#Authentication — Writing

EngineeringNovember 6, 20262 min read

Refresh-token rotation under concurrent replay: 200 scheduled callers

I sent 200 scheduled refresh attempts through one local token family. Only one issued a successor; multiple workers would need a different test.

#Authentication #Mobile Security #Backend #Concurrency

EngineeringNovember 6, 20263 min read

Android Play Integrity request binding and backend verdict policy

What requestHash protects, what the server must verify, and why an integrity verdict is not a substitute for authorization.

#Android #Kotlin #Play Integrity #Mobile Security

EngineeringNovember 6, 20263 min read

Authentication telemetry without leaking tokens or recovery secrets

Design privacy-conscious auth decision logs that help explain failures without recording the credentials that caused them.

#Backend #Observability #Authentication #Mobile Security

EngineeringNovember 6, 20264 min read

Device integrity is not authorization: an App Attest and Play Integrity decision model

A valid App Attest or Play Integrity result cannot authorize a user. I walk through the server decisions separately and test them with synthetic inputs.

#iOS #Android #Mobile Security #App Attest

EngineeringNovember 6, 20264 min read

Mobile session recovery as an explicit state machine

Model sign-in, refresh rotation, expiry, step-up recovery, and revocation without creating a hidden authentication bypass.

#Mobile Security #Authentication #Session Recovery #iOS

Writing

Archive

2026