Articles
Notes on backend architecture, performance work, and the WordPress and Laravel systems I build.
12 min readYour authenticator works in airplane mode: how TOTP really works
The 6-digit code is never transmitted — it is derived. A full walk through RFC 6238: the shared secret exchanged once at enrolment, the time step, HMAC-SHA1 and dynamic truncation, the verification window and clock drift, replay prevention and rate limiting, plus the attacks TOTP does and does not stop.
Intermediate- Security
- Authentication
- Cryptography
- MFA
12 min readThe auth service is down and users are still logging in: how stateless auth works
A backend interview question with a precise answer — the auth service sits on the issuance path, not the verification path. How locally verified signatures, JWKS caching and asymmetric keys keep requests flowing, exactly which operations are already broken, the revocation you traded away, and how to design the degradation deliberately.
Intermediate- Authentication
- Security
- Reliability
- System Design