HN Atlas
← All topics

Authentication and identity

Authentication, authorization, OAuth, passkeys, MFA, directories, and identity security.

6,150 stories · 77 in 30 days · Updated Sep 28, 2026

The pace of conversation

Posts per month

2020-01: 63 posts2020-02: 56 posts2020-03: 69 posts2020-04: 82 posts2020-05: 106 posts2020-06: 83 posts2020-07: 90 posts2020-08: 102 posts2020-09: 77 posts2020-10: 62 posts2020-11: 58 posts2020-12: 73 posts2021-01: 71 posts2021-02: 57 posts2021-03: 97 posts2021-04: 80 posts2021-05: 58 posts2021-06: 53 posts2021-07: 44 posts2021-08: 54 posts2021-09: 49 posts2021-10: 64 posts2021-11: 70 posts2021-12: 52 posts2022-01: 76 posts2022-02: 62 posts2022-03: 75 posts2022-04: 89 posts2022-05: 80 posts2022-06: 80 posts2022-07: 77 posts2022-08: 76 posts2022-09: 96 posts2022-10: 69 posts2022-11: 81 posts2022-12: 78 posts2023-01: 95 posts2023-02: 82 posts2023-03: 71 posts2023-04: 88 posts2023-05: 101 posts2023-06: 80 posts2023-07: 88 posts2023-08: 81 posts2023-09: 71 posts2023-10: 106 posts2023-11: 91 posts2023-12: 64 posts2024-01: 78 posts2024-02: 97 posts2024-03: 54 posts2024-04: 68 posts2024-05: 80 posts2024-06: 62 posts2024-07: 66 posts2024-08: 74 posts2024-09: 68 posts2024-10: 97 posts2024-11: 70 posts2024-12: 74 posts2025-01: 70 posts2025-02: 63 posts2025-03: 86 posts2025-04: 72 posts2025-05: 82 posts2025-06: 87 posts2025-07: 74 posts2025-08: 91 posts2025-09: 69 posts2025-10: 50 posts2025-11: 55 posts2025-12: 71 posts2026-01: 77 posts2026-02: 84 posts2026-03: 114 posts2026-04: 101 posts2026-05: 64 posts2026-06: 80 posts2026-07: 94 posts2026-08: 78 posts2026-09: 73 posts
2020-012026-09

Posts per month · first and latest months may be partial.

01 / EXPLORE THROUGH TIME

Timeline

Start with the latest. Scroll back through time, or zoom in for more.

Year by yearUp to 5 stories per year
2026765 stories
Identity verification on Claude↗ support.claude.com · HN · 735 comments · 866 points · Jun 21, 2026
I'm reluctant to verify my identity or age for any online services↗ neilzone.co.uk · HN · 622 comments · 974 points · Mar 03, 2026
I verified my LinkedIn identity. Here's what I handed over↗ thelocalstack.eu · HN · 490 comments · 1483 points · Feb 21, 2026
Anthropic officially bans using subscription auth for third party use↗ code.claude.com · HN · 792 comments · 655 points · Feb 19, 2026
Discord will require a face scan or ID for full access next month↗ theverge.com · HN · 2041 comments · 2046 points · Feb 09, 2026
2025870 stories
Frequent reauth doesn't make you more secure↗ tailscale.com · HN · 516 comments · 1279 points · Jun 12, 2025
Cloudlflare builds OAuth with Claude and publishes all the prompts↗ github.com · HN · 529 comments · 889 points · Jun 02, 2025
A new form of verification on Bluesky↗ bsky.social · HN · 296 comments · 384 points · Apr 21, 2025
Privacy Pass Authentication for Kagi Search↗ blog.kagi.com · HN · 341 comments · 939 points · Feb 13, 2025
Okta Bcrypt incident lessons for designing better APIs↗ n0rdy.foo · HN · 166 comments · 377 points · Feb 05, 2025
2024888 stories
Bitwarden SDK relicensed from proprietary to GPLv3↗ github.com · HN · 369 comments · 1014 points · Oct 24, 2024
The Copenhagen Book: general guideline on implementing auth in web applications↗ thecopenhagenbook.com · HN · 184 comments · 750 points · Oct 10, 2024
Flaw has Microsoft Authenticator overwriting MFA accounts, locking users out↗ csoonline.com · HN · 311 comments · 497 points · Aug 17, 2024
Should I use JWTs for authentication tokens?↗ blog.ploetzli.ch · HN · 405 comments · 577 points · May 27, 2024
Instead of “auth”, we should say “permissions” and “login”↗ ntietz.com · HN · 345 comments · 614 points · May 27, 2024
20231,018 stories
Autorize – Authorization enforcement detection extension for Burp Suite↗ github.com · HN · 11 comments · 50 points · Dec 29, 2023
What Is OIDC?↗ fusionauth.io · HN · 65 comments · 92 points · Dec 22, 2023
Can't sign in with FIDO2 key on office.com↗ bugzilla.mozilla.org · HN · 29 comments · 101 points · Dec 02, 2023
1Password detects "suspicious activity" in its internal Okta account↗ arstechnica.com · HN · 43 comments · 68 points · Oct 23, 2023
Supabase Auth: SSO, Mobile, and Server-Side Support↗ supabase.com · HN · 10 comments · 51 points · Apr 13, 2023
2022939 stories
Gmail 2FA causes the homeless to permanently lose access 3 times a year↗ twitter.com · HN · 729 comments · 882 points · Oct 07, 2022
Keycloak: Open-Source Identity and Access Management↗ keycloak.org · HN · 234 comments · 388 points · May 04, 2022
Heroku resetting passwords for “a portion” of their users immediately↗ news.ycombinator.com · HN · 169 comments · 340 points · May 04, 2022
Updated Okta Statement on Lapsus$↗ okta.com · HN · 226 comments · 341 points · Mar 22, 2022
Using HTTP Basic Auth in 2022↗ joeldare.com · HN · 334 comments · 524 points · Jan 01, 2022
2021749 stories
Stripe Identity↗ stripe.com · HN · 536 comments · 1057 points · Jun 14, 2021
Permission.site↗ permission.site · HN · 178 comments · 728 points · Mar 26, 2021
Okta to Acquire Auth0 for $6.5B↗ cnbc.com · HN · 315 comments · 632 points · Mar 03, 2021
Show HN: Clerk – all of user management as-a-service, not just authentication↗ clerk.dev · HN · 223 comments · 582 points · Feb 08, 2021
Steam's login method is kinda interesting↗ owlspace.xyz · HN · 226 comments · 523 points · Jan 11, 2021
2020921 stories
Sick of spending time on Auth, we built an open source 'Stripe for Auth'↗ news.ycombinator.com · HN · 339 comments · 545 points · Dec 17, 2020
Don't use third party auth to sign in↗ gurjeet.singh.im · HN · 527 comments · 842 points · Nov 14, 2020
OAuth 3↗ oauth.net · HN · 208 comments · 413 points · Oct 22, 2020
Don’t require a user to be interested twice: lessons on reducing signup friction↗ bbirnbaum.com · HN · 199 comments · 394 points · May 13, 2020
Keycloak: Open-source identity and access management↗ keycloak.org · HN · 122 comments · 455 points · Apr 14, 2020
Scroll through time ↕

