Tag
All topics →Authentication done right: passwords, passkeys, MFA, SSO, and the patterns that keep logins both secure and low friction.
124 stories, newest first.
Latest
Your account is only as secure as its weakest reachable path, and that path is usually recovery. A ranked guide to recovery methods, the NIST-backed design rules, and the help desk vector behind MGM, TfL and M&S.
Read the article
Chrome shipped DBSC to stable. It binds the session cookie to a key in the TPM, which makes a stolen cookie inert off the originating device. Here is the protocol, the honest limits, and the buyer checklist.
Vendor log retention ends months before the average breach is discovered. The funnel, security, and silent-failure metrics every CIAM deployment should have, and the seven-panel dashboard to start with.
More than 20 Pass-the-Passkey techniques abuse logging, session handling, and synced-key recovery. None break FIDO2. Do not freeze the rollout.
GrackerAI switched enterprise SSO from WorkOS to SSOJet, cut the annual bill by roughly $5,000, and gained the custom authentication flexibility an AI platform needs.
A decision framework for enterprise passkeys: when device-bound hardware keys beat synced passkeys, mapped to user risk, device context, compliance, and total cost. Includes the three failure patterns that surface only after rollout.
WebAuthn Level 3 was proposed for W3C Recommendation in July 2026. Encryption key derivation, cross-domain credentials, and automatic list syncing are now first-class. Here is what changed.
Everyone argues about auth pricing. Almost nobody accounts for what identity actually costs per closed deal, or notices the invoice founders obsess over is the smallest of four identity costs.
A leaked static key is a disaster; a five-minute token is mostly a shrug. Here is the credential lifecycle that gets AI agents from 24-hour tokens to ephemeral ones.
In a monolith you check who someone is once. In microservices, every hop has to ask again. Here is how I design authentication and authorization across services: edge auth, per-service verification, workload identity with SPIFFE, and centralized policy.
Passkeys demo better than any login method ever shipped. Most deployments still cannot get anyone to turn them on. Both numbers are true.
AI made it cheap to fake a face, a voice, and a video. Here is my working map of the three problems authentication now has to solve, and the tools that actually hold up in 2026: verifying people, verifying agents, and verifying content.
Your identity stack was architected for humans with browsers and thumbs. Agent traffic breaks consent, delegation, sessions, bot defence and audit at once.
Agents can already prove who they are. What no standard has cleanly solved is passing scoped authority down a multi-hop chain across organizations. Here is the real state of agent identity in 2026, minus the blockchain hype.
Passkeys, post-quantum crypto, silent network authentication, AI behavioral biometrics, and decentralized identity are fusing into one login stack. Here is what it looks like by 2030, and the two moves in 2026 that decide whether you are ready.
Every CTO re-litigates build vs buy for authentication every 18 months, and the framing is broken. The real question isn't build or buy. It's which parts of identity are commodity and which parts are your actual product.
74,000 Fortinet admin credentials cracked by GPU clusters from config backups stolen via old vulnerabilities. Patching the device wasn't enough.
Identity vendors rarely die of bankruptcy. They die of acquisition, then neglect, then a shutdown email. A complete history of every dead CIAM vendor, the pattern behind the deaths, and the questions that protect you from the next one.
Whether Auth0 is too expensive depends entirely on who's asking. A framework for telling the regulated enterprise buyer (pay and negotiate) apart from the high-volume, cost-sensitive platform (migrate), with 2026 pricing and breach-cost data.
Scaling a CIAM platform past a billion users taught me that customer identity is a trust problem: progressive profiling, risk-based auth, and passwordless done right.
Okta and Microsoft no longer define the CIAM market alone. Five developer-first, passwordless-native, and AI-ready platforms are growing fast by solving the specific problems the incumbents leave unaddressed. Here is where each one fits in 2026.
JWT versus opaque tokens for API authentication: statelessness versus revocation, latency at global scale, blast radius, and the hybrid pattern most large deployments use.
