Zero Trust Login
How I Stopped Reading Your Data in my services
I build systems where not even the almighty admin (me) can read your data.
No backdoors. No db.users.find(). Just encrypted chaos. Beautiful, unreadable, untouchable chaos.
Security isn't magic, we are just scared to lose control.
If I'm debugging live prod data, I've already failed my architecture exam.
Many pretend to do the same using JWTs/JWKs. Cute. But let's be honest:
There's always someone with access. Production isn't a vault, it's just a cleaner sandbox.
Most systems cling to readable tokens, human friendly JSON, and debug services like a comfort blanket.
I don't.
Zero trust could work like this:
1. User signs up
➤ They give a password.
➤ I derive a unique key from that password.
➤ That key encrypts a randomly generated User Key.
➤ That User Key encrypts everything else (emails, usernames, secrets, hopes, dreams).
2. User logs in
➤ Same password = same derived key.
➤ That unlocks their User Key.
➤ That unlocks their encrypted data.
➤ Voilà. Magic. But not magic. Math.
3. Token generation
➤ It has no traceable info and All Session Data are encrypted with the backend-only key.
➤ It expires. Quickly.
➤ It is fingerprinted to the device/browser.
➤ You steal it? Good luck. Doesn’t work on your laptop, Dave.
👁️ Zero Visibility ≠ Zero Functionality
• 🔒 I can’t decrypt your data. Not even if I'm angry.
• 🛡️ Backend is stateless. Frontend is stateless. Token is everything.
• 👨💻 No user ID in memory. No session storage. No cookies.
• 🪪 You want access? Bring your password, WebAuthn, 2FA or other login methods.
• 🕵️ No OAuth weirdness, no redirect hell.
• 🧠 Works like OAuth, but with actual privacy. Not even a user ID is exposed
• ⚙️ Agnostic to used technologies - Cloud, OnPremise, SQL, NoSQL, doesn't matter.
Because security isn't magic. It's math, discipline, and just enough spite to not let anyone (including yourself) peek behind the curtain.
Until then, I'll be in the server room. Giggling at encrypted documents I can't read.
#ZeroTrust #Encryption #Security #Stateless #PrivacyByDesign #BackendOnlyAccess #NoRootForYou #Coding #Programming