Proving Who You Are

Authentication done properly: why password storage is a specific engineering problem with a specific answer, what multi-factor actually buys, the real difference between sessions and tokens, and how OAuth and OpenID Connect work once you stop treating them as the same thing.