Series
How It Works
Vendor-neutral explainers on the mechanics of identity — how the pieces actually work, and the places they quietly break. No products, no pitch.
Infostealers, and Why a Password You Changed Years Ago Can Still Burn You
Infostealer malware quietly harvests credentials and sessions from endpoints, and they circulate for years. Here is how the pipeline works and why enforced MFA is the control that defuses it.
Token Signing, and What "Token Forgery" Actually Means
Modern auth tokens are trusted because they're signed. Here is how signing works, what a signing key really is, and why stealing one means an attacker can mint valid identities at will.
OAuth Tokens Explained: Why Changing Your Password Doesn't Kick the Attacker Out
OAuth is how you let one app access another without sharing a password. Here is what the tokens are, why they outlive your password, and why a connected app is its own standing identity.
What Really Happens When the Help Desk Resets Your MFA
Account recovery is the one flow designed to grant access to someone who can't prove who they are. Here is what the reset actually does, and why it's the weakest point in your identity stack.
SCIM Provisioning: How It Works and the Places It Silently Breaks
SCIM is how accounts get created and removed across your apps automatically. Here is the mechanism, and the failure modes that leave access lingering.
The Lifecycle of a Service Account Nobody Owns
Service accounts are created in a hurry and outlive everyone who remembers them. Here is the full lifecycle, and where it quietly goes wrong.
One-Time Codes vs. Passkeys: What "Phishing-Resistant" Actually Means
Not all multi-factor authentication is equal. Here is the mechanical reason a security key or passkey stops phishing that a six-digit code can't.
What's Inside a HAR File — and Why You Should Scrub It Before You Share It
Support asks for a HAR file and you upload one without thinking. Here is what's actually in it, why it can contain live credentials, and how to strip them first.
How Session Tokens Actually Work (and Why MFA Can't Save a Stolen One)
A plain walkthrough of what a session token is, why it exists, and the reason multi-factor authentication does nothing once one has been stolen.