Identity and Access

if i have to write one more custom regex to validate a password policy that even the devs dont understand i might actually lose it. why are we still doing this? honestly, just let users use passkeys and stop making us gatekeep entropy at the application layer.

everyone is obsessed with slapping mfa on everything like it is some magic dust. it is not. if your identity provider is a mess, mfa is just a speed bump for a competent phisher. we are wasting cycles perfecting authenticator flows instead of actually isolating our internal apps.…