Teardowns
How real products handle auth, and post-mortems of the breaches an identity control would have stopped.
Why Passwords Fail (and What to Ship Instead)
Identity · intro · 8 minA shared secret you can type is a secret an attacker can replay. What actually breaks, what does not fix it, and the order to replace passwords.
SMS MFA Is Not MFA
Identity · intro · 7 minNIST restricted SMS as an authenticator in 2017. SIM swaps and real-time phishing are why. What to rip out, and what to put in.
Replace Static API Keys
AI Security · practitioner · 8 minA long-lived key in a repo or an agent env is a master key you cannot inventory. Workload identity, short-lived tokens, and brokered secrets are the replacement.