"Is eSIM safer than a physical SIM?" has a more interesting answer than most articles give. Each SIM type, physical, eSIM, and iSIM, has a different architecture and a different attack surface. Here is how they actually work and which is genuinely more secure.
Auth0 (Okta) versus ForgeRock (Ping Identity), compared on developer experience, CIAM versus workforce IAM, deployment models, extensibility, standards, and pricing.
Most data breaches don't come from sophisticated zero-day attacks. They come from stolen credentials, misconfigurations, and unpatched systems. Here is a practical, prioritized playbook for preventing the breaches that actually happen.
Most "use bcrypt" posts are from 2014. Argon2 won the Password Hashing Competition in 2015 and nobody updated. Here is the actual 2026 decision framework for picking a password hashing algorithm.
A founder's guide to the difference between authentication and authorization in 2026, with passkeys, agent auth, JWT pitfalls, and the mistakes I see at scale.
We cancelled Auth0 over a year ago. Not because it stopped working, but because scaling to 350,000 monthly active users made the pricing model untenable.
The CIAM platform that got you to 1 million users won't get you to 10 million AI agents.
Silent Network Authentication verifies users in 1-4 seconds using SIM cryptography without any user action.
Passwords are responsible for 80% of data breaches. Passwordless authentication eliminates the attack surface entirely.
The most powerful cryptographic primitive you've never heard of. Zero-knowledge proofs prove you know something without revealing what you know, and
March 2026 marks passwordless tipping point: Microsoft forces passkey migration, regulatory deadlines hit, and adoption surges to 69% of consumers.
Not all passwordless solutions are built the same. Some excel at enterprise compliance; others at developer speed or consumer UX.
60% of phishing breaches now bypass traditional MFA. Learn how AI-powered adaptive authentication and behavioral biometrics create continuous security
87% of enterprises are deploying passkeys. This complete playbook covers architecture decisions, enrollment UX, recovery design, and the deployment
Production authentication patterns for OAuth 2.0, OIDC, JWT, SAML, and WebAuthn, including the build-versus-buy maths and the storage and session decisions that are expensive to reverse later.
Authentication determines who gets in and who stays out. Getting this right means fewer breaches, less downtime, and stronger trust with customers.
Comprehensive guide comparing password hashing algorithms - Argon2, Bcrypt, Scrypt, and PBKDF2.
Struggling with MCP authentication? The November 2025 spec just changed everything. CIMD replaces DCR's complexity with a simple URL-based approach, no
One year after launch, MCP has become the universal standard for connecting AI agents to enterprise tools, with 97M+ monthly SDK downloads and backing
Replacing Delinea? Ten PAM alternatives verified for 2026, with ownership changes (CyberArk to Palo Alto, StrongDM to Delinea), pricing, and fit.
Firebase Auth has no real B2B Organizations and prices enterprise SAML free only to 50 MAU. Eight alternatives compared on verified September 2026 pricing.
Cognito's free tier shrank and its hosted UI still fights you. Eight alternatives compared on verified September 2026 pricing, plus the SRP migration trap.
Fourteen Auth0 alternatives compared on verified September 2026 pricing: Clerk, WorkOS, SSOJet, Stytch, Descope, Keycloak, FusionAuth, Cognito and more.
Twilio acquiring Stytch signals a major shift in developer CIAM. I've analyzed 20+ platforms, from Descope to Keyclock, to show you which deliver on
Ten RSA SecurID alternatives with September 2026 pricing, where RSA ID Plus fits, and how to migrate off Authentication Manager.
70% of Americans feel overwhelmed by passwords, yet only half choose secure ones despite knowing the risks.
Five credential management platforms compared on PKI lifecycle, FIDO2 and passwordless, post-quantum readiness, NIST 800-63 assurance levels and real pricing.
🚀 Developers: Boost user signups by 90% with Google One Tap Login! This complete 2025 guide covers implementation, security considerations, and 5
Authentication migrations fail 40% of the time, costing millions in downtime. Learn the strategies security leaders use to avoid disaster, choose the
The complete CIAM provider directory, not a ranking: 34 identity platforms across six categories, with current ownership, published free tiers, and fit.
