Identification & Authentication

With neither Twotle nor Deposplit needing “typical” user accounts, neither the book nor this site cover them. Suffice to say that I would not implement user accounts myself anymore (even though I seem to have got them right with respect to password storage years before many major sites thanks to the first edition of Cryptography Engineering). Instead, I would leave identity management to the pros by falling back on an Identity as a Service (IDaaS) provider such as Zitadel, on an off-the-shelf Identity and Access Management (IAM) solution such as Keycloak, or on so-called social login (either directly or via Zitadel or Keycloak). If you still want to implement user accounts yourself, you should at the very least take advantage of a security library such as pac4j.

To probe further, check Solving Identity Management in Modern Applications out. (If you understand German, you could also check Authentifizierung und Autorisierung out.)