31 stories tagged authentication, newest first.
131 points by tensegrist | 53 comments
Mastodon thread describing a bypass of eMudhra's OTP login by encrypting OTP requests with an exposed public key, enabling brute-forcing of logins to steal certificates.
61 points by civilchaos | 49 comments
A blog post by Nicolas Mattia explaining how to set up SSH keys on macOS that are protected by Touch ID.
17 points by nonsence | 3 comments
Interactive demo of the ULDA SDK: a room-planner app whose data is client-side encrypted and synced, with an inspector comparing decrypted JSON to server ciphertext.
585 points by speckx | 732 comments
Blog post by Scott Helme arguing that passkeys are not a lock-in trap and defending their use as a secure authentication method.
934 points by laurex | 482 comments
A Substack essay for non-technical readers arguing that passkeys serve platform interests over users and advising people not to adopt them.
10 points by BisratMelak | 5 comments
GitHub repository for go-dev-auth, a zero-dependency authentication library for the Go programming language.
24 points by tanin | 19 comments
A blog post explaining how a password input with maxlength="20" silently truncated a longer password and prevented the author from logging into Vanguard.
![Screenshot of openid.net: Identity Management for Agentic AI [pdf] (2025)](https://hn.urlbox.com/shots/renders/2026/10/1/aaa4f090-32f6-4a2b-91c2-1f8da5a2de04.jpg)
68 points by cgeier | 23 comments
OpenID Foundation whitepaper PDF on identity management, authentication, and authorization challenges for agentic AI systems, edited by Tobin South.
5 points by hatimmoxs | 4 comments
BBC News article from December 2014 reporting that a hacker cloned a German politician's fingerprint using only publicly available photos.
328 points by aray07 | 175 comments
Trail of Bits blog post arguing SAML's design-by-committee complexity makes it insecure and that it should be deprecated in favor of OpenID Connect.
676 points by ethanhawksley | 665 comments
A personal blog post by Ethan Hawksley explaining why he dislikes passkeys and the tech industry's push to make users adopt them.
399 points by ksec | 532 comments
A post on X by Nikita Bier arguing that passkeys were designed by security engineers without understanding how ordinary consumers think.
348 points by terryds | 147 comments
Cloudflare blog post announcing OAuth support available to all developers to build third-party apps integrating with Cloudflare accounts.
455 points by dzonga | 265 comments
A GitHub Gist arguing that JWTs should not be used for keeping users logged in and that regular cookie sessions are a better, more secure choice.
566 points by theahura | 690 comments
Claude Code documentation page listing legal agreements, compliance certifications, and security information, including terms governing subscription authentication use.
588 points by modinfo | 172 comments
Homepage of PocketBase, an open-source single-file backend offering a realtime database, authentication, file storage, and an admin dashboard.
806 points by max__dev | 637 comments
Blog post by Daniel Huang arguing that emailed six-digit login codes are worse than passwords because they enable easy phishing attacks, citing Minecraft account thefts.
1175 points by ingve | 490 comments
Tailscale blog post arguing that forcing users to frequently re-authenticate does not improve security.
359 points by n0rdy | 150 comments
Blog post analyzing the Okta Bcrypt cache-key security incident and drawing lessons for designing safer APIs.
659 points by gepeto42 | 467 comments
Blog post by Guillaume Ross arguing that email magic login links are useful but should not be the only sign-in option, responding to 404 Media's defense of them.
374 points by franciscop | 119 comments
A blog post written as short letters to OAuth providers like GitHub and Facebook, pointing out spec violations such as token endpoints returning 200 for errors.
681 points by sebnun | 172 comments
The Copenhagen Book is a free, open-source, community-maintained guide to implementing authentication in web applications, by Pilcrow.
443 points by n2d4 | 90 comments
Stack Auth blog post explaining OAuth 2.0 by starting from a flawed authorization implementation and iteratively attacking and fixing it.
412 points by miles | 271 comments
CSO Online news article on a Microsoft Authenticator design flaw that overwrites existing MFA accounts when new ones are added, locking users out.
536 points by pantalaimon | 367 comments
Blog essay by Henryk Plötz arguing that JSON Web Tokens should not be used as authentication/session tokens, explaining the reasons.
560 points by tambourine_man | 308 comments
Blog post arguing that the ambiguous term "auth" should be replaced with "login" for authentication and "permissions" for authorization.
392 points by sschueller | 239 comments
Google Workspace Updates post announcing that from September 30, 2024, third-party apps using only passwords to access Google Accounts and Google Sync will no longer be supported.
512 points by dgudkov | 118 comments
Homepage of PocketBase, an open-source single-file backend offering a realtime database, authentication, file storage, and an admin dashboard.
653 points by ColinWright | 388 comments
Blog post by Sjoerd Langkemper arguing that short session expiration times in web applications do not meaningfully improve security.
489 points by donohoe | 554 comments
Google Keyword blog post announcing the rollout of passkeys for Google accounts as a step toward a passwordless future.
530 points by bastienbeurier | 255 comments
Nango blog post explaining why implementing OAuth across the 50 most popular APIs remains messy and inconsistent in 2023.