transformations. 

“Okta and Auth0 have an incredible opportunity to build the identity platform of the future,” said Eugenio Pace, Chief Executive Officer, and co-founder, Auth0. “We founded Auth0 to enable product builders to innovate with a secure, easy-to-use, and extensible customer identity platform. Together, we can offer our customers workforce and customer identity solutions with exceptional speed, simplicity, security, reliability, and scalability. By joining forces, we will accelerate our customers’ innovation and ability to meet the needs and demands of consumers, businesses, and employees everywhere.”

Learn more about this announcement: [https://www.okta.com/blog/2021/03/okta-auth0-powering-identity-for-the-internet/](https://www.okta.com/blog/2021/03/okta-auth0-powering-identity-for-the-internet/)


Okta Signs Definitive Agreement to Acquire Auth0

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing.<br/><br/> Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Fintech companies must evolve their identity strategy for the future of banking.



A solid customer identity and access management (CIAM) strategy is a crucial ingredient in successful digital transformation. Over the last several months, many financial services organizations have been forced to recognize that they’re not ready to operate fully online. Features and capabilities that seemed like nice-to-haves in 2019 are being rushed to market in 2020 to meet consumers’ rapidly evolving needs. Delivering a seamless user experience without compromising a strong security posture is the fintech challenge of the moment. 

CIAM is among the best tools for building digital resilience and strengthening online banking security. [Auth0](https://auth0.com/) CEO and co-founder [Eugenio Pace](https://www.linkedin.com/in/eugeniop/) and [IMDWORKS](https://www.idmworks.com/) founder and CEO [Paul Bedi](https://www.linkedin.com/in/paulbedi/) talked with Nick Holland of Information Security Media Group (ISMG) about the role of CIAM in helping banks adapt to our new remote reality and what this means for the future of banking.

## Banks Must Change How They Interact With Customers

Life for most people has changed radically over the last several months, and we’ve reached an inflection point where we’re appraising and challenging established systems and procedures. Put plainly, banks, and fintech companies must change how they interface with their customers. 

**“The way that banks interact with their customers will evolve massively.” &mdash; Paul Bedi, Founder, and CEO of [IMDWORKS](https://www.idmworks.com/).**

For instance, [telehealth](https://auth0.com/blog/how-coronavirus-is-changing-telemedicine-forever/) has gone from an occasional use case to the new default for many types of healthcare. This shift has accelerated the pace of innovation as health systems and technology providers work to redesign their products and procedures for a new system of care.

The COVID pandemic has also created new opportunities for fraud and data theft, raising the security bar even higher. [The Federal Trade Commission](https://www.cnbc.com/2020/04/15/americans-have-lost-13point4-million-to-fraud-linked-to-covid-19.html) reports that Americans have lost more than $13.4 million to COVID-related scams since the beginning of 2020. Meanwhile, [VMWare noted](https://searchsecurity.techtarget.com/news/252481832/Ransomware-attacks-see-148-surge-amid-COVID-19) an alarming 148% surge in ransomware attacks between February and March 2020, along with a 38% increase in the number of cyberattacks in the same period. It’s never been more critical to leverage CIAM to seal up the cracks and ensure your identity strategy is sound. 

### Enable Contactless Transactions

To establish a financial relationship, people used to bring proof of their identity into a brick-and-mortar bank and show it to a bank employee. Before 2020, Millennials’ preference for online banking over in-person transactions was already driving the industry towards developing better remote capabilities, but the pandemic has accelerated this shift. Financial institutions must be able to authenticate customers remotely: not just when they are accessing an established account via ATM or mobile app, but also when they are first launching their financial relationship. The cost of face-to-face interactions, whether measured in terms of public health or time optimization, has risen.

In general, a trend toward contactless transactions has become apparent. When we ordered a takeout dinner in 2019, we met our delivery driver at the door as they handed over our eagerly-anticipated meal. Now food delivery services leave our orders outside the front door and text us because neither party wants to be exposed to unnecessary risk — and because we have the technology to enable us to neutralize that risk.

Other everyday procedures such as notarization, which traditionally involves a face-to-face interaction, analog signatures, and a physical stamp, need to evolve to match the current situation. Because of pandemic-related travel barriers, pace points out, and demand is growing for technology that facilitates international transactions and interactions. It’s no exaggeration to say that we are in the process of reimagining and rearchitecting the entire technological infrastructure upon which we’ve built our lives and livelihoods.

### Earn Customer Trust With User-Centric Security

People have faith in physical banks, Holland suggests because they can see the vault and the teller; there are powerful visual clues that the bank is secure, inviolate. The structures for cultivating and reinforcing this same level of trust in online banking security need to evolve.

A data breach has a devastating impact on customer confidence. [IBM reports](https://www.ibm.com/security/data-breach) that the average data breach costs $3.92 million — of which 36% ($1.42 million) is the direct result of lost business. [A 2019 customer survey from Ping Identity](https://www.pingidentity.com/content/dam/ping-6-2-assets/Assets/Misc/en/3464-consumersurvey-execsummary.pdf) found that 81% of respondents would stop engaging with a brand online if there were a data breach, while 25% would stop engaging with the brand across all channels. 

Bedi advocates for fintech companies embracing public, user-centric security policies and guaranteeing the security of user data across online and mobile apps. “The onus is on you, the company, to protect them, the users,” he says. He urges banks and financial services to consider establishing a contact center staffed with knowledgeable people who can help customers troubleshoot and resolve fraud issues. Now more than ever, Bedi suggests, people want to place complete trust in their financial institutions; they want the reassurance of guaranteed security and genuine accessibility.

## Balancing Security and UX Requires a Fresh Authentication Approach

Maintaining a strong security posture without creating friction that drives users away is a perennial challenge. This is especially true with fintech companies and banks: They operate under heavy regulation, and their top priority is protecting user accounts. Their user bases, meanwhile, often vary wildly in terms of technical sophistication, so the authentication function must be low-friction to avoid confusing, frustrating, and ultimately losing customers. 

### Lose focus on UX and lose 32% of your users

The impact of a cumbersome user experience is easy to dismiss, especially when it’s so important to [protect customer data](https://auth0.com/blog/data-privacy-vs-data-security-why-your-business-needs-both/) (not to mention a legal requirement across 65% of the globe). But bad experiences for users translate directly to lost revenue for you. [PwC found](https://www.pwc.com/us/en/advisory-services/publications/consumer-intelligence-series/pwc-consumer-intelligence-series-customer-experience.pdf) that almost a third of customers will abandon a brand they like after just one negative experience. That’s why it’s crucial to balance high security standards and a smooth customer experience. 

Bedi argues that achieving this balance means making the security paradigm completely invisible to users. In other words, making the systems and processes involved in verifying and managing identity so seamless that the user scarcely registers them. “That’s when you know you’ve succeeded [with CIAM],” he says.

### Put authentication decisions in context

A primary consideration in balancing security and user experience, says pace, is a keen understanding of the context in which interactions are happening. Situations with different levels of risk demand different levels of authentication. For instance, just checking an account balance might require a lower level of authentication than making a transfer. When a user attempts a higher-risk action, they’re prompted with an additional verification step, like multi-factor authentication (MFA) or a [CAPTCHA](https://auth0.com/blog/reducing-the-impact-of-credential-stuffing-attacks/).

Authenticating based on context also involves looking at what time of day a request was made, from what location, and using which device. Historical behavior patterns also come into play. For example, if you always pay your bills on Monday evenings from your laptop at home, a smartphone login in the small hours of Saturday morning from an unexpected location might trigger an additional verification step, because there’s contextual evidence that you are not the one making the login request. On the other hand, a Monday evening request from your living room might not require that additional authentication — and demanding it might create sufficient friction to drive you, the user, to another bank.

Pace explains that the security world has tended to view authentication in binary terms: a user is either authenticated or they’re not. Fortunately for today’s use cases, modern CIAM technology is sophisticated enough to evolve systems to evaluate all of these contextual factors when making decisions. Requesting different levels of authentication depending on context allows fintech companies to maintain high security standards without pestering the user for authentication every time they turn around.

## The Bank of the Future Isn’t Just a Bank

No one has a clear idea of what the future of banking will be, but what is clear is that many features will remain digital. Even once it’s possible to do more banking face-to-face, plenty of customers will still prefer to bank remotely. A hybrid structure is how fintech companies will thrive going forward. 

In a post-pandemic world, real-life interactions will incur a new kind of value, and this certainly applies to financial services companies. One possibility Bedi raises is that banks will transform into offshoots of the community. Like [Capital One Cafés](https://www.capitalone.com/learn-grow/money-management/explore-capital-one-cafes/), banks might leverage their real-estate assets by opening common spaces where people can transact business face-to-face — adding another layer of value to the banking experience. Another possibility is that banking locations could become remote call centers for customers with the kinds of questions that would once have been addressed in person. 

Bedi’s predictions largely align with how pace sees banks evolving in the near future. “The emphasis will be on relationship-building,” he says. In order to keep customers coming through the doors, banks will have an opportunity to deliver value users can’t get online. A bank branch could, for instance, proactively reach out to local customers who qualify for a higher line of credit or a lower interest rate on their mortgage, instead of waiting for customers to seek out their services.

## The Future Calls for CIAM

Ultimately, no matter what new revenue streams financial companies discover in the course of hybridizing their structures, both customers and vendors will be pressuring banks to digitize more fully. A sound CIAM strategy clears the way to next-generation UX without increasing the security risk to customer accounts.

<include src="asides/AboutAuth0" />


How FinTech Benefits From IAM

0cd73f2f2f39709bd03646e9225cc3d3?s=200 avatar

0cd73f2f2f39709bd03646e9225cc3d3?s=200

I’m an engineer with a passion for building frictionless products. I’ve built effective teams and have grown them into successful engineering organizations. I like to forge a culture.

CTO and Co-founder

Matias Woloski

A company retrospective and future vision from Auth0’s CTO and Co-Founder.



Last week we had our annual offsite in Cabo, Mexico where we shared with all the Auziros where we come from and where we are going with our product. Yesterday, we [announced our new funding](https://auth0.com/blog/auth0-closes-103m-in-funding-passes-1b-valuation/) and I wanted to share some of the same things we talked about last week.

<include src="TweetQuote" quoteText="A company retrospective and future vision from Auth0’s CTO and Co-Founder @woloski"/>

## The Beginning

When we started Auth0 in 2013, there were three important shifts developers were going through related to authentication and authorization:

1. Identity becoming the ultimate firewall with software deployed in the cloud and widespread smartphone usage, and consequently, richer API emergence

2. Developers picking best-of-breed platform and languages

3. Password and data breaches becoming a much more prevalent threat 

Suddenly, implementing your own authentication and authorization layer was not a great idea. Developers were confronted with software deployed anywhere; the user identity flowing throughout multiple services written in different languages/platforms; and the need to implement best security practices to prevent a breach.

## Developer-First, Simple, and Extensible

Given the challenges inherent to building authentication and authorization, our strategy for the first few years was to build a platform for developers that would provide a simplified layer on top of this complexity. At the same time, when we started serving our first enterprise customers, we had to deal with last-mile integration issues and the need to customize the platform for their specific requirements. That was the driver to implement Webtask, our serverless runtime that provides built-in extensibility, in 2014 (even before AWS Lambda was a thing).

![Auth0 first strategy was to build a developer-first identity management solution.](https://images.ctfassets.net/23aumh6u8s0i/4W7Vw30Gsgjo1355FYo0ql/509d30f885700cbf858adcff6f32e7ce/developer-first-simples-and-extensible)

Our very first homepage had a clear message about making identity simpler for developers.

![Auth0 makes clear that one of its goals is to make identity simpler for developers.](https://images.ctfassets.net/23aumh6u8s0i/4RuNdazcERtfTw4or0eu85/6c722eeb8885af6af361697148647b3a/identity-made-simple-for-developers)

We spent a great deal of time building our resources and documentation for developers, not only for Auth0-specific usage but for identity topics in general. We found that there was a huge gap in knowledge, especially with the pace at which cloud computing was evolving, and the need for identity was increasing exponentially. We genuinely wanted to help developers. 

After six years and thousands of articles, quickstarts, and guides, our blog is now read by more than 700,000 developers monthly around the world. From this number, 17,000 of them sign up for a trial every month.

![After six years, Auth0's blog is now read by more than 700,000 developers monthly.](https://images.ctfassets.net/23aumh6u8s0i/4e79DMnoySjkThE4LpSWiU/8ec489eb763eb597980b099430a7768b/700000-developers)

As we have dedicated the last six years to also continually improving our identity platform, one constant has been keeping it developer-centric and relying on our proprietary extensibility capabilities to service our customers’ every identity need. It is this simple, yet powerful, last-mile customization capability that makes us stand out. And it’s evident that our customers take advantage of it, with almost *87% of them extending our platform* using serverless [rules](https://auth0.com/docs/rules) to achieve pretty much any use case you can think of.

![87% of Auth0's customers extend the platform by using serverless rules.](https://images.ctfassets.net/23aumh6u8s0i/2ewezukUfH9V5ev9cZzDYd/e7a557d16b8ce18cdc7d440df93427e5/87-percent-of-auth0s-customer-extend-the-platform)

## Scale, Trust, and Enterprise Readiness

When we raised our [Series A in 2015](https://auth0.com/blog/another-big-milestone/), we knew we had found our product market fit. We started to see more and more traction in the enterprise and were turning into a "real" company. With more enterprise customers needing our services and signing on as customers, we had to scale our product and organization.

