Chapters
AI Built This Login in 30 Seconds. A Bot Cracked It in 10.
Ask AI to build a login and it works — until a 15-line script tries 10,000 passwords and walks in. Here’s every part of authentication AI skips, and exactly what to tell it.
Episode 1 · 4:30 · D1 · Identity & Access
Ask AI to build authentication and it delivers in a minute: signup, hashed passwords, login, a session. It works. Then a 15-line script tries the 1,000 most common passwords — and the login answers every guess.
Authentication isn't one thing. It's a dozen decisions, and AI quietly makes almost none of them. This video walks through all of it in plain English — and the exact instruction to hand the AI for each:
- Brute force — cap attempts, and the judgment call: slow down vs hard-lock (why "lock the account" can be a weapon, even for a bank)
- Sessions — 5 minutes or 30 days? A decision only you can make
- Tokens — the revocation trap: why "log out everywhere" often does nothing
- Two-factor — who to force it on, and the backup-code gap AI forgets
- Password reset — the real front door (expire, single-use, kill old sessions)
- Account enumeration — the quiet leak in your error messages
- "Continue with Google" (OAuth) — how two people end up owning one account
The AI writes every line. You're the one who knows what to ask for. That's what makes you an engineer now.
The fix isn't "add a limit" — it's *which* limit, and that's a business decision the AI was never in the meeting for. What's the worst auth bug you've seen ship?