Tag
All topics →Authentication done right: passwords, passkeys, MFA, SSO, and the patterns that keep logins both secure and low friction.
113 stories, newest first.
Latest
Agents can already prove who they are. What no standard has cleanly solved is passing scoped authority down a multi-hop chain across organizations. Here is the real state of agent identity in 2026, minus the blockchain hype.
Read the article
Passkeys, post-quantum crypto, silent network authentication, AI behavioral biometrics, and decentralized identity are fusing into one login stack. Here is what it looks like by 2030, and the two moves in 2026 that decide whether you are ready.
Every CTO re-litigates build vs buy for authentication every 18 months, and the framing is broken. The real question isn't build or buy. It's which parts of identity are commodity and which parts are your actual product.
74,000 Fortinet admin credentials cracked by GPU clusters from config backups stolen via old vulnerabilities. Patching the device wasn't enough.
Identity vendors rarely die of bankruptcy. They die of acquisition, then neglect, then a shutdown email. A complete history of every dead CIAM vendor, the pattern behind the deaths, and the questions that protect you from the next one.
Whether Auth0 is too expensive depends entirely on who's asking. A framework for telling the regulated enterprise buyer (pay and negotiate) apart from the high-volume, cost-sensitive platform (migrate), with 2026 pricing and breach-cost data.
Scaling a CIAM platform past a billion users taught me that customer identity is a trust problem: progressive profiling, risk-based auth, and passwordless done right.
Okta and Microsoft no longer define the CIAM market alone. Five developer-first, passwordless-native, and AI-ready platforms are growing fast by solving the specific problems the incumbents leave unaddressed. Here is where each one fits in 2026.
JWT versus opaque tokens for API authentication: statelessness versus revocation, latency at global scale, blast radius, and the hybrid pattern most large deployments use.
"Is eSIM safer than a physical SIM?" has a more interesting answer than most articles give. Each SIM type, physical, eSIM, and iSIM, has a different architecture and a different attack surface. Here is how they actually work and which is genuinely more secure.
Auth0 (Okta) versus ForgeRock (Ping Identity), compared on developer experience, CIAM versus workforce IAM, deployment models, extensibility, standards, and pricing.
Most data breaches don't come from sophisticated zero-day attacks. They come from stolen credentials, misconfigurations, and unpatched systems. Here is a practical, prioritized playbook for preventing the breaches that actually happen.
Most "use bcrypt" posts are from 2014. Argon2 won the Password Hashing Competition in 2015 and nobody updated. Here is the actual 2026 decision framework for picking a password hashing algorithm.
A founder's guide to the difference between authentication and authorization in 2026, with passkeys, agent auth, JWT pitfalls, and the mistakes I see at scale.
We cancelled Auth0 over a year ago. Not because it stopped working, but because scaling to 350,000 monthly active users made the pricing model untenable.
The CIAM platform that got you to 1 million users won't get you to 10 million AI agents.
Silent Network Authentication verifies users in 1-4 seconds using SIM cryptography without any user action.
Passwords are responsible for 80% of data breaches. Passwordless authentication eliminates the attack surface entirely.
The most powerful cryptographic primitive you've never heard of. Zero-knowledge proofs prove you know something without revealing what you know, and
March 2026 marks passwordless tipping point: Microsoft forces passkey migration, regulatory deadlines hit, and adoption surges to 69% of consumers.
Not all passwordless solutions are built the same. Some excel at enterprise compliance; others at developer speed or consumer UX.
60% of phishing breaches now bypass traditional MFA. Learn how AI-powered adaptive authentication and behavioral biometrics create continuous security
87% of enterprises are deploying passkeys. This complete playbook covers architecture decisions, enrollment UX, recovery design, and the deployment
A comprehensive developer guide to implementing secure authentication in modern applications. Covers OAuth 2.
A Comprehensive Guide for Investment Bankers, Private Equity, and Venture Capital Professionals
Authentication determines who gets in and who stays out. Getting this right means fewer breaches, less downtime, and stronger trust with customers.
Comprehensive guide comparing password hashing algorithms - Argon2, Bcrypt, Scrypt, and PBKDF2.