Our focus then turned to scalability, trust and compliance, and enterprise readiness:

![Auth0 is also focused on scalability, trustworthiness, and enterprises.](https://images.ctfassets.net/23aumh6u8s0i/3LiWhgKqDmgAWiwh2KLxfg/d8154a6ae0a74e00782408768f2515e7/scalable-trustworthy-and-enterprise-readiness)

Midway 2019, Auth0 is a world-class platform that helps developers, administrators and end users to do their job simply and effectively, while offering unparalleled extensibility at every stage of the authentication and authorization lifecycle.

![Inside the Auth0 engine](https://images.ctfassets.net/23aumh6u8s0i/7Hjjueo0hs8FVorgfHytTi/b7620e17df28df15cd2f66c71365316d/inside-the-auth0-engine-low-res)

[Download the high resolution image here](https://cdn.auth0.com/blog/auth0-raises-100m-to-fuel-the-growth/inside-the-auth0-engine-high-res.jpg)

On the scalability front, we’ve had to go from 300 logins per second to 3,000. Today, we handle 2.5 billion logins per month, and have tens of million users registered, securing hundreds of thousands of applications.

![Auth0 is currently handling 2.5 billion logins per month.](https://images.ctfassets.net/23aumh6u8s0i/5JcN6MNxhW5CCb6S9WCDUC/9ff45507ee29a08be4928e604eb75f71/2-point-5-billion-logins-per-month)

On trust and compliance, we’ve grown our Security and Compliance teams and have achieved important certifications, such as ISO 27001 and 270218, SOC 2 Type 2, HIPAA, and PCI.

![Auth0 achieve important certifications, such as ISO 27001 and 270218, SOC 2 Type 2, HIPAA and PCI.](https://images.ctfassets.net/23aumh6u8s0i/5bNX1VaqkT6F1k02tsSG9U/c607cadac61e75f6b5c00ae05312f82b/auth0-certifications)

We made our product enterprise-ready, providing our customers with management tools like our Account Center; developing our Professional Services teams to help customers with the most complex scenarios implement even quicker; we started partnering with System Integrators and other developer-led companies like Twilio, Sendgrid, AWS, and others. 

![Auth0 made the product enterprise-ready, providing customers management tools and partnering with system integrators.](https://images.ctfassets.net/23aumh6u8s0i/3WqAAUjyBoisXLmhlrcMRH/58f22ea6bebc0515b643272154a8dcb2/auth0-partners-and-services)

In these six years, we’ve created a new category: a developer-first identity platform that is simple to implement and easy to extend. On top of that, we scaled it and made it trustworthy. So, what comes next for us? 

## Our Vision

Since our inception, we’ve always believed in a single platform to solve all Identity and Access Management (IAM) requirements. We take a very different approach compared to what traditionally has been done in this industry. Developers, the "makers" of this new world, appreciate building blocks that are simple to integrate but that can adapt to different situations.

When we think about how our platform evolves, we want to take the simplicity and flexibility we’ve built for the developer to a new level. Providing end-to-end workflows for the different actors using our software:

![Auth0 focuses on different actors, like end users, security teams, and administrators and IT professionals.](https://images.ctfassets.net/23aumh6u8s0i/1S43nIErK2EYrEYKuB1SoD/08b241acac6544ea5c554bffb2a7bf1e/end-to-end-solution-to-different-personas)

- **End Users**: We are all end users of software on the internet. But many idiosyncrasies happen with authentication, mostly because developers are choosing between optimizing between user experience and security as a zero-sum game. We are creating a platform that unlocks this dependency allowing you to increase BOTH. Rather than forcing users to log into applications every single time they want to use them, we enable developers to improve the overall experience and keep customers secure at the same time. Previously, only large companies with extensive resources, with hundreds of dedicated engineers were able to achieve that perfect balance. We aim to democratize this and make it available to all developers in the world.

- **Security teams**: Every company is a software company, which makes hiring security experts more and more challenging. CISOs are looking for ways to automate their jobs as much as possible with the end goal of protecting users’ security and privacy. We want to provide them with a single pane of glass that alerts them and self-remediates any sort of attack.

- **Administrators and IT Professionals**: IT departments and business support comprise the backend of IAM. Their day consists of keeping all systems humming, often amidst a relentless barrage of inbound help desk tickets. They have to deal with things like getting audit logs for compliance, onboarding users to new applications, updating a SAML certificate that might have expired, assigning permissions to access an API, resetting the MFA of someone who lost their device, etc. Now, multiply that by the number of users and applications they have to deal with, and you can understand why it can be gruesome. We can decentralize and automate this work by providing out-of-the-box integrations and self-service tools to create an ecosystem where developers can easily implement those to reduce the resources and costs involved in fielding these requests.

We are building a single platform consisting of building blocks and out-of-the-box customizable experiences to solve use cases for all these people. Our vision is to **provide people with secure access to any application in one-click or less**.

<include src="TweetQuote" quoteText="Auth0's vision is to provide people with secure access to any application in one-click or less."/>

## Our Guiding Principles

The one thing that stays constant, as we deliver on this vision, is our guiding principles. Providing a developer-first, simple, and extensible platform, is what makes Auth0 unique. Those differentiators lay on top of two foundational principles that we developed over the years: our scalability and trustworthiness.

<AmpContent>
![Auth0 product pillars](https://images.ctfassets.net/23aumh6u8s0i/4Ix2H1Un4Xx554OT6ID7R9/166b92f3f94d19e39c3e645841d97f91/auth0s-story-and-future_auth0-product-pillars)

</AmpContent>

<NonAmpContent>

<script src="https://fast.wistia.com/embed/medias/psvyqnp9dx.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><p><div class="wistia_responsive_padding" style="padding:75.0% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_psvyqnp9dx videoFoam=true autoPlay=true endVideoBehavior=loop" style="height:100%;position:relative;width:100%"><div class="wistia_swatch" style="height:100%;left:0;opacity:0;overflow:hidden;position:absolute;top:0;transition:opacity 200ms;width:100%;"><img src="https://images.ctfassets.net/23aumh6u8s0i/7xBl2sBiAff9Mk3vHjsvMn/543966d15bf3155eb8c9c095d09eae3f/swatch" style="filter:blur(5px);height:100%;object-fit:contain;width:100%;" alt="" onload="this.parentNode.style.opacity=1;" /></div></div></div></div></p>

</NonAmpContent>

When we think about solutions to the jobs these people above have; when we are answering a question to a customer; when we write a blog post; the whole product think about _simplicity_, _extensibility_, _developer-first_, _scalability_, and _trustworthiness_. If we are not holding the bar high on these principles, we want you to keep us accountable.

## What’s Next

The new funding will give us more fuel that will be used to accelerate investment in all areas. To accomplish the vision we have, we will: grow our Product Engineering teams; continue to invest in our developer-led go-to-market strategy with our Marketing teams; continue to invest in our global expansion to sell our product everywhere; and continue to grow our security, trustworthiness, performance, and scalability practices. 

![What's next for Auth0 after this funding?](https://images.ctfassets.net/23aumh6u8s0i/2yCB5Bu68m5rh1ihfAGgLi/b2e0ef7fd286c93957d9b3e257abdbe3/103-investment)

We are so thrilled with the support we have experienced thus far. With continued growth and global expansion, our mission and reason for existing will remain unchanged – to help developers innovate faster.

If you identify yourself with our vision and mission (and our [culture](https://auth0.com/blog/our-culture-and-values-at-auth0/)), please, go ahead and [apply to join us](https://auth0.com/careers)!


The Developer-First Identity Platform – Auth0's Story and Future

bruno-krebs

I am passionate about developing highly scalable, resilient applications. I love everything from the database, to microservices (Kubernetes, Docker, etc), to the frontend. I find amazing to think about how all pieces work together to provide a fast and pleasurable experience to end users, mainly because they have no clue how complex that "simple" app is.

R&D Content Architect

Bruno Krebs

Project Amber incubates smaller, productivity-oriented Java language features that have been accepted as candidate JEPs. Take a quick glimpse of the features that will arrive on the platform soon.



Recently, [Java changed its release cycle to a more rapidly cadence](https://www.forbes.com/sites/oracle/2018/03/20/what-java-10-and-javas-new-6-month-release-cadence-mean-for-developers/#7ed00d4a271a), affecting the way the language evolves overtime. With this new cadence, features can now reach the market faster. Besides that, this cadence enables the community to work on (and deliver) smaller features instead of expending all their energy on the big changes (e.g., lambda, generics, and modules).

Throughout the next sections, you will learn about Amber, the project that incubates small, productivity-oriented Java language features.

<include src="TweetQuote" quoteText="Stay on top of Project Amber and learn what productivity-oriented @java language features will arrive soon."/>

## Project Amber

Project Amber, [as explained on its homepage](https://openjdk.java.net/projects/amber/), is an effort focused on "exploring and incubating smaller, productivity-oriented Java language features that have been accepted as candidate JEPs under [the OpenJDK JEP process](https://openjdk.java.net/jeps/1)." At the time of writing, this project has already delivered two enhancements and is planning on delivering five more. Let's learn about these enhancements.

> Not sure what JEP (JDK Enhancement Proposal) means? Check out this article and [learn more about the Java platform and the community process that is responsible for evolving it](https://auth0.com/blog/java-platform-and-java-community-process-overview/).

### Enhancements delivered

The first enhancement already released, called [_Local-Variable Type Inference_](https://openjdk.java.net/jeps/286), was introduced in Java 10 and allows developers to reduce the ceremony associated with writing Java code while maintaining Java's commitment to static type safety. With this enhancement, developers can now declare variables like this:

```java
var list = new ArrayList<String>(); // infers ArrayList<String>
var stream = list.stream(); // infers Stream<String>
```

```java
List<String> list = new ArrayList<String>();
Stream<String> stream = list.stream();
```

The second enhancement, called [_Local-Variable Syntax for Lambda Parameters_](https://openjdk.java.net/jeps/323), was introduced in Java 11 and extends the _Local-Variable Type Inference_ feature by allowing `var` to be used when declaring the formal parameters of implicitly typed lambda expressions. For example, with this enhancement, if you write the following code:

```java
IntStream.of(1, 2, 3, 5, 6, 7)
          .filter((var i) -> i % 3 == 0)
          .forEach(System.out::println);
```

Java will have no problem identifying that the `i` variable is an integer.

### Enhancements being developed

Besides the enhancements already released, Project Amber is planning on delivering _Lambda Leftovers_, _Pattern Matching_, _Switch Expressions_, _Raw String Literals_, and _Concise Method Bodies_.

#### **Lambda Leftovers**

The [_Lambda Leftovers_ enhancement](http://openjdk.java.net/jeps/302) aims at bringing two new features to the Java language. First, this enhancement will allow developers to use an underscore (_) to denote an unnamed lambda parameter. Second, the enhancement will allow lambda parameters to shadow variables already defined in the enclosing context. For example, this last feature will enable developers to write code as follows:

```java
Map<String, Integer> msi = ...

String key = computeSomeKey();
msi.computeIfAbsent(key, key -> key.length());
```

In this case, the inner `key` variable will cause no conflict with the external one (derived from the `computeSomeKey()` call).

#### **Pattern Matching**

The [_Pattern Matching_ enhancement](https://openjdk.java.net/jeps/305) will allow developers to be more concise when dealing with the `instanceof` operator. For example, with this feature, whenever developers want to check if an object is a `String` and use it as such, instead of doing this:

```java
if (obj instanceof String) {
    String s = (String) obj;
    // use s
}
```

They will be able to do this:

```java
if (obj instanceof String s) {
    // can use s here
}
```

By using the new pattern matching feature, developers will reduce the overall number of explicit casts in Java programs considerably. For example, as type test patterns are particularly useful when writing equality methods, instead of having a method like this:

```java
@Override public boolean equals(Object o) { 
    return (o instanceof CaseInsensitiveString) && 
        ((CaseInsensitiveString) o).s.equalsIgnoreCase(s); 
}
```

Developers will be able to simplify the code (and avoid the explicit cast), as shown here:

```java
@Override public boolean equals(Object o) { 
    return (o instanceof CaseInsensitiveString cis) && 
        cis.s.equalsIgnoreCase(s); 
}
```

#### **Switch Expressions**

The [_Switch Expressions_ enhancement](https://openjdk.java.net/jeps/325) will enable developers to use the `switch` feature as either a statement (the _traditional_ way) or as an expression (the _simplified_ version). This change will simplify some code, as you can see on the following code snippets. The first one shows how you would use the traditional `switch` keyword to make a decision:

```java
switch (day) {
    case MONDAY:
    case FRIDAY:
    case SUNDAY:
        System.out.println(6);
        break;
    case TUESDAY:
        System.out.println(7);
        break;
    case THURSDAY:
    case SATURDAY:
        System.out.println(8);
        break;
    case WEDNESDAY:
        System.out.println(9);
        break;
}
```

The second one shows how you would use the simplified version to achieve the same result:

```java
switch (day) {
    case MONDAY, FRIDAY, SUNDAY -> System.out.println(6);
    case TUESDAY                -> System.out.println(7);
    case THURSDAY, SATURDAY     -> System.out.println(8);
    case WEDNESDAY              -> System.out.println(9);
}
```

Pretty nice, huh?

