Engineering, security, and product updates
Deep dives into how we build a security-first identity provider. Post-quantum crypto, privacy engineering, and hard-won lessons from production.
Product posts
An Identity Pass Anyone Can Verify Without Asking Us
Most digital ID schemes verify by calling the issuer, which means the issuer learns every place you present it. Identity Pass is an RS256-signed credential checked against a public JWKS instead, so verification is offline, the address is rotatable, every field has its own switch, and the subject is pairwise.
Why We Made 2FA Mandatory for Social Sign-In
Social OAuth providers verify email ownership, but they cannot tell us about device compromise or credential stuffing upstream. Starting this month, every social-linked account is prompted for a second factor within 24 hours of first login. Here is the data that drove the decision.
Stay in the loop
Get notified when we publish new posts about security, engineering, and product updates. No spam, unsubscribe any time.
We respect your privacy. Read our Privacy Policy.