# "private key" (compromised OR stolen OR leaked) — X 热门讨论 (2026-09-11 16:33 UTC)

## @momobsc_ (momo🔸) · 09-11 06:39 · ♥20 ↻3 💬7 Will Crypto Still Be “Crypto” in 2036? https://x.com/momobsc_/status/2098300504682242210

## @anuragdotdev (Anurag Jha) · 09-11 13:03 · ♥25 ↻2 💬2 Authentication & Authorization for Backend Engineers https://x.com/anuragdotdev/status/2098397084244475988

## @pdadx (pdad) · 09-10 06:12 · ♥20 ↻2 💬4 potentially getting lore on one of the craziest crypto acts ever performed, potentially finding out who the person is, potentially it even being ryoshi himself. potentially a coin deployed by somebody with genuinely zero care for money itself other than to show it off as art. or its just a compromised private key.

we trade to take chances, and theres no better chance right now than $nd4

0xa43a9b6eedd8204f445237bf72775ed9b1723d45

sleep tight. https://x.com/pdadx/status/2097931281111601506

## @_jaydeepkarale (Jaydeep) · 09-11 11:57 · ♥21 ↻0 💬1 Authentication & Authorization is beautiful. Every concept has a story. You just don't know it yet.

You build an API.

Anyone can call it. Anyone can read the data. Anyone can delete the records.

There is no "who". There is just "anyone".

So you add a password. Now the user proves who they are before they get in. That is Authentication. The oldest problem in computing, solved with a string you type and hope nobody guesses.

Your server checks the password on login and lets the user in. But HTTP has no memory. Every request arrives like a stranger. The server forgets them immediately.

So you create a Session. The server remembers the user server-side and hands them a Session ID. They send it back with every request. The server looks it up and recognises them.

One stable ID. One server-side store. It works until you have ten servers and no idea which one holds the session.

So you put Session state in Redis. Every server reads from the same store. The user can hit any server. The session survives.

Now you have mobile apps, microservices, third-party integrations. They cannot use cookies. They need something they can carry themselves.

So you use a JWT. A self-contained token with the user's identity baked in. No database lookup. The server verifies the signature and trusts the claims.

It scales. It is stateless. It feels elegant.

Then a user gets compromised. You want to invalidate their token. But the token is valid for 24 hours and there is no registry to check. You cannot un-issue a JWT. It is just out there, valid, until it expires.

So you make tokens short-lived. 15 minutes. You add a Refresh Token, long-lived and stored securely, used only to get a new access token.

Now revocation is possible. The refresh token hits your server. Your server can reject it. The 15-minute window is acceptable risk.

Your app needs to access the user's Google Calendar. You ask them for their Google password. They give it to you. You store it. Now you hold credentials you were never supposed to have.

So you use OAuth 2.0. Google asks the user directly. The user says yes. Google gives your app a scoped token. Your app never sees the password. The user can revoke access without changing their password.

Delegation, not impersonation. The right model. You add OAuth. Users log in with Google. But now you need to know who they are, not just that they have access. The access token lets you call Google APIs. It does not tell you the user's name.

So you add OpenID Connect. An identity layer on top of OAuth. Google sends an ID Token, a signed JWT with the user's name, email, and a unique ID. Authentication and Authorization in one handshake. Users are in. Now the question changes.

Not "who are you" but "what can you do". You give every user full access. It is simpler. One user deletes the production database. Accidentally. They had no reason to have that permission. You had no reason to give it.

So you add Roles. Admin. Editor. Viewer. Each role has specific permissions. Each user gets a role. The Editor cannot delete. The Viewer cannot edit.

It works until you have 40 roles and nobody can explain what each one does.

So you write Policies. Not roles assigned to users but rules evaluated at request time. This user, this resource, this action, this time of day. OPA evaluates it. You get a decision. Access or deny.

Expressible. Auditable. Composable.

A user logs in with just a password. An attacker gets the password from a breach database. Your database was not the one that leaked. Your users reuse passwords. The attacker is in.

So you add MFA. A second factor the attacker does not have. A TOTP code from an authenticator app. A hardware key. A biometric. The password alone is no longer enough.

The attacker has the password. They still cannot get in. A user gets a phishing email. A fake login page, pixel-perfect. They type their password and their TOTP code. The attacker relays both in real time. MFA did not save them. The fake site looked real. The user could not tell the difference.

So you use Passkeys. No password to steal. No code to intercept. The user's device holds a private key bound to your site's exact origin. A fake site is a different origin.

The key does not work there.

Phishing becomes structurally impossible. Not harder. Impossible.

Your services talk to each other inside the cluster. Service A calls Service B. But B has no way to know the request actually came from A and not from something that found a way inside the network.

You trusted the network. The network is not enough. So you use mTLS. Both sides present certificates. Both sides verify each other. A service cannot lie about its identity. A compromised pod cannot impersonate a trusted service.

Zero Trust. Not because it sounds good in a pitch deck. Because the alternative is assuming your internal network is safe. It is not.

Authentication answers: who are you. Authorization answers: what can you do.

Most teams get Authentication right and treat Authorization as an afterthought.

That is where breaches live. Not at the login page. In what you let authenticated users do after they are inside. The pattern across all of it is the same.

Every concept exists because the previous one had a gap. Sessions because HTTP is stateless. JWT because sessions do not scale. OAuth because passwords should not be shared. Passkeys because passwords should not exist.

Each one is a better answer to the same question.

"Who are you. And what are you allowed to do here." > 引用 @shubh19: Backend developers:

What's the difference between:

- Authentication - Authorization

Can you explain both in one sentence? https://x.com/_jaydeepkarale/status/2098380339848822992