<include src="TweetQuote" quoteText="The new Switch Expressions proposal will allow @java developers to use switch as expressions to write more concise code."/>

#### **Raw String Literals**

The [_Raw String Literals_](https://openjdk.java.net/jeps/326) enhancement will add, as the name states, raw string literals to the Java programming language. This type of string can span multiple lines of source code and does not interpret escape sequences, such as `\n`, or Unicode escapes, of the form `\uXXXX`. Among its goals, the enhancement plans on:

- make it easier for developers to express sequences of characters in a readable form, free of Java indicators;
- supply strings targeted for grammars other than Java;
- and supply strings that span several lines of source without supplying special indicators for new lines.

One good way to see the benefits of this enhancement is to consider what you would need to do to write a long SQL query:

```text
String query = "SELECT `EMP_ID`, `LAST_NAME` FROM `EMPLOYEE_TB` " +
               "WHERE `CITY` = ‘INDIANAPOLIS' " +
               "ORDER BY `EMP_ID`, `LAST_NAME`;";
```

By using _Raw String Literals_ you will be able to rewrite the previous code snippet as follows:

```text
String query = ``SELECT `EMP_ID`, `LAST_NAME` FROM `EMPLOYEE_TB`
                 WHERE `CITY` = ‘INDIANAPOLIS'
                 ORDER BY `EMP_ID`, `LAST_NAME`;
               ``;
```

#### **Concise Method Bodies**

The [_Concise Method Bodies_](https://openjdk.java.net/jeps/8209434) enhancement is all about supporting _more_ concise methods in the Java programming language. The Java 8 version, released back in 2014, introduced what is known as the [_Lambda Expressions_](https://jcp.org/en/jsr/detail?id=335) enhancement. This enhancement, known as Java's first step into functional programming, allowed developers to define methods that do not belong to any class. As such, these methods (which have a very concise syntax) can be passed around as if they were objects and can be executed on demand.

For example, prior to the Lambda Expressions introduction, if you needed to do some calculation and return an integer, you would have to find a class where to define a new method:

```java
public static class Utils {
  public static int calculate(Object someParameter) {
    // ... calculate
    return result;
  }
}
```

After that, you would be able to call this method whenever you wanted, after importing the `Util` class. With the introduction of this new feature, you can now replace all this boilerplate with something much simpler:

```java
ToIntFunction<Object> calculate = (Object o) -> {
  // ... calculate
    return result;
};
```

The code above, instead of belonging to some random class (like `Utils`, on the example), can be written and called right where you need it. This can be considered the first _concise methods_ introduced in the programming language.

Now, back to the _Concise Method Bodies_ enhancement that Project Amber will introduce, when this feature is released, developers will be able to apply this kind of syntax in more places. For example, if you ever did something like creating a method like this:

```java
int length(String s) {
  return s.length();
}
```

In the near future, you will be able to rewrite it like this:

```java
int length(String s) -> s.length();
```

## Conclusion

As you learned in this short blog post, Project Amber is the project that you have to keep an eye on to learn about the productivity-oriented features that will arrive at the Java programming language soon. If you want to stay on top of this, [follow us on Twitter](https://twitter.com/auth0), or subscribe to our newsletter.

<include src="asides/AboutAuth0" />


The Future of Java - Project Amber

How top teams are updating their legacy systems with more secure and efficient solutions.



You used to pay with cash. Then credit cards. Then EMV cards. Now, we’re moving toward things like [cryptocurrency](https://auth0.com/blog/an-introduction-to-ethereum-and-smart-contracts-part-3/) and [biometric authentication](https://auth0.com/blog/tags/biometric-identity/).

Payments and the technology involved in making them are constantly evolving. For example, payment company Square recently added [_Square Register_](https://techcrunch.com/2017/10/30/square-announces-the-register-a-999-point-of-sale-device-for-larger-businesses/) to its hardware lineup. Unlike most of Square’s other equipment, Square Register targets the needs of larger sellers.

![New Square Register hardware that targets larger sellers](https://images.ctfassets.net/23aumh6u8s0i/3cB517ydiTQ1OrJtW1Xcgp/21b12b0ff377b06d77686c542522fb9f/square-register)

At the same time, Mastercard is [_doing away with signatures_](https://newsroom.mastercard.com/press-releases/signing-off-mastercard-moves-beyond-signatures-worldwide/) on the backs of credit cards, and on receipts themselves, in favor of exploring more advanced technologies for identity verification. 

Even PayPal has jumped on the payment revolution by going beyond ecommerce. PayPal now offers customers the option to use their [_PayPal balances_](https://www.tearsheet.co/payments/how-paypal-is-moving-into-physical-retail) at physical retail shops through Android Pay. 

Needless to say, the [_financial services_](https://auth0.com/financial-services) and payments landscape is ever-changing. And a business that wants to remain competitive within its industry needs to look at [updating its legacy system](https://auth0.com/blog/how-do-i-modernize-my-legacy-system/) (or even ripping and replacing it) in order to be more secure, efficient, and compliant with customers’ financial data.

## What’s Inspiring These Changes?

We live in an age of [seemingly constant innovation and advancement](https://www.teampay.co/insights/how-blockchain-will-change-finance/), so it makes sense that payments are following suit.

But there are a few other factors involved in pushing these advancements in payment technology.

One is the uptick of credit card fraud and, as a result, the increasing consumer concern about their security and protection.

![Advancements and the Future of Payments and Payments Processing in 2019](https://images.ctfassets.net/23aumh6u8s0i/2tbJEM41OF7GvxFNduJbpT/1726b2e1900063ee05eb56c52b9a572f/future-of-payment)

Credit card fraud has steadily been on the rise. In fact, the [_financial industry estimates_](https://www.accenture.com/us-en/insight-banking-future-payments-ten-trends) that we’ll reach $31.3 billion in global credit card losses by the end of 2018. Credit card scammers are getting smarter. Today, these fraudsters are capable of not only [_selling credit card numbers_](https://www.businessinsider.com/credit-card-fraud-scam-what-to-do-2018-8) but also identifying information like zip codes. 

Additionally, new [_payment regulations_](https://home.treasury.gov/sites/default/files/2018-07/A-Financial-System-that-Creates-Economic-Opportunities---Nonbank-Financi....pdf) demand an increasing level of transparency and security. To stay compliant, businesses have no choice but to keep up with the changing technology and rules.

## The Future of Payments: 3 Advancements to Be Aware of in 2019

There’s no shortage of changes happening in the payments space. But trying to stay on top of (or even *ahead* of) all of them is a daunting task.

If you're like most companies, you're primarily focused on what you need to know right now. But to remain competitive, you have to stay ahead of the curve. What will payments look like in the future? Here are three burgeoning areas that you should be aware of as you look at updating your own legacy systems.

### 1. Multi-Factor Authentication Will Gain Even More Importance

As concerns over security continue to grow (for good reason), [multi-factor authentication](https://auth0.com/docs/multifactor-authentication) will be of increasing importance for consumers and businesses. 

Traditionally, you could access various accounts by entering a single identifier (think a username or an email address) and a correct password. 

But multi-factor authentication adds another layer to the identity-verification process by asking you to prove your identity in another way — for example, by entering a code you receive on your cell phone or even scanning a fingerprint.

You can think of it as a second security door. Hackers and thieves who are able to make it through the first will have a much tougher time passing through the second.

Because more and more financial and payment data is linked to our personal accounts (your credit card being stored in your Amazon account is just one example), we’ll see multi-factor authentication become the norm more and more. 

Many regions are actually instituting policies to mandate strong customer authentication—like [_PSD2 in Europe_](https://auth0.com/blog/open-auth-standards-psd2/). 

### 2. Point-of-Sale Analytics Will Become Even More Advanced

While the protection of data is an area of primary focus, so is* leveraging* data.

To make more informed predictions about the future, businesses are hungry for any information about what their customers are purchasing. That means we’ll see [_retail analytics_](https://auth0.com/blog/retail-analytics-past-present-and-future/) continue to expand — with an emphasis on point-of-sale analytics. 

Previously, POS analytics were fairly straightforward — they shared what was purchased, and by whom. But today these analytics are capable of reporting on where the item was stored or where it was shipped from and can provide information about inventory and dead stock and even details about the [_customer's identity_](https://auth0.com/blog/digital-success-through-customer-identity-and-access-management/) and their consumption patterns.

As we move into the future, payments are no longer just a one-time transaction with little to no data attached to them. Instead, this important point of contact will become an informative touchpoint for businesses to learn even more about their consumers. 

### 3. User Experience Will Be Paramount

Convenience and ease of use are main areas of focus for today’s customers. They’re no longer writing out checks or counting out stacks of coins—they want the payment process to be as streamlined as possible.

Just look at something like [_ZAPBuy_](https://www.prnewswire.com/news-releases/omnyway-launches-zapbuy-allowing-shoppers-to-buy-products-from-ads-with-a-snap-300425915.html), which was launched by Omnyway in early 2017. The tool allows users to hold their smartphones over an advertisement on any channel and immediately purchase what’s being promoted to them. 

Consumers have a desire to reduce or eliminate friction in the purchasing process, which is fueling this move toward more [_“invisible” payments_](https://www.tearsheet.co/payments/4-charts-that-show-the-coming-autonomous-payments-wave). Think about Uber as just one of many examples. You don’t think about making a payment when you step foot out of that Toyota Corolla—the transaction happens seamlessly behind the scenes. 

![Uber user interface and simple experience for the future of payments](https://images.ctfassets.net/23aumh6u8s0i/5bRmcm4wRgjkEXsWdYrgJz/24020dd49f3fcabbe8d6c24fcd5b69ab/uber)

When today’s customers see a clunky or cumbersome purchasing process, they immediately head in the other direction. Payments are expected to be fast and easy—and that’s an expectation that will only increase as Generation Z makes up [_40% of consumers_](https://www.accenture.com/t20171012T092426Z__w__/us-en/_acnmedia/PDF-62/Accenture-Driving-the-Future-of-Payments-10-Mega-Trends.pdf#zoom=50) by the year 2020.

## What This Means for You: Updating Legacy Systems in Your Business

Change is here for payments, and it’s going to keep coming.

That means it’s time to start looking at [updating legacy systems](https://auth0.com/blog/how-do-i-modernize-my-legacy-system/) related to payments in your business. While your current systems, tools, and software may work for you right now, they might not have the level of flexibility required to keep up in this ever-evolving industry.

Having the right resources in place will make it much easier to stay on top of—and maybe even ahead of—the constant barrage of changes and advancements in the world of payments. 

Wouldn’t you rather do that than fall behind? We thought so. 

<include src="asides/AboutAuth0" />


The Future of Payments in 2019

2b7b341132c3df90155a9914f13b6deb

Former Auth0 Employee

Zach Walchuk

The growing importance of Identity and Access Management calls for a buy plus build future.



Any company with an online presence will, at some point, face the decision of whether to build identity services in-house or have them provided by an external, third-party vendor. In the past, it was possible to [argue for the benefits](https://auth0.com/blog/when-to-build-and-when-to-buy/) of either approach. But recent acquisitions of major Customer Identity and Access Management (CIAM) providers highlight a growing trend: identity solutions are becoming a crucial component in the architecture of many digital businesses, and relying on in-house expertise may no longer be enough to keep up.

## Identity and Access Management’s Growing Importance

Even the most basic user information, if exposed, can be utilized by sophisticated, automated phishing campaigns to gain expanded access to a user’s sensitive data. The number and variety of online security concerns increases daily, and the cost of [data breaches](https://auth0.com/blog/what-is-a-data-breach/) continues to grow. The rise in breaches has triggered an increase in regulatory oversight, including the European Union’s [General Data Protection Regulation](https://auth0.com/gdpr/) (GDPR) and California’s Consumer Privacy Act, making protection of user data a primary concern. The majority of digital businesses do not have the in-house expertise to stay on top of compliance requirements.

For Akamai Technologies, the solution to this challenge was the acquisition of CIAM pioneer Janrain. On Monday, January 7th, [Akamai announced](https://www.akamai.com/us/en/about/news/press/2019-press/akamai-to-add-customer-identity-access-management-capability-to-enhance-digital-trust-by-acquiring-janrain.jsp) they would be integrating Janrain’s Identity Cloud into their Intelligent Edge Platform, providing CIAM services to Akamai’s enterprise clients. With this acquisition, Akamai also hopes to gain more visibility into online customer behavior, which could be used to drive improvements to their bot management and threat intelligence offerings.

Enterprise users of Akamai will benefit from the new capabilities, but it remains to be seen whether Janrain’s CIAM solution will remain a good fit for all businesses. As we discussed with [SAP’s 2017 acquisition of Gigya](https://auth0.com/blog/sap-to-acquire-gigya-whats-next-for-identity-management/), when choosing an IAM provider, it’s important to understand if identity and security are the core competencies of the company. [SAP’s stated goal](https://www.gigya.com/gigya-the-market-leader-in-customer-identity-and-access-management-to-be-acquired-by-sap/) with the acquisition of Gigya was to enrich customer profiles for effective targeting in marketing, sales, and service approaches. This is a different end use than Akamai’s, but the value provided to the acquiring companies and their enterprise customers with the addition of an IAM solution is the same: trusted technologies for establishing a user’s identity and preferences. The value to businesses looking primarily for an identity provider is less clear, as the companies providing these services no longer have an identity focus.

## The Evolution of Build vs. Buy in IAM

For both Akamai and SAP, the build vs. buy decision became irrelevant — through acquisition, they maintained full control of their IAM capabilities without having to build them from scratch. But acquisition isn’t an option available to most businesses.

