Non-profit · open · built by practitioners
Free lessons, attack breakdowns and honest tool reviews from the identity security community. Sourced, dated and free of sponsorship.
Learn
Each path strings together guides, standards pages and glossary entries already on the site, in the order we would read them. Start anywhere; nothing is gated.
Learn it in a minute
Six steps between you, an identity provider and the app. Each one has a glossary entry, and each one is a place attackers aim for.
The app does not check your password itself. It sends your browser to the identity provider it trusts.
Glossary: Identity provider →You prove the first factor: a password, or better, a passkey bound to this site.
Glossary: Passkey →A second factor, ideally phishing-resistant, so a stolen password alone is not enough.
Glossary: MFA →An ID token says who you are. A separate access token says what the app may do for you.
Glossary: ID token →It verifies the signature, the audience and the expiry before it trusts a single claim.
Glossary: Access token →The app sets a session cookie. Steal that cookie and every step above is skipped.
Glossary: Session hijacking →Updated every day
Chainalysis said on November 4 that names, usernames, password hashes and live tokens for all users were exposed, reversing its October 30 statement that no session tokens were accessed. It took KYT, address screening and its login page offline after abnormal activity.
Affects Zammad. Disclosed Sep 29, 2026.
The digest · Issue 20
Binance traced its $6.34 billion theft to a fake job interview, an internal AI tool and a deployment token on a laptop, Microsoft showed Teams help desk calls ending in AD CS certificates for a domain controller, and stolen workload credentials drove Northflank, Todyl's Entra ID campaign and Google's LLMjacking report.
Get it every week, free →
Non-profit and open
Start with Identity is written and reviewed by volunteer practitioners. There is no sponsorship and no paid placement, and everyone who contributes is credited.
Every guide, brief and profile is open. No paywall, no signup wall.
Spot something wrong or missing? Tell us, or write it with us.
Shipped work carries your name and a contributor profile.
Your name goes here when your first contribution ships. How credit works
Public figures we profile in our experts directory. They are not members of this community and their profiles are not endorsements of it.
Sourced, dated and vendor-neutral.
Highest scored
Against our published capability matrix
Identity security, by the numbers
of breaches start with stolen credentials
Source: Verizon DBIR 2026 ↗machine identities outnumber humans
Source: Palo Alto Networks 2026 Identity Security Landscape ↗passkeys are now in use worldwide
Source: FIDO Alliance 2026 ↗of identity attacks blocked by phishing-resistant MFA
Source: Microsoft Digital Defense Report 2025 ↗Join free
This Week in Identity: the breaches, standards and vendor moves that matter, with sources linked. Free, no sponsorship, and every past issue is public.