Identity & Authentication

37 posts

Long-form

The Verifier Never Showed Up120 min readIdentity & Authentication Leadership & Product Public Policy
Thirty years of digital identity programs, sorted by how they actually failed, and why the half of the system that decides adoption is the half nobody funds.

Posts

The WebPKI and Client Authentication Are at a CrossroadsMarch 21, 202610 min readPKI & Certificates Identity & Authentication
Agents Are More Like Humans Than Workloads. Here's Why That Matters for Identity.February 13, 202626 min readAI Identity & Authentication
From Persistent to Ephemeral: Why AI Agents Need Fresh Identity for Every MissionAugust 14, 202515 min readAI Identity & Authentication
How a $135 Billion Fraud Bootstrapped America's Digital Identity SystemJuly 16, 20254 min readIdentity & Authentication Public Policy
The Account Recovery Problem and How Government Standards Might Actually Fix ItFebruary 10, 20255 min readIdentity & Authentication Standards & Governance
The Identity Paradox: If It’s an Identity, Why Is It in a Secret Manager?February 5, 20255 min readIdentity & Authentication
AI Agent Security Needs Accountability and ControlFebruary 3, 20255 min readAI Identity & Authentication Security Practice
Why It’s Time to Rethink Machine and Workload Identity: Lessons from User SecurityJanuary 22, 20255 min readIdentity & Authentication
From Years to Seconds: Rethinking Public Key InfrastructureNovember 27, 20245 min readPKI & Certificates Identity & Authentication
Bundling and Unbundling in the NHI Market: Opportunities in Identity, Governance, and CryptographyNovember 26, 20242 min readIdentity & Authentication Leadership & Product
Rethinking Authentication: “Something You Have,” “Something You Know,” and “Something You Are” for Workloads and MachinesNovember 26, 20243 min readIdentity & Authentication Security Practice
From Static to Dynamic: Adapting PKI for Cloud-Native ArchitecturesJune 19, 20244 min readPKI & Certificates Identity & Authentication
Credential Management vs. Secret Management: Choosing the Right ApproachJune 18, 20243 min readIdentity & Authentication Cryptography & Keys
ACME vs. SPIFFE: Choosing the Right OneJune 17, 20243 min readIdentity & Authentication PKI & Certificates Standards & Governance
Automating Non-Human Identities: The Future of Production Key Management May 22, 20246 min readIdentity & Authentication Cryptography & Keys
The Rebirth of Network Access Protection with Microsoft's Zero Trust DNSMay 4, 20244 min readSecurity Practice Identity & Authentication
Gov ID: If at First You Don't Succeed, Try, Try AgainJanuary 14, 20242 min readIdentity & Authentication Standards & Governance
Why hasn’t SHAKEN/STIR made a big dent in the volume of robocalls?August 29, 20223 min readIdentity & Authentication Security Practice
User-managed smart cards are an oxymoronAugust 26, 20222 min readIdentity & Authentication PKI & Certificates
What is Fortify and how does it work?June 20, 20185 min readEngineering & Code Identity & Authentication
Blockchain, Digital Signatures and IdentityJune 15, 20153 min readBitcoin Identity & Authentication PKI & Certificates
Removing Friction From Online SignaturesMay 22, 20152 min readPKI & Certificates Identity & Authentication
Has identity verification on the web become a glass ceiling?May 6, 20153 min readIdentity & Authentication
Smart cards, PC/SC and ChromeJuly 30, 20141 min readIdentity & Authentication Engineering & Code Bitcoin
Smart cards, PIV, Bitcoin and secp256k1July 30, 20142 min readIdentity & Authentication Bitcoin Cryptography & Keys
Two Factor Authentication with BitGo and CoinbaseJuly 27, 20141 min readBitcoin Identity & Authentication
Keeping long-term passwords securedApril 23, 20141 min readIdentity & Authentication Security Practice Bitcoin
The weaknesses of fingerprint based authenticationSeptember 11, 20134 min readIdentity & Authentication Security Practice
Thoughts on Apple and fingerprint based biometricsSeptember 11, 20134 min readIdentity & Authentication
The origin of the Windows Biometric FrameworkSeptember 11, 20133 min readIdentity & Authentication
Strategies for Deploying 2FAJuly 9, 20134 min readIdentity & Authentication Security Practice
Enterprise logon with challenge response (OTP) tokensJuly 2, 20133 min readIdentity & Authentication
How to do a quick and dirty benchmark on a smart cardJune 12, 20132 min readIdentity & Authentication Engineering & Code
Certificate-based Mozilla Persona IdPApril 10, 20137 min readIdentity & Authentication PKI & Certificates
Making a Windows smartcard login certificate with OpenSSL.November 20, 20121 min readIdentity & Authentication PKI & Certificates Engineering & Code
Generic Identity Device Specification PublishedApril 9, 20103 min readIdentity & Authentication Standards & Governance
ASKING THE DRUNK IF THEY ARE DRUNK April 5, 20074 min readSecurity Practice Identity & Authentication