Luckily, the possibilities are not limited to building from scratch or outright acquisition. Many Identity as a Service (IDaaS) providers offer extensive customization capabilities. This extensibility gives businesses a great degree of control over the look and behavior of their access solutions. Customizations range from simple things, such as [branding the login page](https://auth0.com/docs/hosted-pages/login) to match the company website, all the way to [rules for handling advanced authorization logic](https://auth0.com/docs/rules). A flexible IDaaS solution may also offer options for [integrating with external services](https://auth0.com/learn/go1-adaptable-authentication-service-built-scale/), custom databases, and other identity providers, allowing businesses to maintain existing capabilities while still delivering a seamless customer experience.

These capabilities bring the conversation away from the **build vs. buy** dynamic and towards a **buy plus build** future: buy core Identity and Access Management capabilities from a trusted, independent IDaaS vendor, and build the pieces you need to fit your business. With a buy plus build model, the cost and time required to implement and maintain an identity solution can be [kept to a minimum](https://auth0.com/learn/dashthis-implements-seconds-auth0/) without sacrificing flexibility. And as compliance and security requirements change, IDaaS customers will benefit from updates to the service as a whole, freeing time and resources to focus on business needs.

<include src="asides/AboutAuth0" />

What Akamai's Acquisition of Janrain Says for Build vs. Buy

956290?s=200

R&D Content Engineer

Luke Oliff

Open source is the past, present, and future. Pay it forward by learning how to make your first contribution with Auth0.

A First Timers Guide to an Open Source Project

Auth0 explores the Data-Driven approach to eCommerce and how retail analytics can help you optimize procurement, merchandising, and marketing



Retailers are always fighting for better predictions of what their customers want. From setting price points to predicting next season's trends, [retail](https://auth0.com/retail) has been working to move faster and be more efficient since its inception.

<include src="TweetQuote" quoteText="Retailers are always fighting for better predictions of what their customers want."/>

That's why every retail company has some form of *retail analytics* in place. Retail analytics is data in and around the creation, distribution, and purchase of products. Keeping track of what percentage of your inventory is still in stock would fall under *retail analytics*, but so would data about the efficacy of your new marketing campaign. 

As consumers have adopted device after device and service after service, eCommerce worked hard to create robust methods of tracking and analyzing a flood of new retail data. Retail analytics today is more powerful and more flexible than ever before. For marketers, salespeople, and product people, it is the way forward for eCommerce.

Here's everything you need to know to keep up with *retail analytics* for today and tomorrow. 

## What can you expect from retail analytics?

When something encompasses production through sales, its possibilities seem almost endless. Right now, though, the big uses for *retail analytics* center on optimizing procurement, optimizing merchandising, and optimizing marketing.

### Optimizing procurement

One of the key places that *retail analytics* helps businesses is **optimizing procurement**. By better predicting sales numbers, procurement and stocking gets more efficient. Retailers can also better see the cost balance for a given materials vendor, with more visibility into how the different purchases from a single vendor add up. 

### Optimizing Merchandising

When it comes to merchandising, **product appeal** has always been a huge consideration for retailers. With digital marketing and eCommerce, it's only gotten more important. The color of landing pages, the music in product videos, the packaging that an item comes in when someone receives it in the mail — these things are all important factors that replicate the “in-store experience” for digital consumers. And they're things that marketers are testing to optimize for the most appeal to online shoppers, who have their attention going in 700 different directions.

![Retail Analytics - Optimizing Merchandising](https://images.ctfassets.net/23aumh6u8s0i/1uK9nzv2IQrcWwjlaikcIm/dc37cf9f813f1ed99553591ba78570b3/optimizing-merchandising)

> _"The best packaging [...creates] memorable marketing," [writes](https://www.forbes.com/sites/onmarketing/2014/07/23/the-five-things-product-packaging-must-do/#7cfd6433ac4f) Simon Preece for Forbes._

Another big place that companies are constantly tweaking with the help of *retail analytics* is **pricing**. Companies like [Price Intelligently](http://www.priceintelligently.com/) have made whole businesses off of analyzing how to optimize pricing by digging into data about customers, price points, and pricing strategies. Even companies that aren't outsourcing their pricing strategy are still paying close attention to what their consumer data tells them about how much a customer is willing to pay for their product.

### Optimizing Marketing

The digital age birthed more sales channels than ever before, and now it's rushing to catch up to them. Consumers find their way to products across social media, shopping websites, word of mouth, meatspace ad campaigns, emails, and magazines. To track all of these channels is difficult, but *retail analytics* is getting better at tracking across devices and digital channels to give a better idea of **which ads are working online**. 

<include src="TweetQuote" quoteText="The digital age birthed more sales channels than ever before, and now it's rushing to catch up to them."/>

**Ad targeting** is another area that can be positively influenced by *retail analytics*. As users login with their social accounts for eCommerce sites, see targeted ads on social media, and are retargeted after purchase, more information about their demographics, habits, likes, and dislikes are gathered. This means that *retail analytics* can streamline ad targeting for happier customers and happier marketers. 

![Retail Analytics - Interest Targeting](https://images.ctfassets.net/23aumh6u8s0i/5MDdOkV4JJyYEAzc0bJlRK/a8f4da62b0481e368ed5e11749132960/but-no-one-else-would-trick)

> _[Digitalmarketer](http://www.digitalmarketer.com/facebook-advertising-targeting-options-social/)'s literal ad target shows one way to determine ad interest and reach by using the “but no one else would” trick._

## Trends in retail analytics

Digital retailing has both given a boost to traditional *retail analytics* and allowed companies to create new ways to follow their digital commerce. While companies are going to continue to refine *retail analytics*, the *retail analytics* trends of today are strongly tied to our ideas about multichannel commerce and will likely continue in this vein. 

### Oldies but goodies

Let's start out with some of the “traditional” *retail analytics* that have stood the test of time. These are some baseline heavy-hitters. Where before, people might have tracked these manually, they have now been supercharged by contemporary analytics platforms. 

* **POS analytics.** Point of Sale analytics, or POS analytics, is a broad field that uses the information that relates to the final sale of an item. This started as simply a log of payments and has progressed as sales technology picked up, gaining steam from the mid-1980s onward. Now, POS analytics will cover not just what was purchased and by whom, but also where that item was stored or shipped from, and information about the customer (rewards points, address, email, etc.). Almost every eCommerce system comes equipped with basic POS analytics — [Shopify](https://www.shopify.com/retail/improved-retail-analytics-help-merchants-dive-deeper-into-data-to-bolster-sales) is a great example. 

* **“Traditional” marketing analytics.** Marketing has been around forever, and old-school analytics have made their way over to digital. Tracking the basics of marketing campaigns is easier with marketing tools, and many of them put bells and whistles on basic marketing stats, like ROI on mailing campaigns. Google Analytics or built-in analytics on platforms like Facebook Business often serve as an easy way into this type of data.

### New kids on the block

What's happening in *retail analytics* today isn't just refreshed POS analytics. More data is being collected, which means there's more to dive into. The *retail analytics* trends of today are focused on looking at more micro-level actions or strings of actions that are predictive, rather than simply using analytics to form assessments of marketing schemes or to find macro trends. 

* **Micro marketing analytics.** Digital analytics platforms have allowed businesses a greater window of insight into their marketing analytics. Now, it's easier than ever to look at more micro-level marketing data (like how many impressions a customer needs before they purchase), what items are likely to be purchased together or in subsequent orders, and live updates of A/B testing on campaigns. 

* **Sentiment analysis.** Sentiment analysis is a new way of determining how customers and potential buyers feel about your product. It uses text analysis to determine how your customers are talking about your products on channels from on-site product reviews to comments on your social pages. [Sentiment analysis](https://auth0.com/blog/4-ways-to-calculate-your-customers-happiness) helps predict trends, gauge customer reactions to products and marketing materials, and can be the missing link that explains sales fluctuations.

![Retail Analytics - Social media real time sentiment analysis](https://images.ctfassets.net/23aumh6u8s0i/5rw5l3OakrHAJCvIYKDzZa/ca074dc53bd1d85a277d2ded7e9ad1b7/social-media-realtime-sentiments)

<small>[[Source](https://www.linkedin.com/pulse/introducing-social-media-real-time-sentiment-analysis-debajani)]</small>

* **Omnichannel analytics.** With all of the different platforms available to customers, and all of the paths customers take to purchase, getting a robust view of how your customers are purchasing across platforms and devices is crucial. While some software, like [Sellbrite](https://www.sellbrite.com/ecommerce-reporting/), include multi-channel eCommerce reporting, companies also turn to their IAM to help them stitch together [customer identities](https://auth0.com/blog/the-three-best-ways-to-create-the-single-vision-of-a-customer/) across channels. This can help eCommerce companies build and track brand experiences.

### The future 

Moving commerce online was the first in a series of chain reactions that have opened an entirely new world for retail and marketing. Even though technology and techniques seem to move at lightening speed, the truth is that eCommerce, shopping and marketing analysis, and behavioral analysis of customers has been slow to perfect. While getting targeting capabilities, cart abandonment numbers, and CTR stats has been quick, true customization for retailers, shoppers, and marketers is just beginning. 

* **Better predictions and forecasting.** While companies like [SAS](https://www.sas.com/en_us/solutions/analytics.html#forecasting) are investing a lot of energy into building forecasting capabilities, [predictive analytics](https://auth0.com/blog/predictive-analytics-why-is-it-important/) for retail will get better as more customer data is collected and software is better able to track and integrate that data across channels. Because predictions and forecasting are holistic efforts, as each part of data-rich eCommerce improves, so will these capabilities.

* **More IoT data.** It's no secret that the IoT has more and more [use cases](https://www.interana.com/blog/the-top-iot-analytics-use-cases-today/) as each year passes. More connected devices will mean a better picture of your eCommerce customer and their behaviors. eCommerce is also likely to build its own integrations with IoT devices — think [Farmstead](https://www.farmsteadapp.com/) integrated with your smart fridge — and this will bring a whole new set of data to process. 

![Retail Analytics - The Internet of Things and the mythical smart fridge](https://images.ctfassets.net/23aumh6u8s0i/52FGQ6wdqOVIBaR1GA6569/10ec870dbfa0fec766f9451db849e7cc/mythical-smart-fridge)

<small>[[Source](https://uxmag.com/articles/the-internet-of-things-and-the-mythical-smart-fridge)]</small>

## Getting your data together

The more that eCommerce progresses, the better *retail analytics* is going to get. Right now, companies and platforms have the capability to collect a huge amount of data, but we're still in the process of refining [how to use it](https://auth0.com/blog/all-you-need-to-know-about-data-management-and-integration/). Marketing is getting smarter and optimizations are being made all the time. From startups to the enterprise, eCommerce software is trying hard to figure out the best ways to help companies use customer data.

<include src="TweetQuote" quoteText="The more that eCommerce progresses, the better retail analytics is going to get."/>

For now, you should be looking at a combination of tried-and-tested *retail analytics* and newer approaches to retail data, like putting together cross-channel analytics and predictive metrics. The good news is that things aren't changing quite as fast as we think they are, and there's plenty of time to ramp up your analytics to get ready for the next step in eCommerce business.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.


Retail Analytics: Past, Present, and Future

The future of the web affects everyone, and here's where it could be headed.



Just like a newborn baby, when the internet made its public debut, no one could have predicted just how powerful it would grow to be.

Here we are in 2017 and that little baby has grown to become the most robust and prominent form of information sharing there is. Whether you log on to watch videos, search for news on current events or to find tools to manage your business, it's the go-to place to find knowledge and entertainment.

Net neutrality is what allows for this open access and information free flow. But with the recent push by the Federal Communications Commission (FCC) to repeal net neutrality, this openness could be curbed.

Net neutrality is essentially a battle between service providers and content providers. In one corner, Internet Service Providers (ISPs) like Comcast, AT&T and Verizon want the FCC to roll back rules that dictate how they operate. On the other end, content providers like Google and Amazon are worried freedom of information will be stifled.

In the middle is the public, users of the internet. What does net neutrality mean for us? Will it reduce access to information? Will it change the way we use the internet?

Let's take a closer look at what's at stake for the general public.

## What's net neutrality all about?

Referred to as the [first amendment of the internet](http://blogs.lse.ac.uk/mediapolicyproject/2011/03/30/net-neutrality-the-first-amendment-of-the-internet/), net neutrality is the idea that no matter what type of content you choose to access online, it's delivered quickly and without bias. Meaning, if you're searching for a list of the best restaurants in your neighborhood, all possibilities pop up in the search engine, and not just the ones the service provider wants to promote. With the current regulations in place, ISPs don't dictate what types of content they offer users.

This rule goes back to 2010 when the FCC created The Communication Act Title I. It didn't come with a lot of restrictions, but ISPs pushed back anyway. They didn't want to be told how to operate and felt that the FCC didn't have the authority to enforce the rules. Meaning, an ISP like Comcast didn't feel the FCC had the right to regulate its network principles.

For example, if Comcast wanted to decide network speed for the internet packages it offers users, it didn't feel the FCC had the right to tell them whether they could do that or not.

The push back from ISPs meant that the FCC had to find better ways to regulate online competition. It responded by reclassifying ISPs under the Communication Act Title II in 2015. The idea was to avoid any anti-competitive advantage one ISP might have over another. Meaning, instead of slowing down content created by competitors, ISPs can't discriminate, they have to treat all content equally. This was seen as a bold move for the FCC since the new act includes stricter rules for how an open access internet should be governed.

