Teardowns
How real products handle auth, and post-mortems of the breaches an identity control would have stopped.
Why Passwords Fail (and What to Ship Instead)
Identity · intro · 8 minA shared secret you can type is a secret an attacker can replay. What actually breaks, what does not fix it, and the order to replace passwords.
SMS MFA Is Not MFA
Identity · intro · 7 minNIST restricted SMS as an authenticator in 2017. SIM swaps and real-time phishing are why. What to rip out, and what to put in.
Replace Static API Keys
AI Security · practitioner · 8 minA long-lived key in a repo or an agent env is a master key you cannot inventory. Workload identity, short-lived tokens, and brokered secrets are the replacement.
Blue Checks Are Not Security: What Each Badge Actually Proves
Email Security · intro · 7 minGmail's checkmark proves a trademark. X's proves a payment cleared. LinkedIn's proves an ID matched a face. What each badge checks, what it costs to counterfeit, and why none of them make a message safe.