Struggling with MCP authentication? The November 2025 spec just changed everything. CIMD replaces DCR's complexity with a simple URL-based approach, no
One year after launch, MCP has become the universal standard for connecting AI agents to enterprise tools, with 97M+ monthly SDK downloads and backing
Looking for Delinea PAM alternatives? Discover 10 powerful privileged access management solutions offering advanced security features, seamless
Explore the top 6 alternatives to Firebase Authentication, from MojoAuth’s passwordless login to Okta’s enterprise IAM, and find a secure, scalable CIAM
Looking for AWS Cognito alternatives? Compare MojoAuth, Auth0, Okta, FusionAuth, and Keycloak for secure, scalable, and flexible customer identity
Looking beyond Auth0? Compare FusionAuth, Keycloak, Cognito, Firebase, and MojoAuth for SSO, MFA, passkeys, and social logins, plus pricing,
Twilio acquiring Stytch signals a major shift in developer CIAM. I've analyzed 20+ platforms, from Descope to Keyclock, to show you which deliver on
Explore 10 top alternatives to RSA SecurID, featuring MFA, SSO, and risk-based authentication solutions.
70% of Americans feel overwhelmed by passwords, yet only half choose secure ones despite knowing the risks.
Discover the top 5 credential management solutions of 2025. From Entrust's PKI expertise to Okta's extensive integrations, find the perfect platform to
🚀 Developers: Boost user signups by 90% with Google One Tap Login! This complete 2025 guide covers implementation, security considerations, and 5
Authentication migrations fail 40% of the time, costing millions in downtime. Learn the strategies security leaders use to avoid disaster, choose the
Choosing the right authentication provider? A comprehensive directory covers 30+ top CIAM solutions from enterprise leaders like Auth0 to innovative
The identity industry faces its biggest shift yet: machines now outnumber humans 90:1 in digital systems.
From Basic Auth’s simplicity to OAuth 2.0’s delegated muscle, this quick-read unpacks the strengths, gaps, and best-fit use cases of the four core REST
Struggling with Auth0's pricing or technical limitations? This comprehensive guide analyzes the top commercial and open-source authentication alternatives
86% of users abandon websites due to poor authentication experiences. Discover how AI can transform your login and registration pages into conversion
At RSAC 2025, the cybersecurity landscape underwent a seismic shift. This analysis reveals how autonomous AI agents, deepfake technologies, and quantum
In a world where credential breaches cost companies millions, strong authentication isn't optional, it's essential.
Authentication pages serve as both security checkpoints and critical SEO touchpoints. While 80% of data breaches involve compromised credentials, properly
Authentication issues block 75% of enterprise SaaS deals, with companies losing millions in revenue annually.
Uncover the mechanics of password hashing and salting, and how these techniques are pivotal in defending against cyber threats.
CIAM has evolved from a security tool into a business advantage. This comprehensive guide explores how CIAM solutions balance robust security with
Discover how JSON Web Tokens (JWT) revolutionize web authentication. This guide covers everything from basic concepts to advanced security measures,
Understand different token types, from bearer tokens to PATs, along with their implementation strategies and security considerations.
Dive into the world of AI agent authentication, where cutting-edge security meets autonomous systems.
Dive deep into the technical fundamentals of Authentication and SSO systems. Learn how HTTP, security protocols, and best practices work together to
Dive into the world of Security Assertion Markup Language (SAML), from its core concepts to practical implementation.
Discover the essentials of FIDO2 authentication implementation in this developer-focused guide.
Explore the technical realities of passwordless authentication in this comprehensive analysis.
Tired of passwords? AI is ushering in a new era of authentication! This post delves into cutting-edge technologies like behavioral biometrics, risk-based
Dive into the identity and access management world with a technical comparison of OpenID Connect (OIDC) and Security Assertion Markup Language (SAML).
Authentication: The digital gatekeeper. Explore the hidden infrastructure and cutting-edge security keeping your data safe online.
AI revolutionizes access management by enabling intelligent provisioning, dynamic access control, and fraud prevention.
The shift towards AI-powered IAM promises to enhance security, improve user experiences, and simplify complex access management tasks.
Dive into a clear technical guide explaining JWT, OAuth, OIDC, and SAML. Learn their strengths and weaknesses and use cases to choose the right approach
Machines against machines, AI promises the future’s most decisive counterpunch against surging account takeover threats.
Discover the future of secure and innovative authentication with WebAuthn. Say goodbye to passwords and hello to passwordless auth and passkeys.
In the fast-paced world of the internet, where every click, every search, and every interaction leaves a digital footprint, the security of human
Secure your online accounts with out-of-band authentication. Learn more about cyber security and how it can protect your information.
Cybersecurity is a continuous journey, but with solid authentication systems, this trip can be safer for everyone on board.
Don't leave your website's security to chance! Insure it against cyber threats with web session tokens, the ultimate insurance policy for your online
OAuth 2 allows users to grant third-party applications access to their accounts without sharing their passwords.
