June 15, 2026
Uncategorized
OAuth + SPIFFE = No Secrets!
Want to get rid of OAuth client secrets? SPIFFE holds the key. Want to know how? That is what the new OAuth SPIFFE Client Authentication draft spells out. Want to dig into it with us? Come to the Identiverse 2026 session where Nancy Cam-Winget from Cisco and I will walk through what the draft does …
September 29, 2025
Identity
Authentication is not Authorization: Why treating them as the same breaks your security model
September 17, 2025
Real-World Lessons
Shai-Hulud npm Supply Chain Attack: Why Secrets Fueled the Worm
September 2, 2025
Real-World Lessons
From OAuth Tokens to API Keys: The Toxic Data Behind the Salesloft Drift / Salesforce Breach
August 18, 2025
AI
MFA vs Multi-Attestation: Why AI Needs a New Identity Model
August 5, 2025
Identity
Service Accounts Were a Shortcut. Now They’re a Liability. It’s time to go Accountless.
July 31, 2025
Real-World Lessons
Wiz’s Base44 Vulnerability Findings Spotlight a Fixable Gap: Non-Human Identity
July 16, 2025
Real-World Lessons
Another Day, Another Leaked API Key — This Time, It’s xAI
July 11, 2025
Real-World Lessons
McDonald’s McHire Breach Shows Why APIs Need Non-Human Identity and Strong Auth
July 9, 2025
CI/CD
Want Control Over Secrets? Start with Your Strategic Control Point: CI/CD.
June 30, 2025
Identity
Secret Sprawl: Understand It To Reduce Your Risk
June 19, 2025
Real-World Lessons