The identity industry faces its biggest shift yet: machines now outnumber humans 90:1 in digital systems.
From Basic Auth’s simplicity to OAuth 2.0’s delegated muscle, this quick-read unpacks the strengths, gaps, and best-fit use cases of the four core REST
86% of users abandon websites due to poor authentication experiences. Discover how AI can transform your login and registration pages into conversion
At RSAC 2025, the cybersecurity landscape underwent a seismic shift. This analysis reveals how autonomous AI agents, deepfake technologies, and quantum
In a world where credential breaches cost companies millions, strong authentication isn't optional, it's essential.
Authentication pages serve as both security checkpoints and critical SEO touchpoints. While 80% of data breaches involve compromised credentials, properly
Authentication issues block 75% of enterprise SaaS deals, with companies losing millions in revenue annually.
Uncover the mechanics of password hashing and salting, and how these techniques are pivotal in defending against cyber threats.
Discover how JSON Web Tokens (JWT) revolutionize web authentication. This guide covers everything from basic concepts to advanced security measures,
Understand different token types, from bearer tokens to PATs, along with their implementation strategies and security considerations.
AI agents need to prove both their own identity and that a human authorized the action. Here is the three-token delegation architecture that answers both, and the security layers around it.
Dive deep into the technical fundamentals of Authentication and SSO systems. Learn how HTTP, security protocols, and best practices work together to
SAML 2.0 has been frozen since 2005 and still carries enterprise SSO, because that is what large IT organisations standardised on. Here is the protocol, the assertion flow, and the parts that go wrong.
Discover the essentials of FIDO2 authentication implementation in this developer-focused guide.
Passwordless projects fail on enrolment and recovery, not cryptography. A phased checklist from baseline to deprecation, with the metrics that matter.
Synced passkeys for most users, device-bound FIDO2 keys for admins, push as a bridge. The full comparison on security, cost, assurance level and rollout.
Explore the technical realities of passwordless authentication in this comprehensive analysis.
Tired of passwords? AI is ushering in a new era of authentication! This post delves into cutting-edge technologies like behavioral biometrics, risk-based
Dive into the identity and access management world with a technical comparison of OpenID Connect (OIDC) and Security Assertion Markup Language (SAML).
Authentication: The digital gatekeeper. Explore the hidden infrastructure and cutting-edge security keeping your data safe online.
AI revolutionizes access management by enabling intelligent provisioning, dynamic access control, and fraud prevention.
The shift towards AI-powered IAM promises to enhance security, improve user experiences, and simplify complex access management tasks.
JWT is a format, OAuth is delegation, OIDC is authentication on top of OAuth, and SAML is the XML predecessor enterprises still require. Here is how they fit together and which one your use case needs.
Machines against machines, AI promises the future’s most decisive counterpunch against surging account takeover threats.
Discover the future of secure and innovative authentication with WebAuthn. Say goodbye to passwords and hello to passwordless auth and passkeys.
In the fast-paced world of the internet, where every click, every search, and every interaction leaves a digital footprint, the security of human
Secure your online accounts with out-of-band authentication. Learn more about cyber security and how it can protect your information.
Cybersecurity is a continuous journey, but with solid authentication systems, this trip can be safer for everyone on board.
Don't leave your website's security to chance! Insure it against cyber threats with web session tokens, the ultimate insurance policy for your online
OAuth 2 allows users to grant third-party applications access to their accounts without sharing their passwords.
Looking for a comprehensive guide to mobile authentication? Look no further than our Developer's Guide!
Discover how Single Sign-On (SSO) is revolutionizing digital identity management. Learn about the benefits of SSO and how it is changing the game for
Registration forms are like a bad dream that never ends. But with lazy registration, it's like waking up to a beautiful day without a care in the world.