![Dont block my net](https://images.ctfassets.net/23aumh6u8s0i/3FXiq8ol6cPmQpXTmMelZu/0ecb1f18a84b2494ce95877b8b4624f6/dontblockmynet)
_[Source:](http://www.ibtimes.com/what-net-neutrality-how-fccs-title-ii-open-internet-rules-came-be-2488854)_

At the time Title II was rolled out, FCC chairman, Tim Wheeler [said](https://www.theguardian.com/technology/2017/jul/11/what-is-net-neutrality-threat-trump-administration), “The internet is the most powerful and pervasive platform on the planet.” He continued, “It’s simply too important to be left without rules and without a referee on the field.”

But alas, ISPs like AT&T and Verizon felt the new rules were too harsh and would [slow innovation and investments into infrastructure](https://www.technologyreview.com/s/604292/net-neutrality-rules-may-slow-innovation-but-uncertainty-will-be-worse/). For example, ISPs feel innovation will slow down because they can't come up with new products or services fast enough to meet the changing needs of their users. They were concerned that FCC regulations would dictate what kinds of plans or services they could offer customers and what bureaucratic processes they'd have to follow-through on for new plans and services. For infrastructure investments, some ISPs think that the current regulations make it hard for smaller ISPs to get financing to invest in boosting their network capacity.

While there isn't any proof to back these claims, the current FCC chairman, Ajit Pai, wants to [repeal it](https://www.fcc.gov/restoring-internet-freedom). The reason? He believes that Title II isn't needed for stricter regulation and ISPs can govern themselves.

To be fair, this discussion isn't just about keeping ISPs unbiased. Content providers, like search engines, have been showing paid ads at the top of SERPs for a long time. In a way, this is the kind of thing net neutrality tries to avoid, someone controlling what users see online. Both sides of this battle need some kind of regulation that results in fair play.

The reality is that without net neutrality, Pai's proposal leaves the public at the mercy of ISPs to control website speed, access and cost to view certain websites. In the end, the internet fails to be open and doesn't resemble the place it's meant to be.

## Tech companies aren't the only ones with a voice

This summer, we saw large companies participate in the [Day of Action protest](https://www.battleforthenet.com/july12/). Tech giants, like Google, Facebook, Amazon and Vimeo, tech startups and activists took to the digital streets to protest the dissolution of net neutrality regulation.

On July 12, some posted notes in support of net neutrality while others took a bolder approach and posted pop-ups, like the one below, on their homepages. If control of restrictions is shifted from the FCC to ISPs, pop-ups like this one show:

* What the internet might look like if preferential treatment is given to some content over others.
* If users have to pay to access content.
* If retail companies resort to using tactics that influence what ISPs display.

![Web without net neutrality](https://images.ctfassets.net/23aumh6u8s0i/4mzh9YblhqEqd7PMY1vW62/bca552dff66952d9a0c70394c3a1bd97/webform)

These sorts of pop-ups did a good job of clearly stating what the future of the internet could look like: slow speeds, censorship and extra fees. Tech companies and activists are passionate about this potential change to regulation because these impositions hurt their livelihood and their relationships with their users. Look at China where content that President Xi Jinping and his government don't agree with is censored and monitored very closely. ISPs have the authority to block access to any websites not approved or that contain banned keywords.

Even though tech companies have huge stakes in the game, they don't have the same influence over the FCC as the public does, so the public taking action is key. For example, [Canada](https://www.theglobeandmail.com/report-on-business/rob-commentary/why-canadas-net-neutrality-stance-places-consumers-in-control/article34867805/) “has emerged as a world leader in supporting net neutrality.” They got there by putting the needs of internet users first and not allowing ISPs to dictate access.

This is not just saying yes or no to net neutrality, it's about having an authentic discussion about what's at stake. Look at it this way: [76%](https://blog.mozilla.org/blog/2017/06/06/new-mozilla-poll-americans-political-parties-overwhelmingly-support-net-neutrality/) of Americans are in support of net neutrality. With more than three quarters in favor of it, the general public has an opportunity to go one step further and [do something](https://www.battleforthenet.com/july12/) about it.

There has already been a lot of engagement by the pubic online, but people can email Congress or phone their representative to talk about what these changes mean for them. There has already been over [5 million](https://techcrunch.com/2017/07/13/net-neutrality-day-of-action-spurs-millions-to-speak-out-for-online-freedoms/) emails sent to Congress and over [124,000](https://techcrunch.com/2017/07/13/net-neutrality-day-of-action-spurs-millions-to-speak-out-for-online-freedoms/) phone calls made to representatives.

The Day of Action protest was a way to educate the general public, but the conversation is still ongoing. It's important to voice opinions so that the internet remains fair and open to everyone.

## A level playing field means full access to information

We're living in a digital age that encourages creativity and innovation. Every day a new app, product or process is released. A diverse range of small businesses thrive. People who use the internet enjoy the freedom it offers to explore and dream. An internet without net neutrality stifles the potential for growth if creativity and innovation are cut off.

It's possible that increased latency will have an adverse effect on people who want to start a business. Currently, new businesses have access to low-cost options, like social media, to reach lots of people. This exposure is what eventually leads to their success.

Let's say there are two new startups competing for the same target audience. One is completely independent while the other is backed by a major tech enterprise that has ties to an ISP. Without net neutrality, when a potential customer searches for content related to both startups, an ISP can boost the startup it has ties to over the other one by increasing latency. As a result, users don't see what's most relevant to them.

![ISP](https://images.ctfassets.net/23aumh6u8s0i/7yKgimIDdbKOrtzMcBIbhs/46458bb04035e1be74a7f27817a8849c/isp)
_[Source](http://techminders.blogspot.ca/2015/04/in-future-ispinternet-service-provider.html)_

Or let's say a potential customer wants to search for a specific company or product. Slow speeds or an additional cost to access the content could lead to frustrated users who can't easily access the products they need. This has the potential to hurt SaaS based businesses if customers start to believe that latency is unpredictable. For example, one day a site loads quickly and easily and on another day it takes longer or doesn't load at all.

Something else to consider with latency is [the move from monolith architecture to microservice architecture](https://auth0.com/blog/getting-a-competitive-edge-with-a-microservices-based-architecture/). The monolith approach was attractive because it meant fast builds that got MVPs up and running quickly, especially for startups. But as apps grow in size and complexity, so do coding and architecture requirements. Growth slows down as a result.

Microservice architecture has become a better option because it breaks down apps into individual services which helps developers build out each one separately over time vs. the who app at once. So as apps grow and receive more calls, the flow works better.

Without net neutrality, startups in particular are affected because the bigger they get, they more vulnerable they are to slow latency. Slow latency creates bottlenecks which limit innovation, because different services work together, if one slows down, everything else slows down. Startups already have limited access to the quality of service enterprises enjoy, taking away net neutrality only adds to the disadvantages they face.

If fewer people aren't getting their needs met in the digital space, the potential for innovation drops and we find ourselves back in the early 1990s when [barriers to entry were high](https://www.forbes.com/sites/jpmorganchase/2015/11/03/how-innovation-and-technology-has-lowered-the-barrier-to-entry-like-never-before/#10a4fafe6d6f). Without the tech innovations we enjoy today like various cloud technologies and mobile computing options, it was harder for companies to set up shop. Today, a new business can build a website in a day because of innovation. This is what we need for businesses to run more efficiently.

Without net neutrality, a few large competitors are left with disproportionate control over what people can find, explore, use or sell online. This means a few things:

* The public is left with fewer options and products available to them.
* Companies aren't able to organically grow their success online.
* The internet is no longer seen as the World Wide Web but a more limited version.

That's why it's so important to speak out and explain how net neutrality helps and what the general public stands to lose.

## Make your voice heard

You've probably heard, “Speak now or forever hold your peace,” right? Well, it's true. Without voicing an opinion, anyone using the internet will have to accept the results, whatever they are.

On July 12, [10 million people](https://www.recode.net/2017/7/13/15964766/net-neutrality-protest-day-of-action-2017-data-fcc) saw the protest ads. [2 million](https://techcrunch.com/2017/07/13/net-neutrality-day-of-action-spurs-millions-to-speak-out-for-online-freedoms/) of these people then went on to submit comments to the FCC. But with tech users in the billions, this is just the beginning.

There's still time to have your comments heard before the FCC makes as decision later this year. Before they make a decision, they'll respond to all comments on Aug 30.

Send thoughtful, well-reasoned [comments](https://www.battleforthenet.com/july12/) to the FCC to advocate for what matters to you. There's a lot of information out there about the impact of getting ride of net neutrality but don't just copy and paste what you see online. Give some thought to the impact the rollback will have on you and explain that in detail.

The hope is that comments from the public will be enough to make the FCC take a step back and reconsider their proposal.

## Conclusion

For the internet to continue being a neutral, powerful source of information, its contents and distribution need to remain unbiased and free from third-party interests. 'Neutrality' means giving innovation, creativity, and information-exchange a fair shot. What kind of internet do you want? The power is in your hands.


Why You Need to Care About Net Neutrality

Focus your protection on the most precious assets



It's estimated by the analysts at [MarketsandMarkets](http://www.marketsandmarkets.com/Market-Reports/identity-access-management-iam-market-1168.html) that the total [identity management](https://auth0.com/user-management) market will grow from $8 billion in 2016 to nearly $15 billion by 2021.

In total, it's expected that businesses worldwide are going to spend just over [$100 billion](http://fortune.com/2016/10/12/cybersecurity-global-spending/) on cybersecurity software and services by 2020, up from $73 billion today.

That's about an 8% Compound Annual Growth Rate (CAGR) in overall cybersecurity spending, and about 13% in identity management specifically.

The amount being spent on identity management is projected to increase faster than the amount spent on security as a whole—and that has a lot to do with the growing recognition of how important properly secured, audited and compliant identity management is to preserving network security.  

> Increase productivity, collaboration, efficiency and security in your organization [through consolidated identity](https://auth0.com/b2e-identity-management-for-employees).

## The Problem with Simply Spending More on Security

Just looking at the overall amount of money being spent on network security, you might think that companies are responding well to the increased threat of breaches—and the constant drumbeat of networks being compromised/passwords being leaked that we hear in the news.

But if you look at the increase in spending alongside how those breaches have changed, you start to see a different story. While we're spending more on security, we're also seeing bigger and more frequent breaches take place—[of more sensitive data](http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/).   

In 2005, [137 data breaches](http://www.privacyrights.org/data-breach) were reported by the Privacy Rights Clearinghouse. That number spiked to 783 in 2014, and 1,093 in 2016.

![Data breaches](https://images.ctfassets.net/23aumh6u8s0i/64USaSQyIDmAQN5iwRSnVP/bf8253294d8e5d8061245bca86fbc407/data-breaches)

Simply spending more and more on cybersecurity while the number of breaches grows greater each year—the juxtaposition of these two facts should give you pause. Where, exactly, has all that money been going?

In many cases, it's been going to the same things for years and years. The security budget, while bumped up, has been wasted in exactly the same way over and over again.

As Vormetric's Vice President of Marketing Tina Stewart [puts it](https://betanews.com/2016/03/24/federal-agency-threats/), "Albert Einstein's oft-used quote is fitting -- if doing the same thing over and over and expecting a different result isn't the definition of insanity, it is certainly a recipe for placing our nation’s critical assets at risk.”

## Where We Should Spend Money—the New Firewall

When you look at the attack vectors and consequences of the biggest data breaches [of the last decade](https://betanews.com/2014/07/03/the-top-10-data-breaches-and-how-they-happened/), one thing stands out:

* **Adobe** (2013): weak password requirements abetted exposure of customer data (152 million customers affected)
* **eBay** (2014): employee credentials stolen (145 million customers affected)
* **Target** (2013): personal information exposed (110 million customers)
* **Epsilon** (2011): customer names and email addresses exposed
* **Sony** (2011): names, emails, passwords, and credit cards exposed (77 million users affected)

The people who are attacking these systems are very rarely doing so as a form of corporate espionage. They're rarely (at least not for bigger sites) doing it for ransom, as “hacktivism,” or out of boredom.

They're doing it to gain access to **user identities.** They're often even using one compromised identity to gain access to the entire network of identities that you are responsible for maintaining.

They're doing that to get at sensitive information like names, email addresses, credit cards—but also things like API tokens and secrets that can be harnessed to *find* your users' more precious personal secrets.  

### Why you need risk-based security

![Banks are looking at you](https://images.ctfassets.net/23aumh6u8s0i/3wtf2UcoNUEaYuRHBoSJbS/d198633e268ff2f7e3673154bdb47559/dolar-eye)

Think of yourself like a bank. Customers come and do business with you—you provide them a product or a service, they pay you, and alongside all of this, there's an expectation that you will keep their data—or investment—safe.     

How do you design a bank to make sure you keep the valuables safe?

You don't make people come in through blast doors or get fingerprinted the moment they walk in—that would be insane. You'd make the very act of doing business with your bank extremely unpleasant. Nor would protecting against unauthorized entry *into your lobby* be much good for protecting against the dedicated attacker.  

No—you leave the lobby as it is. In fact, upon walking into the bank, there's very little visible security infrastructure at all. In fact, **you could probably walk right into the secure area if you wanted to**. It would be trivial to get access.

