tag: #authentication

Most MFA does not stop phishing. SMS, TOTP, and push approvals are all secrets the user can be tricked into handing over, and in 2026 the tools that trick them are a commercial service. Only one thing actually stops it: an authenticator that is cryptographically bound to the real site's origin, so it stays silent on the fake one. That is FIDO2, and it is the whole point.

The one fact that makes Kubernetes authentication click - there is no user object. The API server never stores users. It only verifies a credential from outside and reads a name off it. Once you know that, the whole model stops being confusing.

At some point JWTs became the default answer to "how do I keep a user logged in." For most applications it was the wrong choice. A JWT's headline feature is that the server does not remember it, which is the same sentence as "the server cannot forget it" — so you cannot revoke a session when you need to. Add the algorithm confusion attacks the format invites, and the boring opaque session cookie turns out to be safer, simpler, and revocable for anything that does not need stateless cross-boundary verification.