What we do not publish and why
The kinds of detail this book leaves out on purpose, the reasons, and where you can still find what you need.
On this page
This book explains how TDACorp Identity works, and it is meant to be complete enough that you can use your account and build on the platform with confidence. It is not complete in every respect. Some detail is left out on purpose. This page says which kinds, and why, so a gap does not look like an accident or a cover-up.
What this book does publish#
- Every page a person sees, with its real wording, and what each step does.
- How the OpenID Connect and OAuth behaviour works: discovery, keys, scopes, claims and token lifetimes.
- The limits that matter to you as a user or builder, such as how long a session lasts and how long an authorization code is valid.
- What the platform does not do and does not claim, on the Security practices page, which lists at length what is not claimed.
- A way to report a flaw, on the Vulnerability disclosure page.
What it leaves out, by kind#
| Kind of detail | Why it is left out |
|---|---|
| Exact request limits and how they are counted. The book says only that a request can be refused with a 429 response and a Retry-After header. The page shows Too many attempts. Try again in a wait such as 45 seconds, 57 minutes or 2 hours. | A number someone can read is a number a script can stay just under. What you need to know is that waiting works. |
| How the platform decides a sign-in is unusual. The book says only that an unfamiliar browser or place may be asked to confirm. | Telling an attacker which signals count tells them which to avoid. A legitimate person only needs to know what to do when asked. |
| Anti-automation details. | The same reason as above. You may see a short Checking your browser step, and that is all you need. |
| Whether an account exists for an address. Sign-in, registration and recovery pages are worded to say the same thing either way. | An answer to "does this address have an account" helps a stranger who is trying to target people. The message comes to the mailbox, where only its owner can read it. |
| Key handling and internal data layout. | Not needed to use or build on the platform, and useful mostly to an attacker. |
| Administrator tools and operator procedures. | They are for the people who run the platform, not for account owners. |
| Whether an optional feature is on for a given deployment. The book says Available, In development or Planned, or that something is available where your organization allows it. | Which features are on is a decision for each deployment and can change without a new edition of the book. A page that said otherwise would go out of date. |
| Source file names, repository layout and decision records. | They describe how the platform is built today, not how you use it, and they change often. |
What leaving it out does not mean#
- It does not mean the detail is what keeps you safe. Not publishing something is a choice about disclosure. It is not a claim that the secret detail makes anything secure on its own.
- It does not mean the book is hiding a problem. Known weaknesses that the platform's operators track are listed on the trust pages, and the Vulnerability disclosure page lists issues it already knows about.
- It does not mean you cannot verify behaviour. The pages show their own wording, the protocol behaviour is documented, and standard clients can check discovery and keys.
If you need something that is not here#
Ask the question you actually have. Often the answer is a decision, not a number.
| You want to know | Look at |
|---|---|
| How long will my session last? | Sessions and devices and Security practices. |
| Why was I asked to confirm a sign-in? | Sign in on another device. |
| Why was I refused for too many attempts? | Wait, then try again. If it persists, If you are locked out. |
| What happens to my data? | Privacy and Retention and deletion. |
| I think I found a flaw. | Reporting a vulnerability. |
| I am building on identity and need exact behaviour. | The build and reference sections of this book. |
A note on honesty#
The book follows a rule: no invented figure, no present tense for anything unshipped, no link to something that does not exist. Where a detail is withheld, the page says that it is withheld, or points to the trust pages. If you find a page that claims something it cannot back, that is a bug in the book, and we want to know. Use the security contact on the Vulnerability disclosure page.