The experiment passed. That was the problem. A team I worked with ran their first real fault injection against the identity platform on a Thursday afternoon. The target was the session store: a Redis cluster holding roughly nine million live sessions. They cut it off at the network level for
The cutover took four seconds. The load balancer moved 100% of traffic from the blue fleet to the green fleet, connection draining finished cleanly, and the deploy dashboard turned a satisfying shade of green. Error rate: flat. Latency: flat. Somebody typed "clean cutover" in the channel and started
The bake-off had been running for six weeks and was, by any normal measure, already decided. One vendor had a feature matrix with four hundred rows and a demo that showed a login flow being reshaped live on stage. The other had a product you could describe on an index
The incident review had been going for forty minutes before anyone noticed that the first question was unanswerable. A support engineer's session had been used to pull a customer export at 02:14. The account was real, the device was enrolled, the token was valid, the policy engine
The phone starts buzzing at 01:47. It is the same notification the contractor has approved four hundred times: Are you trying to sign in? He denies it and goes back to sleep. Again at 01:49. Again at 01:52. Then a cluster — six in ten minutes, then eleven
Engineering
Most explanations of XML Signature Wrapping stop at the summary: "the attacker moves the signed element somewhere else and the parser reads the wrong one." That sentence is accurate and completely useless. It doesn't tell you what your code is doing wrong, and it doesn't tell you what a fix looks li
Engineering
Your ACS endpoint is a URL on the public internet that accepts a POST with a Base64-encoded XML document and, if it likes what it reads, logs someone in.
Engineering
I want to be clear about where I'm standing before I start listing problems: passkeys are the most significant improvement in consumer authentication in twenty years. Phishing resistance as a structural property rather than a training exercise. No shared secret to breach. No reuse across sites. If y
Engineering
The first client credentials integration takes about five minutes.
Engineering
Login is a request-response problem. The user shows up, proves something, and gets a credential. It either works or it visibly doesn't.
Engineering
At 09:12 on a Tuesday, login p99 went from 90 milliseconds to just over four seconds and stayed there for twenty-six minutes.
Engineering
If you open up the architecture of Auth0, Okta, Keycloak, Ping, and any serious in-house identity platform built in the last decade, something slightly uncomfortable becomes obvious: they all look alike. Not similar in the way that all web apps look alike. Similar in the specific, structural way tha