02 / CATCH UP

The conversation now

Popular stories, with attention fading over roughly two weeks.

Ask HN: How to recover Google auth after phone stolen?↗ news.ycombinator.com · HN · 131 comments · 124 points · Sep 17, 2026
How we rebuilt complex permissions without migrating to Zanzibar↗ infisical.com · HN · 16 comments · 73 points · Sep 09, 2026
Omarchy: 1Password and 37signals become Distinguished Corporate Patrons↗ omarchy.org · HN · 135 comments · 87 points · Aug 31, 2026
My security camera shipped a GitHub admin token in its login page↗ hhh.hn · HN · 242 comments · 645 points · Jul 24, 2026
Tell HN: Namecheap gave my account to an unverified third party↗ news.ycombinator.com · HN · 177 comments · 498 points · Jul 23, 2026

03 / GO DEEPER

Follow your curiosity

Find a particular story, revisit a year, or see what resonated.

Highest rated · the last 30 days

Ask HN: How to recover Google auth after phone stolen?↗ news.ycombinator.com · HN · 131 comments · 124 points · Sep 17, 2026
Omarchy: 1Password and 37signals become Distinguished Corporate Patrons↗ omarchy.org · HN · 135 comments · 87 points · Aug 31, 2026
How we rebuilt complex permissions without migrating to Zanzibar↗ infisical.com · HN · 16 comments · 73 points · Sep 09, 2026
Authentication Is Largely Solved. Authorization Isn't↗ technometria.com · HN · 13 comments · 15 points · Sep 09, 2026
Ask HN: Why do many websites use a sign-in code instead of a password?↗ news.ycombinator.com · HN · 4 comments · 9 points · Sep 04, 2026
Show HN: Authorize MCP tool calls without giving agents the credentials↗ github.com · HN · 8 comments · 7 points · Sep 14, 2026
Show HN: EACL is a situated ReBAC authorization library for Datomic and Datahike↗ github.com · HN · 0 comments · 6 points · Sep 15, 2026
Amazon Is Requiring Passkeys↗ news.ycombinator.com · HN · 7 comments · 6 points · Sep 01, 2026
Show HN: Oauthcli – CLI for checking/testing/verifying OAuth 2.1 servers↗ github.com · HN · 0 comments · 5 points · Sep 13, 2026
Ask HN: Allow agents access to cloud files with least privilege?↗ news.ycombinator.com · HN · 2 comments · 4 points · Sep 27, 2026

10 stories shown.

Help shape Hacker Atlas

Useful, confusing, or missing something? I’d love to hear.

Your feedback is private. Your email is only used to reply, never to sign you up for a newsletter.