Identity and Privacy
Identity and privacy covers authentication, authorization, and the data-protection duties around personal information. Distinguish authentication (who you are), authorization (what you may do), and accounting/audit (what you did). Know the factors-knowledge, possession, inherence-and that MFA must combine different factors; two passwords are not MFA.
Rules
- Passwords: length beats complexity; use a password manager, unique credentials per site, and check breaches. Servers store salted KDF hashes (Argon2/bcrypt), never plaintext.
- Prefer phishing-resistant MFA (FIDO2/WebAuthn security keys, passkeys) over SMS, which is vulnerable to SIM swap and interception.
- Apply least privilege and role-based access; separate admin accounts; review access; disable departed users promptly.
- SSO and federation (OAuth 2.0 for authorization, OpenID Connect for authentication, SAML) centralize identity but make the IdP a high-value target.
- Privacy principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity/confidentiality, accountability. GDPR adds data-subject rights (access, rectification, erasure, portability) and breach notification-72 hours to the supervisory authority where required.
- Reduce tracking: browser privacy settings, block third-party cookies, review app permissions, use pseudonymity where appropriate.
Worked example
A SaaS app asks for a user's birth date for marketing. Under data minimization, if age verification is the real need, collect only an age bracket or verify without storing the full date. Reasoning: purpose limitation ties collection to a stated need; storing extra personal data increases breach impact and legal exposure without adding function.
Traps
Authentication is not authorization. MFA fatigue and push bombing are real; number matching helps. Delete account may only deactivate. Hashing an email does not anonymize it. Privacy is not only secrecy-it includes consent and retention.