How Modern Authentication Works
A first-principles breakdown of one-time passwords, multi-factor security, cryptographic time drift, and cellular delivery networks.
Pieces in this series
How OTP and Two-Factor Authentication Actually Work
From shared cryptographic secrets and Unix timestamps to dynamic truncation and SMS delivery risks
Time-based one-time passwords (TOTP) do not rely on cellular towers, SMS gateways, or an internet connection. Both your phone and the server independently calculate the exact same 6-digit number using a shared secret and the current tick…
Why SMS OTPs Sometimes Arrive Late or Fail Entirely
The multi-hop journey from enterprise application servers through telecommunication aggregators, SMPP queues, and cellular signaling networks
Unlike instant messaging apps that keep persistent TCP/WebSocket connections open over IP, an SMS OTP must traverse enterprise API gateways, international telecommunication brokers, carrier firewalls, and low-priority cellular control…
How Public-Key Cryptography Actually Works
One-way mathematical trapdoors, modular clock arithmetic, Diffie-Hellman key exchange, and the RSA prime factor breakthrough
For four thousand years, all encryption required sharing a secret key beforehand. In 1976, public-key cryptography shattered this paradox using mathematical 'trapdoor functions'—calculations trivial to compute forward but practically…
How Passkeys and WebAuthn Work
From FIDO2 public-key credentials and Secure Enclave isolation to origin binding, challenge-response signatures, and synced passkeys
Passkeys and the W3C WebAuthn standard replace shared secrets and passwords with asymmetric public-key cryptography bound to hardware security modules. When you authenticate, your device signs a cryptographic server challenge inside an…
How Single Sign-On (SSO), OAuth 2.0, and OpenID Connect Work
From the browser redirect dance and Proof Key for Code Exchange (PKCE) to JWT signature verification, SAML assertions, and identity provider federation
Before federated identity, every website demanded its own password or asked for your primary email credentials. Single Sign-On, OAuth 2.0, and OpenID Connect solved this by replacing shared passwords with cryptographically signed tokens…