CIAM becomes prominent and requires cross-functional collaboration and deliberate decision-making
By incorporating built-in platform authentication mechanisms, including MFA and adaptive authentication, you can build the trust of your customers by
RESTful APIs are still vulnerable to various security risks. In this article, we will explore five common RESTful API security risks and discuss how to
Verifiable credentials ensure individuals have total control over their personal information and need to verify their data instead of providing it.
Authentication, identity verification, and identification answer three different security questions. Confusing them is how products end up with weak controls.
Out-of-band authentication adds a second communication channel to verify the user. Here is how it works and where it earns its keep.
Traditional IAM was built for employees, not customers. Here are five signs your IAM cannot do the CIAM job and what to fix.
Most B2B SaaS companies bolt on identity as an afterthought. After scaling a CIAM platform to 1B+ users, I learned that getting identity right from the
Single sign-on and social login both reduce password friction, but they solve different problems. Here is when to use each.
Cross-device authentication promises one identity across phones, laptops, and TVs. The privacy trade-offs deserve a hard look.
OAuth 2.0 client credentials grant explained: how services authenticate to each other, request scoped tokens, and call APIs without a user in the loop.
Whether we talk about inappropriate data collection or a loophole in managing consumer identities, anything could lead to compromised sensitive
Decentralized identity is becoming a reality for users of blockchain-based applications, and it’s thanks to the proliferation of unique, verifiable identifiers.
To verify the identity of clients, many security-minded organisations use multi-factor authentication.
Credential stuffing exploits password reuse at industrial scale. Here is how it works and the layered defences that actually stop it.
Many users switch websites when they are bombarded with lengthy registration forms too early. The solution to this is lazy registration
Account sharing on streaming platforms is now a revenue and security problem. Concurrent-session limits are a key part of the answer.
Cookies vs. JWTs for authentication: how each works, where each fits, and why most modern systems run both side by side across web, mobile, and API surfaces.
A practical guide to turning on two-factor authentication across the accounts that matter, with the right method for each.
Forward-looking businesses are using artificial intelligence to solve real-world digital identity challenges.
When investing in a password manager for business, always prioritize better functionality and security over fancy designs or a complicated interface.
These easy login methods might be the nail in the coffin. We take a brief look at the death of passwords, and how to prepare for a passwordless future.
Enterprises need to use methods to maximize the use of digital identities for multiple users.
Retail identity is uniquely hard: high volume, low margin, omnichannel, and fraud-heavy. Here are the challenges and how to address them.
SAML and OIDC both enable single sign-on. They have different strengths and the right choice depends on the audience you serve.
Follow my blog with Bloglovin [https://www.bloglovin.com/blog/21054273/?claim=rf6ng2jvpc4]When it comes to Digital Identity concepts, Authentication is
Many businesses are facing challenges in dealing with phishing attacks. Here’s an insightful read to defend against phishing attacks and improve your business.
Continuous authentication treats trust as a stream, not a single login event. Here is how it works and where it earns its keep.
Broken authentication is one of the most common and most damaging classes of web vulnerability. Here is how it happens and how to stop it.
Most web-application breaches still come from a small set of well-known threats. Here are the seven that matter most and how to stop them.
In reality, there are so many mistakes that can make your account vulnerable to cyber attacks.
Security problems are an alternative way to recognise your customers when they have forgotten their password, entered too many times the wrong passwords,
How I built LoginRadius into an IDaaS platform that handles hybrid environments, SSO, MFA, and compliance at scale.
Single-page apps changed how auth works. Here is how we approached SPA security at LoginRadius and the patterns worth keeping.
In the previous article (Guide to Digital Identity-Part 1 [https://medium.com/@dip_ak/guide-to-digital-identity-part-1-4b7c8fe45ee1]), we talked about the
Overall, a major challenge for corporations is poor passwords combined with smart hackers.
Single sign-on authentication, or SSO, is becoming more commonplace as the digital revolution continues to evolve.
IAM is for employees, CIAM is for customers, and IDaaS is how either is delivered. Here is how they differ and which one you need.
Social login still has a place, but it is no longer the front door. A practitioner's view on when to use it, how to harden it, and what is replacing it.