It would be easy to get *to* the safe. What you're not going to be able to do is actually crack it open.

The way a bank's security operates hinges on this idea of risk-based security. The bank knows that people are going to come and try to rob it. They also know that the vast majority of people are not there to rob it. Therefore, it makes sense to build a system that focuses only on [stopping attackers](http://www.delfigosecurity.com/iamblog/security-vulnerabilities/are-we-ready-for-a-poach-breach-mindset), not on building the maximally secure bank lobby.

![Man in the middle](https://images.ctfassets.net/23aumh6u8s0i/3vq86iKFSKYTKIzNGg62DL/0caa53116a1a6f78bc00d1a7a4579e6f/man-in-the-middle)

You can't keep a dedicated criminal from getting into the bank. You can stop them from getting anything of value and leaving with it, though. This is how you should also treat your network security.

## Protecting Your Most Valuable Information

There are many different ways to compromise an account, from exploits to the abuse of features built into programs to social engineering.

Attackers [sometimes go as far](https://medium.com/@botherder/on-the-banality-of-attacks-and-on-mindful-engineering-fc0a50e5cff5#.b2v9n4xe0) as to “befriend victims, impersonate their relatives and co-workers, and create all the pre-conditions to make the attack as credible as possible.”

But the fact that accounts can be compromised from many directions and through many vectors [does not mean](https://medium.com/@botherder/on-the-banality-of-attacks-and-on-mindful-engineering-fc0a50e5cff5#.b2v9n4xe0) “that we should leave all doors open.” As hacker and security researcher Nex says, “Reducing the number of possible attack points allows us to deal and watch for the fewer remaining ones more efficiently.”

Three of the major methods for reducing attack points are:

* **[Multifactor authentication](https://auth0.com/multifactor-authentication/)**: The requiring of multiple authentication stages for users to be identified—can operate through Time-based One-Time Password (TOTP), mobile verification, hardware, SMS, etc. Also, can solely be triggered through context—a new geographic location for login, a specific time of day, or a specific type of network.    
* **[Breached password detection](https://auth0.com/breached-passwords)**: Continuously updating a list of credentials identified as breached, so all user attempts to login or signup with them can be verified as non-breached, and matches can be blocked.
* **[Anomaly detection](https://auth0.com/learn/anomaly-detection/):** Monitoring network traffic and alerting users upon outlier events—logins from new IP addresses or devices, multiple failed login events in a short period of time, using [Tor network](http://lifehacker.com/what-is-tor-and-should-i-use-it-1527891029), and others.

[Multifactor authentication]](https://auth0.com/multifactor-authentication/), [breached password detection](https://auth0.com/breached-passwords), and [anomaly detection](https://auth0.com/learn/anomaly-detection/) are just three of the risk based security features that Auth0 offers customers. But these are the kinds of things that businesses need to be pursuing in this age when breaches are frequent, breaches are significant, and the amount of customer data in the cloud grows larger and larger each day.

## Intelligent and Adaptive Security

Even the most dedicated and advanced attackers can be caught out when the right measures are in place and the right data is being collected—in cybersecurity as elsewhere.

Says security expert [the Grugq](https://grugq.tumblr.com/post/142637754018/elusive-midday-bandit-robs-11th-bank-fbi-patch): If a [small-time robber takes $70](https://grugq.tumblr.com/post/142637754018/elusive-midday-bandit-robs-11th-bank-fbi-patch) one day, and then two weeks later takes $350, and then one week later takes $1000, investigators can infer how much they're spending per day ($50~) and precisely when the next robbery will occur (in 3 weeks~). “If they’ve profiled more, such as his geographic operations zone, and what type of bank he usually targets,” he continues, “They can place assets in the area and be ready for him.”

Risk based security is part of acknowledging the world we live in today. Breaches are going to happen. Attacks are going to happen. Don't hope that the flood will never come—build above sea level, mitigate its effects, and above all, protect what really matters.

> [Give your customers **enterprise identity integration**, frictionless SSO across your products and adaptive authentication with **MFA and Anomaly Detection**. All of this with a flip of a switch.](https://auth0.com/b2b-enterprise-identity-management)


The Firewall of the Future Is Identity

The good, the bad, and the future of Biometric Identity.



If we have any hope of a future with all-around [passwordless, friction-free authentication, it will probably come at the hands of biometrics](https://auth0.com/passwordless).

A biometric identity is the unique physical features of your person that can be used to identify you. The classic example is fingerprints, which have been used to identify criminals since the 1800s. But now, much more than the fingerprint is used to identify people — for less sinister reasons than criminal identification.

And the future only promises more innovation in the field of biometric authentication. From gait analysis to the way you use a computer, biometric authentication still has plenty of room to grow.

## Biometrics of today

There are a large number of biometric options available today, some more used than others. Here's a quick rundown of what's in place and how they're generally used.

## Widely Used

The most widely used biometrics are generally used by the government or large companies to verify your identity. One popular application of biometrics is in border security, where it is used as a way to confirm someone's identity in addition to their passport. Banks and hospitals are also big users of biometrics, in part because they secure large amounts of sensitive data.

Of course, with facial and fingerprint recognition available in many smartphones and computers. Day-to-day, many consumers use biometric authentication habitually, whether it's unlocking one's phone or signing into an app.

Another huge use of biometrics is in law enforcement. While most people thankfully don't come up against this use, it is an extension of the government's ability to store large amounts of biometric data, which is important for its widespread adoption.

### Eyes: Iris or Retina Recognition

An individual may be identified by a scan of their eye, either looking for unique patterns in the iris or vein patterns in the retina. Both are unique to individuals and may be verified against a digital copy. The largest use of iris or retina recognition currently is by governments at border control or to verify benefits recipients. Smartphones with the capability to scan eyes have been released, but fingerprints remain much more common on personal devices.

![Retina recognition](https://images.ctfassets.net/23aumh6u8s0i/45NNDBOYwKZ7b1XbxoEAUs/75c3830e1f764eba131882fe38d6f1dc/iris)

([source](http://www.iritech.com/blog/iris-biometric-safe/))

### Face Recognition

Face recognition is made possible by taking features of the face (ex the distance between eyes) and using those to match a face stored in a database. There are many methods of analysis currently in use for accurate facial recognition, and the field is still developing. Face recognition is widely used by the US and other governments, is available for device login, and is also used by cameras and social sites to identify faces in photographs.

### Fingerprint Recognition
One of the most widely known ways to identify and individual biometrically is with their fingerprint. Everywhere from police stations to border control to your iPhone, you can be identified by the ridges and valleys on the tips of your fingers.

### Other Hand Recognitions
Fingerprints aren't the only unique features of the hand — anything from dimensions of fingers to vein patterns in the palm to a palmprint may be recorded and used to identify an individual. Other hand recognitions are not as common as fingerprints, but are gaining in popularity everywhere from the FBI to hospitals.

![Palm scan](https://images.ctfassets.net/23aumh6u8s0i/1Zj3Cb2vQedCEh04ByR9It/65e19f026a938dd153f7f4ea8bcc5f17/nyu-langone-patientsecure-palm-scan-620)

(Vein matching scan | [source](http://www.cbsnews.com/news/patientsecure-biometric-palm-scan-system-hospital-security/))

### DNA
DNA recognition is probably the only form of biometric authentication on this list that isn't easy to understand, because it relies on the isolation, copying and splitting of genetic markers in our DNA to identify us as an individual. Though widely used and very accurate, from court evidence to paternal testing to gene therapy, it doesn't have the immediacy needed to be used for something like border security.

## Emerging

There are some biometric technologies that are still being refined and implemented, but are already available for use. Among these, voice recognition may be the most widely available, especially in the financial sector, although the development of voice technology still leaves much to be desired.

It remains to be seen if these will become widely adopted, or pushed out of the way by newer technology. Either way, it's possible that you'll one day soon be able to be identified by the following:

### Typing Recognition
Already widely used by Norwegian financial firms, typing recognition identifies individual by their unique habits using a computer keyboard, from key pressure to rhythm of tapping. One company boasted a [99.7%](https://www.hottopics.ht/stories/consumer/dont-go-hacking-my-heart-10-startups-at-the-frontier-of-biometric-authentication/) success rate at distinguishing real and fake users.

### Ear Recognition
You may not know that the human ear is unique to every individual, for we are born with more or less the ear shape we'll have for the rest of our lives. While the technology for highly accurate ear recognition exists and is theoretically ready to use, applications of ear recognition are being refined and tested, and are still not widespread.

### Voice Recognition
From the sound of your voice to the cadence of your breath, voice recognition takes ~[100 datapoints](https://www.theguardian.com/technology/2016/feb/19/how-safe-is-voice-recognition-fingerprint-id-hsbc) from your speech to identify you as a unique individual. It is starting to be implemented in bank security and also by some governments.

## Biometrics of tomorrow

The future of biometrics is likely to try and move towards identifications that are easier and easier for users. Things like gait analysis don't take any real work on the part of the individual, like putting a finger or palm a scanner. They will rely on more powerful technological infrastructure becoming available in public areas, whether that's an easier way to read under-skin chips or better touchscreens for finger writing.

It is, of course, possible that these technologies won't be significantly better than the developments made in our current biometric authentication methods — but there's only one way to find out.

### Gait Analysis
An individual can be identified by a number of data points surrounding their gait, including speed and joint movements. Gait analysis is sometimes used for efficiency of motion in elite athletes, but people are still trying to figure out the best way to implement gait analysis for identification, and what the limits of its applications are.

### Body Modifications (Bodymod)
While certainly not adopted by the masses, people like PayPal's Jonathan Leblanc have [talked](https://www.hottopics.ht/stories/consumer/dont-go-hacking-my-heart-10-startups-at-the-frontier-of-biometric-authentication/) about bodymod as a way to attach unique identification to a person, rather than relying on their underlying biological identity. Could embedding, injecting, or ingesting technology could be the future of authentication? He's not the only one that thinks so — a senior BuzzFeed reporter got a chip implanted in his hand and successfully purchased goods by connecting it to a mobile paying app. Radical? Yes, but also possible.

![Gait analysis](https://images.ctfassets.net/23aumh6u8s0i/17cZlAxCWdOOtGSLq4uLfz/f4ab86a826e31ec15a13eb343b36a7d7/gait-analysis)

([source](https://www.buzzfeed.com/charliewarzel/yes-we-scan?utm_term=.ctLeR0e7ZZ#.hg09LO9Voo))

### Finger Writing
With repeated writing on a touch screen, computers can recognize a “signature” in your finger writing — your unique way of writing without a pen. This data could theoretically be stored and used in any number of ways. For example, instead of punching in a PIN number, you might write a phrase on a screen. Finger writing to date has been given an extremely high level of accuracy, with confidence up to [99.97%](http://resources.infosecinstitute.com/biometrics-todays-choice-future-authentication/#gref).

### Computer Interaction
Like typing recognition, computer interaction relies on the unique way an individual interacts with a computer, from typing speed to common spelling mistakes. It is currently [being developed](http://resources.infosecinstitute.com/biometrics-todays-choice-future-authentication/#gref) at West Point, but there are definitely civilian applications for the tech — imagine if you just had to write a quick email to get through customs or to apply for a visa.

## Are biometrics safe?

Biometrics *are* safe. There are a lot of hyperbolic fears about people who are worried that if they have a cold voice recognition won't work, or that people will be cutting off fingers to get around fingerprint scanners.

Well, remember those 100 datapoints that advanced voice recognition takes? They can determine you are you if you have a cold, and can even distinguish between voice imitators that sound so similar the human ear might confuse them for the same person.

Biometric authentication checks aren't 100% foolproof, but it shouldn't be cause for concern. Unfortunately, there are weaknesses for every system. The weaknesses in biometric systems certainly aren't any higher than those in a username + password system, which we rely on now.

Let's put it this way — nobody is going to make a 3D printed version of your face to fool a scanner, unless you're an *extremely* powerful public figure.

![3D Face Scan](https://images.ctfassets.net/23aumh6u8s0i/2XQianhjwIV5inXu5aqYe5/69cc8f85393509d707a1981fd75d28c4/3d-face)

(Source: [The Memo](http://www.thememo.com/2017/03/02/how-secure-is-your-face-the-worrying-world-of-biometrics/))

If you are a powerful figure, you might want to avoid a total reliance on biometrics to [configure a multifactor login](https://auth0.com/multifactor-authentication) with a complex, unique password and multiple devices involved in login.

Most people simply aren't going to be targets of biometric identity theft, especially as technology gets more sophisticated and takes more and more data into account when making identifications. As it is now, biometric authentication is probably better than having “1234567” or “0000” as your password, anyway.

## Aside: Securing Applications with Auth0

Are you building a [B2C](https://auth0.com/b2c-customer-identity-management), [B2B](https://auth0.com/b2b-enterprise-identity-management), or [B2E](https://auth0.com/b2e-identity-management-for-employees) tool? Auth0, can help you focus on what matters the most to you, the special features of your product. [Auth0](https://auth0.com/) can improve your product's security with state-of-the-art features like [passwordless](https://auth0.com/passwordless), [breached password surveillance](https://auth0.com/breached-passwords), and [multifactor authentication](https://auth0.com/multifactor-authentication).

[We offer a generous **free tier**](https://auth0.com/pricing) so you can get started with modern authentication.

