Auth0 vs Delinea

Backend-Owned SMS OTP: Cooldowns and Attempt Caps

This technical blog post explains best practices for implementing passwordless phone logins using SMS OTPs in an Express/Node.js backend. It argues that the backend must own resend cooldowns, verification attempt counters, and anti-abuse policies (not the client), model the authentication state machine (ready → code_sent → verified/expired/locked), persist minimal authoritative state, use atomic database transitions, emit single transition events for observability, and use idempotency keys and retry/backoff handling when calling providers. Provider choices (Twilio, Firebase, Auth0, Amazon SNS, Infrai) are discussed with trade-offs between managed verification and owning template/state-machine responsibilities.

• The article recommends the Express/Node.js backend should own SMS OTP resend cooldowns, maximum verification attempts, and anti-abuse counters rather than trusting the client.
• Designs should expose explicit states: send-code, verify-code, resend-code, and lockout; persist minimal authoritative state (challenge ID, phone identity, expiry, next-send time, counters, lockout).
• Use atomic database transitions and idempotency keys tied to admitted transitions to prevent race conditions and duplicate sends.

Don't Build Login Pages Again: Centralized Auth

The article argues that repeatedly rebuilding login and user/role management across projects is inefficient and error-prone. It describes a common pattern where teams duplicate authentication code across multiple apps, leading to duplicated bugs and maintenance burdens. Two solutions are compared: (1) create a reusable login/user-management module/library to import into projects, and (2) build a separate centralized application (service) that handles authentication, users, roles, and exposes an API for other projects. The author favors the centralized application approach and cites existing services (Auth0, Firebase Authentication, Clerk) as examples, then introduces Roled — a centralized user and role management platform — with links to its site and quickstart documentation.

• Repeatedly copying login and user-management code across projects causes duplicated bugs and maintenance overhead.
• Two approaches are proposed: a reusable module/library, or a separate centralized application for login and user/role management.
• The article cites third-party services such as Auth0, Firebase Authentication, and Clerk as existing options.

NVIDIA secures the agent's machine; we secure everything it reaches

New blog post added: 'NVIDIA secures the agent's machine; we secure everything it reaches' (6 minute read) at https://delinea.com/blog/nvidia-secures-the-agents-machine-delinea-secures-its-access

Delinea joins Project Glasswing: What this means for your environment

Delinea announces its participation in Project Glasswing, a new initiative, with a blog post explaining the implications for customer environments.

How to choose the right level of PAM vault security

New blog post from Delinea on selecting appropriate PAM vault security levels.