> Now I’m wondering how Google does authn... That's my corner of Google. We haven't published anything comparable to this paper in the time I've worked on it (

> Now I’m wondering how Google does authn... That's my corner of Google. We haven't published anything comparable to this paper in the time I've worked on it (maybe we could—I'm pleasantly surprised to see the Zanzibar folks got approval to share qps numbers and everything) but here's a bit about how it worked back in 2006: https://www.usenix.org/legacy/event/worlds06/tech/prelim_papers/perl/perl_html/gaia-worlds.html https://www.usenix.org/legacy/event/worlds06/tech/prelim_pap... Some of that still applies. fwiw, while we do our fair share of password checking, we do a _lot_ more oauth token and cookie checking. Most folks just stay signed in on both mobile and web, so no need to recheck their passwords. In contrast, session credentials get checked on every request.