Practice

Security and Identity Engineer

Zero Trust, passwordless, and what happens to a login once the password is gone

I design authentication and access — the part of a system where a mistake is not a bug but an incident. I built Toqen.app: a passwordless platform with an OIDC provider, device-bound cryptographic verification and hardware-backed keys on mobile. Before that, protected corporate and government systems at Sber and Yandex, where the requirements on handling data were not negotiable.

What I can do

  • Design an authentication model: who proves what, to whom, and what a stolen token is worth.
  • Stand up an OIDC provider with correct token lifecycles instead of an improvised session cookie.
  • Move a product off passwords: passkeys, TOTP, device-bound keys, and recovery that is not a backdoor.
  • Handle keys on mobile properly: secure storage, biometrics, and a plan for a lost device.
  • Review an existing system for the ordinary failures: OWASP, token handling, access control, input at the trust boundary.
  • Put secure-development practice into a team's routine so security stops being a release-week panic.

Where this came from

  1. 2025 —

    ASMB Tech

    Toqen.app: architecture of a Zero Trust passwordless ecosystem. An OIDC provider on Node.js with Jose, Argon2 and TOTP, cross-platform clients with hardware-backed key storage, and a public TS/JS SDK for third-party integration.

  2. 2023 — 2025

    Yandex

    Authorization and protected service-to-service communication in the Lavka B2B panel; security-minded code review and access management.

  3. 2019 — 2022

    Sber

    An isolated interface for handling sensitive enforcement documents against state registries. Secure-development standards and strict typing that removed whole classes of input error.

  4. 2016 — 2019

    CloudLink

    A utility billing system handling financial transactions and personal data.

Stack

Security and identity
Zero Trust ·OpenID Connect ·OAuth 2.0 ·Passkey ·Passwordless ·TOTP ·Jose ·Argon2
Standards and practice
OWASP ·SSDL ·Token lifecycle ·AppSec ·Threat modelling ·Hardware key generation
Backend and data
Node.js ·TypeScript ·PostgreSQL ·Supabase ·REST API
Mobile
React Native ·Expo ·Secure key storage ·Biometric authentication
Infrastructure
Docker ·GitHub Actions ·Vercel

About this on the site

Working together

Write to me if this is the shape of the problem you have.

Get in touch