MojoAuth

Your reliable & simplified #passwordless solution provider. Prevent #credentialstuffing & password attacks. Give your users the best login experience

[MojoAuth @MojoAuth]

⚙️ MojoAuth = 1 API for Email, SMS, WhatsApp & Authenticator OTPs.
⏱ Integrate in hours, not months.
🌍 Global delivery <3s.
👉 Build faster: https://t.co/NUZNTmD4ls

#OTP #Security #SaaS

[MojoAuth @MojoAuth]

Every request makes a network call to your identity provider first: 5,000 key fetches a second, extra latency on every call, and if the provider slows down or rate-limits you, your whole API fails auth.

The fix is today's post: cache the keys, refetch only on an unknown key ID.

[MojoAuth @MojoAuth]

This middleware fetches your IdP's signing keys before it checks any token.

Staging: 5 calls/s. Fine.
Production: 5,000 calls/s to your IdP, a round trip on every request, and one IdP slowdown fails all auth.

What would you change?

#javascript #oauth

[MojoAuth @MojoAuth]

Everyone logged in at 9:00 with a 1-hour token.

At 10:00 they all refresh. At 11:00, again. Your login spike just became an hourly echo.

Refresh at a random 75–90% of the token's life instead.

Fixed time or random: which do yours do?

#oauth #backend

[MojoAuth @MojoAuth]

Set-Cookie: sid=8f3a91c2

Sent over HTTP. Readable by any script. Carried on cross-site requests. Alive until the browser quits. A subdomain can plant a copy.

Five words fix it: __Host- Secure HttpOnly SameSite=Lax Max-Age

How many does yours have?

#websecurity #webdev

[MojoAuth @MojoAuth]

The audit log write and the welcome-back email. Queue both and respond first.
The fraud score usually has to stay: it decides whether the login goes through.

[MojoAuth @MojoAuth]

One login, itemized: 504 ms against a 300 ms budget.

Two lines on this receipt could happen after the response. Which two?

#performance #backend

[MojoAuth @MojoAuth]

10,000 users tap "Log in" at 9:00:00. What breaks first?

A) CPU: password hashing
B) DB connections
C) SMS/email provider
D) Rate limiter

Reply with a letter and why.

#backend #systemdesign

[MojoAuth @MojoAuth]

Monday, 9:00. Login p99 is 14.2s.
Pods at 100% CPU. New pods need 3 min.
Marketing just emailed 2M users.

The load test? One user, 10,000 times.

Six messages. Three minutes. All fixable on Friday.

Which one would you have caught?

#sre #incidentresponse #devops

[MojoAuth @MojoAuth]

50% CPU: a login waits about 2× its work time.
90% CPU: 10×.
99% CPU: 100×.

Queues don't get slow slowly. They fall off a cliff.

What CPU target do you scale at?

#sre #performance #backend

[MojoAuth @MojoAuth]

"Login is slow, let's lower the bcrypt cost."

That makes it faster for attackers too. The fix is more hashing capacity, not weaker hashes.

Which would you pick: more cores, or a separate hashing pool?

#security #appsec #backend

[MojoAuth @MojoAuth]

Size the hashing pool by both: cores for the CPU time, RAM for the memory. Cap concurrency so a pod can never exceed its limit; a queued login is a slow login, an OOM-killed pod is a failed one.

Your peak will differ.

[MojoAuth @MojoAuth]

19 MiB per argon2id hash: OWASP's minimum.

That's memory, not CPU. 1,000 logins hashing at once need about 18.6 GiB. Are your auth pods sized for that?

#security #backend #capacityplanning

[MojoAuth @MojoAuth]

RAM in use = hashes in flight × memory per hash. 1,000 × 19 MiB = 19,000 MiB ≈ 18.6 GiB.

Hashes in flight = logins per second × seconds per hash (Little's law). At 100 ms per hash, 1,000 in flight means 10,000 logins/s; at 500 ms per hash, 2,000/s.

[MojoAuth @MojoAuth]

Where the numbers come from:

19 MiB (m = 19456 KiB), t = 2, p = 1 is the minimum argon2id setting in the OWASP Password Storage Cheat Sheet. Memory-hard by design: the cost is RAM, not only CPU.

[MojoAuth @MojoAuth]

• Cores = logins per second × seconds per hash (Little's law). 5,000 × 0.1 = 500.
• Memory = hashes in flight × memory per hash. 500 × 19 MiB ≈ 9.3 GiB.

Your numbers will differ. The method won't. Tomorrow: why "lower the cost" is the wrong fix.

[MojoAuth @MojoAuth]

Password hashing is supposed to be slow. That's the point.

5,000 logins/s × 100 ms per hash = 500 cores, just to check passwords.

Have you ever timed one hash on your production hardware?

#security #backend

[MojoAuth @MojoAuth]

• 100 ms per hash is a scenario. On a current server core the same setting lands anywhere from tens of ms up; that's why the post says "measure yours".

[MojoAuth @MojoAuth]

Where the numbers come from:

• 19 MiB, 2 iterations, parallelism 1 is the minimum argon2id setting in the OWASP Password Storage Cheat Sheet.

[MojoAuth @MojoAuth]

Shift starts at 5am. The help desk opens at 9.

A worker forgets their password. Nobody to call for four hours. So they borrow a colleague's login, because the trucks still need loading

Any auth method that needs a help desk behind it fails everyone who clocks in before it opens

[MojoAuth @MojoAuth]

"Our users won't understand passkeys" stopped being true the moment Amazon made them the default mobile sign-in. 320M customers have already been through the flow.

The blocker isn't comprehension. It's that nobody owns the rollout.