Looking for a comprehensive guide to mobile authentication? Look no further than our Developer's Guide!
Discover how Single Sign-On (SSO) is revolutionizing digital identity management. Learn about the benefits of SSO and how it is changing the game for
Registration forms are like a bad dream that never ends. But with lazy registration, it's like waking up to a beautiful day without a care in the world.
CIAM becomes prominent and requires cross-functional collaboration and deliberate decision-making
By incorporating built-in platform authentication mechanisms, including MFA and adaptive authentication, you can build the trust of your customers by
RESTful APIs are still vulnerable to various security risks. In this article, we will explore five common RESTful API security risks and discuss how to
Verifiable credentials ensure individuals have total control over their personal information and need to verify their data instead of providing it.
Authentication, identity verification, and identification answer three different security questions. Confusing them is how products end up with weak controls.
Out-of-band authentication adds a second communication channel to verify the user. Here is how it works and where it earns its keep.
Traditional IAM was built for employees, not customers. Here are five signs your IAM cannot do the CIAM job and what to fix.
Most B2B SaaS companies bolt on identity as an afterthought. After scaling a CIAM platform to 1B+ users, I learned that getting identity right from the
Single sign-on and social login both reduce password friction, but they solve different problems. Here is when to use each.
Cross-device authentication promises one identity across phones, laptops, and TVs. The privacy trade-offs deserve a hard look.
OAuth 2.0 client credentials grant explained: how services authenticate to each other, request scoped tokens, and call APIs without a user in the loop.
Whether we talk about inappropriate data collection or a loophole in managing consumer identities, anything could lead to compromised sensitive
Decentralized identity is becoming a reality for users of blockchain-based applications, and it’s thanks to the proliferation of unique, verifiable identifiers.
To verify the identity of clients, many security-minded organisations use multi-factor authentication.
Credential stuffing exploits password reuse at industrial scale. Here is how it works and the layered defences that actually stop it.
Many users switch websites when they are bombarded with lengthy registration forms too early. The solution to this is lazy registration
Account sharing on streaming platforms is now a revenue and security problem. Concurrent-session limits are a key part of the answer.
Cookies vs. JWTs for authentication: how each works, where each fits, and why most modern systems run both side by side across web, mobile, and API surfaces.
A practical guide to turning on two-factor authentication across the accounts that matter, with the right method for each.
Forward-looking businesses are using artificial intelligence to solve real-world digital identity challenges.
When investing in a password manager for business, always prioritize better functionality and security over fancy designs or a complicated interface.
These easy login methods might be the nail in the coffin. We take a brief look at the death of passwords, and how to prepare for a passwordless future.
Enterprises need to use methods to maximize the use of digital identities for multiple users.
Retail identity is uniquely hard: high volume, low margin, omnichannel, and fraud-heavy. Here are the challenges and how to address them.
SAML and OIDC both enable single sign-on. They have different strengths and the right choice depends on the audience you serve.
Follow my blog with Bloglovin [https://www.bloglovin.com/blog/21054273/?claim=rf6ng2jvpc4]When it comes to Digital Identity concepts, Authentication is
Many businesses are facing challenges in dealing with phishing attacks. Here’s an insightful read to defend against phishing attacks and improve your business.
Continuous authentication treats trust as a stream, not a single login event. Here is how it works and where it earns its keep.
Broken authentication is one of the most common and most damaging classes of web vulnerability. Here is how it happens and how to stop it.
Most web-application breaches still come from a small set of well-known threats. Here are the seven that matter most and how to stop them.
In reality, there are so many mistakes that can make your account vulnerable to cyber attacks.
Security problems are an alternative way to recognise your customers when they have forgotten their password, entered too many times the wrong passwords,
How I built LoginRadius into an IDaaS platform that handles hybrid environments, SSO, MFA, and compliance at scale.
Single-page apps changed how auth works. Here is how we approached SPA security at LoginRadius and the patterns worth keeping.
Authentication proves who you are. Authorization decides what you can do. Here is why mixing them up causes most access-control bugs.
In the previous article (Guide to Digital Identity-Part 1 [https://medium.com/@dip_ak/guide-to-digital-identity-part-1-4b7c8fe45ee1]), we talked about the
Overall, a major challenge for corporations is poor passwords combined with smart hackers.
Single sign-on authentication, or SSO, is becoming more commonplace as the digital revolution continues to evolve.
In order to serve customers, conventional identity management is no longer enough.
Social login still has a place, but it is no longer the front door. A practitioner's view on when to use it, how to harden it, and what is replacing it.
