authentication

A reset flow is a second login page with weaker checks. Interviewers use it because every step has a classic bug, and the strong answer finds them in order.

SPF checks a server, DKIM checks a signature, and neither checks the From line the user reads. DMARC ties them to that line. Interviewers want the alignment idea, then the phishing that still gets through.

SHA-256 with a salt sounds right and fails. The answer that scores explains the attacker's economics and names the parameters.

Ten seconds of definition, then the part that scores: why most access bugs happen to users who logged in perfectly.

Both are 'something you have'. One can be typed into a fake page in real time; the other checks which page is asking.

Zero trust is a set of engineering decisions, not a product. The scored answer names them, shows how they replace network location as a trust signal, and admits where they are hard.

Logging in is one moment; a session lasts hours or months. Most session bugs live in what happens between: identifiers that never change, timeouts nobody enforces, and logouts that only clear the browser.

The login form is the front door, but attackers use the side doors: reused passwords, guessable recovery, and MFA that can be phished or reset by a support agent.

Define the partner identity, permitted operations, disclosure rules and commitment states. Verify claims against authorized evidence and reconcile disputed or uncertain effects.

Trace a voice request through verified identity, exact-action approval and the account service. Test recovery, changed details, handoffs and effects that outlive the call.