## The bio-future

Biometric authentication clearly has a long way to go before we exhaust its possibilities. From government identification to healthcare to banking, from consumers unlocking their devices to evidence in a courtroom, where biometric authentication isn't the norm, it's likely to become the norm in the future.

With more development, we could sharply reduce the use of passwords, identification documents, and PIN numbers. Biometrics are here to stay — and the best part is that once they're in place, you might never have to remember any passwords again.


The State of Biometric Identity in 2017

1097492785caf9ffeebffeb624202d8f?s=200 avatar

1097492785caf9ffeebffeb624202d8f?s=200

Prosper is a great speaker, community leader, open source hacker, technical consultant, and a fervent Developer Advocate. He is a full-stack software engineer who has worked on biometric, health and developer tools. Prosper recently co-founded a startup called Eden that’s focused on improving the quality of lives in Nigeria and currently leads the engineering team. He also co-founded forloop, the largest developer community in Africa.

Prosper Otemuyiwa

Progressive Web Apps are the future. Learn how to make your mobile web app native-like by making it work offline, load instantly and send push notifications.

Introduction to Progressive Web Apps (Push Notifications) - Part 3

Progressive Web Apps are the future. Learn how to make your mobile web app native-like by making it work offline and load instantly.



---

**TL;DR:** Web development has evolved significantly over the years allowing developers to deploy a website or web application and serve millions of people around the globe within minutes. With just a browser, a user can put in a URL and access a web application. With, **Progressive Web Apps**, developers can deliver amazing app-like experiences to users using modern web technologies. In the [first part of this tutorial](https://auth0.com/blog/introduction-to-progressive-apps-part-one) we set up our progressive web app, cached the pages and made it work partially offline. This time, we'll make it load instantly and work offline fully.

---

## Recap and Introduction to Part 2

In [Introduction to Progressive Web Apps (Offline First)](https://auth0.com/blog/introduction-to-progressive-apps-part-one), we discussed how a typical progressive web application should look like and also introduced the service worker. So far, we've cached the application shell. The `index` and `latest` pages of our web app now load offline. They also load faster on repeated visits. Towards the end of the first part of this tutorial, we were able to load the `latest` page offline but couldn't get dynamic data to display when the user is offline.

This tutorial will cover:

* Caching the App data on the `latest` page to be displayed to the user when offline
* Using `localStorage` to store the App data
* Flushing out old App data and fetching updated data when the user is connected to the internet


## Offline Storage

When building progressive web apps, there are various storage mechanisms to consider like so:

* **[IndexedDB](https://developer.mozilla.org/en/docs/Web/API/IndexedDB_API):** This is a transactional JavaScript based database system for client-side storage of data. This database employs the use of indexes to enable high performance searches of the data stored in it. IndexedDB exposes an asynchronous API that supposedly avoids blocking the DOM, but some research has shown that in some cases it is blocking. I recommend that you use libraries when working with IndexedDB because manipulating it in vanilla JavaScript can be very verbose and complex. Examples of good libraries are [localForage](https://mozilla.github.io/localForage), [idb](https://www.npmjs.com/package/idb) and [idb-keyval](https://www.npmjs.com/package/idb-keyval).

  ![IndexedDB Browser Support](https://images.ctfassets.net/23aumh6u8s0i/3TAkSh1K0jquHYGmAIKlG0/177eb267243366d60a232f9b3b3e99c3/indexeddbsupport)

  _IndexedDB browser support_
* **[Cache API](https://developer.mozilla.org/en-US/docs/Web/API/Cache):** This is best for storing url addressable resources. Works with Service worker really well.
* **[PouchDB](https://pouchdb.com):** Open Source JavaScript database inspired by [CouchDB](http://couchdb.apache.org). It enables applications to store data locally while offline, then synchronize it with CouchDB and compatible servers when the application is back online, keeping the user's data in sync no matter where they next login. PouchDB supports all modern browsers, using IndexedDB under the hood and falling back to WebSQL where IndexedDB isn't supported. Supported in *Firefox 29+ (Including Firefox OS and Firefox for Android), Chrome 30+, Safari 5+, Internet Explorer 10+, Opera 21+, Android 4.0+, iOS 7.1+* and *Windows Phone 8+*.
* **[Web Storage e.g localStorage](https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API):** It is synchronous and can block the DOM. The usage is capped at 5MB in most browsers. It has a simple API for storing data and it uses key-value pairs. 
  
  ![Web Storage Browser Support](https://images.ctfassets.net/23aumh6u8s0i/5t6F5vI9NFvk8MiYbFg0rs/c2804c91dc9d0c15279788ebcf9ec1c0/webstorage)

  _Web Storage browser support_

* **[WebSQL](https://www.w3.org/TR/webdatabase):** This is a relational database solution for browsers. It has been deprecated and the [specification](https://www.w3.org/TR/webdatabase) is no longer maintained. So, browsers may not support it in the future.

![Quota for Mobile Storage](https://images.ctfassets.net/23aumh6u8s0i/nDs06JOzFjU8L5N741a75/593af684f2f1ff25b050093afccf15dc/mobile)

_Mobile Storage Quota_

[Addy Osmani](https://twitter.com/addyosmani) has a comprehensive resource on [Offline storage for progressive web apps](https://medium.com/dev-channel/offline-storage-for-progressive-web-apps-70d52695513c#.j7e7w3m7g). You should really check it out!

According to PouchDB maintainer, [Nolan Lawson](https://twitter.com/nolanlawson), do well to ask yourself these questions when you are using a database:

* Is this database in-memory or on-disk(PouchDB, IndexedDB)?
* What needs to be stored on disk? What data should survive the application being closed or crashing?
* What needs to be indexed in order to perform fast queries? Can I use an in-memory index instead of going to disk?
* How should I structure my in-memory data relative to my database data? What’s my strategy for mapping between the two?
* What are the query needs of my app? Does a summary view really need to fetch the full data, or can it just fetch the little bit it needs? Can I lazy-load anything?

You can check out [how to think about databases](https://nolanlawson.com/2016/02/08/how-to-think-about-databases) to give you a broader knowledge on the subject matter.


## Let's Implement Instant Loading

For our web app, we'll use `localStorage` . I recommend that you don't use `localStorage` for production apps because of the limitations I highlighted earlier in this tutorial. The app we are building is a very simple one, so `localStorage` will work fine.

Open up your `js/latest.js` file. We will update the `fetchCommits` function to store the data it fetches from the Github API in `localStorage` like so:

```js


 function fetchCommits() {
    var url = 'https://api.github.com/repos/unicodeveloper/resources-i-like/commits';

    fetch(url)
    .then(function(fetchResponse){ 
      return fetchResponse.json();
    })
    .then(function(response) {
        console.log("Response from Github", response);

        var commitData = {};

        for (var i = 0; i < posData.length; i++) {
          commitData[posData[i]] = {
            message: response[i].commit.message,
            author: response[i].commit.author.name,
            time: response[i].commit.author.date,
            link: response[i].html_url
          };
        }

        localStorage.setItem('commitData', JSON.stringify(commitData));

        for (var i = 0; i < commitContainer.length; i++) {

          container.querySelector("" + commitContainer[i]).innerHTML = 
          "<h4> Message: " + response[i].commit.message + "</h4>" +
          "<h4> Author: " + response[i].commit.author.name + "</h4>" +
          "<h4> Time committed: " + (new Date(response[i].commit.author.date)).toUTCString() +  "</h4>" +
          "<h4>" + "<a href='" + response[i].html_url + "'>Click me to see more!</a>"  + "</h4>";

        }

        app.spinner.setAttribute('hidden', true); // hide spinner
    })
    .catch(function (error) {
      console.error(error);
    });
};

```

With this piece of code above, on first page load, the commit data will be stored in `localStorage`. Now let's write another function to retrieve the data from `localStorage` like so:

```js

  // Get the commits Data from the Web Storage
  function fetchCommitsFromLocalStorage(data) {
    var localData = JSON.parse(data);

    app.spinner.setAttribute('hidden', true); //hide spinner

    for (var i = 0; i < commitContainer.length; i++) {

      container.querySelector("" + commitContainer[i]).innerHTML = 
      "<h4> Message: " + localData[posData[i]].message + "</h4>" +
      "<h4> Author: " + localData[posData[i]].author + "</h4>" +
      "<h4> Time committed: " + (new Date(localData[posData[i]].time)).toUTCString() +  "</h4>" +
      "<h4>" + "<a href='" + localData[posData[i]].link + "'>Click me to see more!</a>"  + "</h4>";

    }
  };

```

This piece of code fetches data from `localStorage` and appends it to the DOM. 

Now, we need a conditional to know when to call the `fetchCommits` and `fetchCommitsFromLocalStorage` function. 

The updated `latest.js` file should look like so:

_latest.js_

```js

(function() {
  'use strict';

  var app = {
    spinner: document.querySelector('.loader')
  };

  var container = document.querySelector('.container');
  var commitContainer = ['.first', '.second', '.third', '.fourth', '.fifth'];
  var posData = ['first', 'second', 'third', 'fourth', 'fifth'];

  // Check that localStorage is both supported and available
  function storageAvailable(type) {
    try {
      var storage = window[type],
        x = '__storage_test__';
      storage.setItem(x, x);
      storage.removeItem(x);
      return true;
    }
    catch(e) {
      return false;
    }
  }

  // Get Commit Data from Github API
  function fetchCommits() {
    var url = 'https://api.github.com/repos/unicodeveloper/resources-i-like/commits';

    fetch(url)
    .then(function(fetchResponse){ 
      return fetchResponse.json();
    })
    .then(function(response) {
        console.log("Response from Github", response);

        var commitData = {};

        for (var i = 0; i < posData.length; i++) {
          commitData[posData[i]] = {
            message: response[i].commit.message,
            author: response[i].commit.author.name,
            time: response[i].commit.author.date,
            link: response[i].html_url
          };
        }

        localStorage.setItem('commitData', JSON.stringify(commitData));

        for (var i = 0; i < commitContainer.length; i++) {

          container.querySelector("" + commitContainer[i]).innerHTML = 
          "<h4> Message: " + response[i].commit.message + "</h4>" +
          "<h4> Author: " + response[i].commit.author.name + "</h4>" +
          "<h4> Time committed: " + (new Date(response[i].commit.author.date)).toUTCString() +  "</h4>" +
          "<h4>" + "<a href='" + response[i].html_url + "'>Click me to see more!</a>"  + "</h4>";

        }

        app.spinner.setAttribute('hidden', true); // hide spinner
      })
      .catch(function (error) {
        console.error(error);
      });
  };

  // Get the commits Data from the Web Storage
  function fetchCommitsFromLocalStorage(data) {
    var localData = JSON.parse(data);

    app.spinner.setAttribute('hidden', true); //hide spinner

    for (var i = 0; i < commitContainer.length; i++) {

      container.querySelector("" + commitContainer[i]).innerHTML = 
      "<h4> Message: " + localData[posData[i]].message + "</h4>" +
      "<h4> Author: " + localData[posData[i]].author + "</h4>" +
      "<h4> Time committed: " + (new Date(localData[posData[i]].time)).toUTCString() +  "</h4>" +
      "<h4>" + "<a href='" + localData[posData[i]].link + "'>Click me to see more!</a>"  + "</h4>";

    }
  };

  if (storageAvailable('localStorage')) {
    if (localStorage.getItem('commitData') === null) {
      /* The user is using the app for the first time, or the user has not
       * saved any commit data, so show the user some fake data.
       */
      fetchCommits();
      console.log("Fetch from API");
    } else {
      fetchCommitsFromLocalStorage(localStorage.getItem('commitData'));
      console.log("Fetch from Local Storage");
    }   
  }
  else {
    toast("We can't cache your app data yet..");
  }
})();

```

In the piece of code above, we are checking if the browser supports `localStorage` and if it does, we go ahead to check if the commit data has been cached. If it has not been cached, we fetch, display and cache the app's commit data.

Now, reload the browser again, make sure you do a hard, clear-cache, reload else we won't see the result of our code changes. 

Now, go offline and load the `latest` page. What happens?

Yaaay!! it loads the data without any problem.

![Load Dynamic Data Offline](https://images.ctfassets.net/23aumh6u8s0i/36OIqp3X2ZgkuGhLrElTuo/59cb767fae6efe1286ae47c0311f0358/pwacommits)

Check the **DevTools**, you'll see the data been stored in `localStorage`.

![Store Data Locally](https://images.ctfassets.net/23aumh6u8s0i/7BqkhLztkyPWUy4r9kPNNG/ed3e4bfebb1a77f4cc3a518916aa4607/data-stored-locally)
_Store Data Locally_

Just look at the speed at which it loads when the user is offline....OMG!!!

![Loads From Service Worker](https://images.ctfassets.net/23aumh6u8s0i/3i5tSnwsD9hz4TSLCJhyCR/badb2a218fa38c57a507cb4c13a3eb63/load_from_service_worker)
_Loads from Service Worker when user is offline_

## One More Thing

Now, we can make the app load instantly by fetching data from the localStorage. How do we get fresh updated data? We need a way of still getting fresh data especially when the user is online.

It's simple. Let's add a refresh button that triggers a request to GitHub to get the most recent data.

Open up your `latest.html` file and add this code for the refresh button within the `<header>` tag.

```html

<button id="butRefresh" class="headerButton" aria-label="Refresh"></button>

```

So the `<header>` tag should look like this after adding the button:

```html

<header>
  <span class="header__icon">
    <svg class="menu__icon no--select" width="24px" height="24px" viewBox="0 0 48 48" fill="#fff">
      <path d="M6 36h36v-4H6v4zm0-10h36v-4H6v4zm0-14v4h36v-4H6z"></path>
    </svg>
  </span>
  <span class="header__title no--select">PWA - Commits</span>
  <button id="butRefresh" class="headerButton" aria-label="Refresh"></button>
</header> 

```

Finally, let's attach a `click` event to the button and add functionality to it. Open your `latest.js` and add this code at the top like so:

```js

document.getElementById('butRefresh').addEventListener('click', function() {
    // Get fresh, updated data from GitHub whenever you are clicked
    toast('Fetching latest data...');
    fetchCommits();
    console.log("Getting fresh data!!!");
});

```

Clear your cache and reload the app. Now, your `latest.html` page should look like so:

![PWA - Get Updated data](https://images.ctfassets.net/23aumh6u8s0i/MhrrMYrgjMApmPLbCbBdh/11496d354460a2d24895c74e73397b4c/latest_data)

_Get Updated data_

Anytime users need the most recent data, they can just click on the refresh button.


## Aside: Easy Authentication with Auth0

You can use [Auth0 Lock](https://auth0.com/docs/libraries/lock) for your progressive web app. With Lock, showing a login screen is as simple as including the **auth0-lock** library and then calling it in your app like so:

```js

// Initiating our Auth0Lock
var lock = new Auth0Lock(
  'YOUR_CLIENT_ID',
  'YOUR_AUTH0_DOMAIN'
);

// Listening for the authenticated event
lock.on("authenticated", function(authResult) {
  // Use the token in authResult to getProfile() and save it to localStorage
  lock.getProfile(authResult.idToken, function(error, profile) {
    if (error) {
      // Handle error
      return;
    }

    localStorage.setItem('idToken', authResult.idToken);
    localStorage.setItem('profile', JSON.stringify(profile));
  });
});

```

**Note:** If you want to use Auth0 authentication to authorize _API requests_, note that you'll need to use [a different flow depending on your use case](https://auth0.com/docs/api-auth/which-oauth-flow-to-use). Auth0 `idToken` should only be used on the client-side. [Access tokens should be used to authorize APIs](https://auth0.com/blog/why-should-use-accesstokens-to-secure-an-api/). You can read more about [making API calls with Auth0 here](https://auth0.com/docs/apis).

_Implementing Lock_

```js

document.getElementById('btn-login').addEventListener('click', function() {
  lock.show();
});

```

_Showing Lock_


![Auth0 Lock Screen](https://images.ctfassets.net/23aumh6u8s0i/ElPRQ0cfHgykYZStjyH3D/709b6df945b846607fee305380d134f5/nexthrone-auth0lock)

_Auth0 Lock Screen_

In the case of an offline-first app, authenticating the user against a remote database won't be possible when network connectivity is lost. However, with service workers, you have full control over which pages and scripts are loaded when the user is offline. This means you can configure your `offline.html` file to display a useful message stating the user needs to regain connectivity to login again instead of displaying the Lock login screen.

## Conclusion

In this article, we were able to make our app load instantly and work offline. We were able to cache our dynamic data and serve the user the cached data when offline. 

In the final part of this tutorial, we will cover how to enable push notifications, add web application manifest and our app to a user's homescreen.


Introduction to Progressive Web Apps (Instant Loading) - Part 2

Progressive Web Apps are the future. Implement offline functionality and make your mobile web app feel like a native app.

Introduction to Progressive Web Apps (Offline First) - Part 1

Learn how the Dyn attack was perpetrated, how it could have been prevented and how to avoid similar attacks in the future



---

**TL;DR:** Last week, one of the biggest attacks in the internet history was perpetrated via a group of hackers during which popular websites like **Twitter**, **Netflix**, **GitHub**, **Amazon**, **Spotify** were knocked offline. These web sites were not accessible for the period the attacks lasted. A Distributed Denial of Service (DDOS) attack on Dyn - a domain name server company -  affected the online availability of these popular platforms.

---

## How did it happen?

Investigations about the recent DDOS attacks primarily revolved around **Internet of Things(IoT)**. It was revealed that several cameras, digital video recorders(DVRs) were hacked to create a massive botnet that struck Dyn with lots of traffic, about a trillion bits of data per second. These cameras and devices were vulnerable because they used default and common guessable passwords.

The attack on Dyn came from tens of millions of IP addresses according to the formal statement that was released on Dyn's website. The botnet that invoked the attack looks for smart home and **Internet of things** devices and transforms them into bots to use in cyberattacks. It was also discovered that one of the reasons this was so easily done was that most IoT devices still use the default username and password combination that they were shipped with. An example of a common username is `root`. These credentials are easy to find on the Internet, and were probably used to compromise thousands of devices with minimal effort.

## How could it have been prevented?

It is not new that in the **Internet of things** world, a lot of default and guessable passwords are used for these devices. In short, it's been a thing of concern for a long time that a lot of these devices are not well secured. For instance, several security cameras such as the one produced by Hangzhou XiongMai Technologies (XM) have a web app which requires a username and password to gain access to. But according to Wikholm, it's actually possible to bypass the login process by providing the IP address of a target device and adding "DVR.htm" to the end. These simple steps shown below will go a long way in preventing a lot of the cyber attacks happening frequently.

* Always change default passwords - Most of these devices hardcode the default passwords, so in most cases it would involve a firmware rewrite from the manufacturer. Companies responsible for creating these devices can provide an over-the-air update capability to enable the change from default to a complex username and password combination. In cases where the default passwords can be changed easily, please change it as soon as you purchase the device.
* Brute Force Protection - A certain limit can be set on failed login attempts on a device. If it exceeds a certain number, you can block the user!
* Change passwords frequently - The more devices, apps and systems get hacked, the likelihood that your password is leaked increases. Make a habit of frequently changing your passwords. More details can be found [here](https://auth0.com/blog/avoiding-password-reuse-attacks/)

## How can Auth0 help secure IoT?

Here at Auth0, we conducted a survey about both developer and consumer sentiments when it comes to the state of IoT security and what people think about the future. This very interesting [post](https://auth0.com/blog/surprised-turns-out-consumers-dont-trust-iot-security/) gives full details about the survey.

![Do you believe IoT devices are secure](https://images.ctfassets.net/23aumh6u8s0i/43Z5eryum1VacHZxnch7JM/b89916c018c26d4726c71bbd1bed9eab/do-you-believe-iot-devices-are-secure-2)

![Do you trust your personal data to IoT devices](https://images.ctfassets.net/23aumh6u8s0i/4fzx4Tgxetbu1jwnrfcWET/239b94449039d867270a6cbe611aa7eb/do-you-trust-your-personal-data-to-iot-devices)

You can use **Auth0** to simplify the implementation of your identity security. Auth0 provides the following:

- Can function as your authentication server, providing you with secure Json Web Tokens (JWTs)
- Keeps you up to date on the latest security vulnerabilities
- Provides [passwordless](https://auth0.com/passwordless) authentication, thus removing the vulnerabilities involved with hacked passwords.
- Provides [Anomaly Detection](https://auth0.com/learn/anomaly-detection/)
- Provides [Breached Password](https://auth0.com/breached-passwords) detection

## Conclusion

Cyber attacks are becoming the order of the day and many companies that develop IoT devices constantly think about user experience before security. Experts are concerned about the security of IoT devices for a long time, but nobody took action to improve that. Security should be *first-class* when dealing with connected devices and any type of application. Now that the world witnessed what lack of security in connected devices can do, it is important that manufacturers of IoT devices and users start taking security seriously to prevent similar or even worst attacks in the future.

<include src="TweetQuote" quoteText="Security should be first-class when dealing with connected devices and any type of application!"/>


How was the biggest DDoS attack in Internet history perpetrated?

Why Passwordless Login Is The Way Of The Future



Last year we launched [Auth0 Passwordless](https://auth0.com/passwordless) and since then, we've seen increasing success. Passwordless is a method of removing passwords from the login process completely. Instead, it uses one-time codes or “magic links” sent to your user's SMS or email as a method of authentication. 

With [59% of users](https://www.passwordboss.com/password-habits-survey-part-1/) admitting to reusing passwords to avoid having to remember multiple, and the process of recovering a lost password being unnecessarily unpleasant, Passwordless offers a much simpler and more streamlined user experience.

Throughout 2015 and early 2016, data was gathered on how Auth0's users and our user's users were using Auth0. We noticed some inspiring trends regarding Passwordless growth.

## The Data So Far

Passwordless was officially announced in September of 2015. The interesting thing to note is that people were already using Passwordless connections way before it was even announced, lending to the argument that it's definitely a good option. 

In January of 2015 there were about 50,000 connections, with steady growth of about 10,000 every month until September when it spiked. Since then, there's been a steady 10,000-20,000 growth in connections per month and it's still rising.

![Passwordless Connections from Jan 2015 to May 2016](https://images.ctfassets.net/23aumh6u8s0i/7ph9XjCEbVpLv4XDJ2uB2z/00fd946a4595bf1ae183949a301bc42b/passwordless-connections-from-jan2015-may2016)

In the 17 months from January 2015 until May 2016 when we collected our last data point, Passwordless connections have seen 6X growth. In the first few months of 2016, growth of username and password usage was only 0.83%. In the same time span, an increase in Passwordless usage was over 11%.

Passwordless continues to grow for a [number of reasons](https://auth0.com/blog/how-passwordless-sms-authentication-can-improve-your-app/):

* **Improved User Experience**: Passwordless means that you don't add to the growing number of passwords that your users have to remember. Instead you remove the friction for them using your app and allow them to quickly sign up.
* **Increased Security**: By using a randomly-generated code sent to SMS or e-mail, logins are now much harder to hack. It is no longer possible for someone to simply use encrypted malware to steal your private information. 

Passwordless is almost as [easy to use for developers](https://auth0.com/blog/auth0-passwordless-email-authentication-and-sms-login-without-passwords/) as it is for users, making it a welcome change for both parties.

## When Passwordless Will Overtake Passwords

Using the data we collected, we projected growth estimates for Passwordless implementation in relation to Username/Password (U/P) usage. We can see that Passwordless is projected to overtake U/P in mid-2027, which is impressive considering how long U/P has been around.

![Forecast: User/Password Connections vs Passwordless Connections](https://images.ctfassets.net/23aumh6u8s0i/6RlTe8wlf2MSSI36bQvNEx/f77b8d1532c04c98a41cdf52e37c59ec/forecast-up-vs-passwordless)

Of course, it's even more important to note that these projections were made while keeping U/P constant. In reality, it's likely that while Passwordless grows, U/P is likely to fall. With so many other options available for authentication, including [Social Connections](https://auth0.com/blog/how-to-use-social-login-to-drive-your-apps-growth/) and Passwordless, the number of people using U/P is likely to decrease significantly, as it is the most inconvenient and least secure option. 

### What Could The Future Hold?

We drew up another projection of Passwordless growth based on the almost exponential rate of growth that Passwordless has seen so far. The estimate shown above is much more conservative in that it only takes into account a very linear rate of growth.

In this projection, we see that even when U/P is estimated with a similar increasing rate of growth, Passwordless overtakes it within a year. This is much faster compared to the estimate above of ~10 years.

![Passwordless Connections Growth with Previous Growth Rates](https://images.ctfassets.net/23aumh6u8s0i/5URWew6kEAkmQtJDMxNpXT/a2dea5fdebcd15330c9f4d34667634d2/passwordless-growth-with-previous-growth-rates)

So which of these is the “real” estimate? The truth likely lies somewhere in the middle. While we don’t think Passwordless will grow as fast as the exponential growth projects, we do think that as more people see the benefits of Passwordless, the rate of growth will no doubt increase. Expect to never have to remember a password again somewhere in the early 2020s!

## How To Implement Passwordless To Add Your Users To These Numbers

Developing your own in-house SMS API for passwordless login is both [difficult and costly](https://auth0.com/blog/how-passwordless-sms-authentication-can-improve-your-app/). Luckily, implementation of Auth0’s Passwordless Logins is quick and easy to achieve. 

Within the Auth0 Dashboard, you can choose to configure SMS, Email, or both Passwordless options. Using SMS and Email will send a magic code or link that your user can type in or click to login.

![Passwordless Connections](https://images.ctfassets.net/23aumh6u8s0i/39Ce4owft66eBEYeLZ1tol/d0da4d8410e61c9dfddc7850bb98f027/passwordless-connections)

Even the documentation is simple for developers to implement, and Auth0 provides [tutorials](https://auth0.com/docs/connections/passwordless) to guide you every step of the way. 

![Adding Passwordless - Code Snippet](https://images.ctfassets.net/23aumh6u8s0i/7xxYUzn7bLk7CxK5lPxbHd/7e39e48e73f50338b0d604d2c531f1b3/adding-passwordlessa)

Using Auth0's Passwordless greatly simplifies the process of making your authentication method much safer for your users.

## Passwordless Is The Future

With Passwordless connections seeing 6X growth in just 17 months, there is no question that Passwordless is steadily growing and will continue to do so. It is projected to overtake U/P usage as soon as late 2017 and no later than mid 2027, making it clear that the time to switch is now.

This really is a great thing for both developers and users as it will increase convenience and security on both ends. You can test it out using the [demo](https://auth0.github.io/lock-passwordless/) and when you're convinced, it's easy to [get started](https://auth0.com/passwordless)!


"future"