The Father of SSL: Passwords are holding us back

Sasha asked the question that this whole episode turns on. Lotus Notes authenticated its users with cryptography instead of passwords in 1991, so why did the industry not take that turn? Taher Elgamal did not hedge.

“It’s my fault, 100%.”

Taher Elgamal, at 6:34

Listen · Taher on episode 61, from 6:34

I pushed back, because the behavior of hundreds of millions of users is not one person’s fault, and he kept it anyway: “It’s kind of my fault, unfortunately. Well, it’s not, I mean, it is my fault.” Then he explained the design decision that produced the password field, which is the most useful ten minutes of history a founder building a login page will hear this year. We published this on January 23, 2025, with Sasha Sinkevich co-hosting, and the show notes were 36 words. This page is the rest of it: the option in SSL that nobody checked and what filled the gap, where the father of SSL tagline came from and what the patents and the Marconi Prize say he actually did, the number theory that took a Cairo University graduate to Marty Hellman’s lab, the 1991 product that already knew passwords were a bad idea, the man who invented the password to separate papers rather than to protect them, the business case for getting rid of it, what a chief technology officer for security does at a company built for 1999, the line no product requirements document has, the AI layer in front of the stack that nobody can read, why he would regulate misuse and never the tool, what he looks for in a pitch, and the two boards he sat on that cover who you are and what you can do. There are four things to try along the way: a quiz on the episode, a scorecard for how much of your company still runs on a password, a calculator for what the password field costs you a year, and a timeline you can filter.

The option nobody checked

The design decision is simple once he lays it out. Netscape wanted to use the internet, which had existed for decades without a business model, for commerce, and everyone inside the company knew that the open internet as it stood would make e-commerce “dead on arrival.” SSL was the fix: a required cryptographic authentication of the server, so that a browser could prove it was talking to Amazon and not to someone pretending to be Amazon, plus an encrypted channel. The client side got the same mechanism as an option.

“On the consumer side, there is eight billion people. VeriSign started the issue of certificates for the server side, because this is a business model. It’s going to enable e-commerce, you’re going to make money, so paying some money to get a digital certificate seemed like a reasonable thing to do. But you and I are just not going to pay for a digital certificate as consumers. It’s just, why would I do that? I mean, I’m buying something, and if you don’t trust me, that’s fine. I’m buying from somebody else. I mean, it’s like, but we put in the cryptographic authentication for the client side as an option. So there’s actually an option in SSL to use mutual authentication, as we call it today. But it was not forced. So that actually got everybody to do passwords, because how else are you going to have an account?”

Taher Elgamal, at 6:41

Listen · the option, from 7:52

The primary source agrees with him word for word. The Internet-Draft he and Kipp Hickman posted in April 1995, “The SSL Protocol,” describes a protocol in which “Servers are always authenticated, and clients are optionally authenticated” (IETF). One side of the handshake had a business paying for its certificate, and the other side had eight billion people who were not going to. So the account came from somewhere else: “So you call somebody, say, I want to have an account with eBay. They say, cool. Who are you? They get some information from you. You have an account and you have a password key. That’s how passwords actually started.” Thirty years later his closing line on the subject is still true. NordPass’s 2025 study of leaked credentials across 44 countries found “123456” the most common password in the world, as it has been for six of the last seven years (Devolutions, NordPass).

What I find generous about the answer is that he does not blame the users or the era. He lists the reasons the option stayed unchecked: “back then, we did not really have fingerprints and other biometrics to, to validate who these people are and that kind of thing,” and “Processing a certificate on the client side will probably be perceived as a lot of processing power, because running public key cryptography is not cheap.” Then the sentence that should be on the wall of every identity startup: “There were a lot of reasons why whatever happened, but it just, we waited way too long, is the problem.” The phone with a secure chip and a fingerprint reader is the client certificate that consumers never bought, which is the entire thesis of device-bound credentials, and the reason the company he sits on the board of was founded by his old boss at Netscape. More on that below.

Wikipedia actually claims

I opened with his LinkedIn profile, whose first entry is technical staff at HP in 1984 with no security in it, and asked how a graphics and compression engineer came to be called the father of SSL. His answer started with the encyclopedia.

“[Wikipedia actually claims] I’m the father of SSL. That’s where it came from. So whoever wrote that, I did not write my own Wikipedia entry, as nobody actually does. It refers to what I contributed, I suppose, to SSL, because I’m not actually technically the pure inventor of it. Although I wrote [patents] for SSL way back when, so, so that the Netscape original SSL [patents] I wrote. But I actually ended up building the team that developed the SSL 3.0 RFC, which we took to IETF to become TLS 1.0, and that became the industry standard.”

Taher Elgamal, at 1:08

The record fills in the pieces. Wikipedia’s source for the nickname is a December 2012 Network World profile by Ellen Messmer, which describes him as often called the father of SSL for his work at Netscape, and in which he already named storage and inadequate passwords as the weakest links (Network World, Wikipedia). The patents are real: US 5,657,390, “Secure socket layer application program apparatus and method,” filed August 25, 1995, granted August 12, 1997, inventors Taher Elgamal and Kipp E. B. Hickman, assigned to Netscape Communications, with a continuation, US 5,825,890, granted October 20, 1998 (Justia). The part he undersells is the standard. The Marconi Society’s account is that Paul Kocher focused on developing the protocol itself while Elgamal “led the adoption of SSL as a free and transparent industry standard,” secured Netscape’s agreement to make it free to everyone including competitors, and then led the effort to have the IETF adopt SSL 3.0 as the basis for TLS, winning Microsoft’s support over an alternative it had developed internally (Marconi Society). SSL 2.0 shipped in February 1995 with flaws, SSL 3.0 was a complete redesign in 1996 by Kocher with Netscape’s Phil Karlton and Alan Freier, TLS 1.0 arrived as RFC 2246 in January 1999, and TLS 1.3 as RFC 8446 in August 2018 (Wikipedia). “TLS got updated over the years, which of course is a wonderful thing. But it’s actually kind of surprising that it, this kind of technology lasts this long.”

The prize is the part the tape never mentions, because he is not that kind of guest. On March 13, 2019 the Marconi Society named Elgamal and Kocher the 2019 Marconi Prize recipients “for their development of Secure Sockets Layer/Transport Layer Security (SSL/TLS)” and other contributions to the security of communications, with Vint Cerf, the Society’s chair, observing that “In today’s climate, protecting communication and data across network channels has never been more important” (Rambus). It was presented on May 17, 2019 at the Hiller Aviation Museum in San Carlos.

At @Hillermuseum getting ready to honor our 2019 Marconi Prize winners Taher Elgamal of @salesforce and Paul Kocher @rambusinc #cybersecurity #cryptography

The Marconi Society (@MarconiSociety) · May 17, 2019

Three years later the National Academy of Engineering elected him for “contributions to cryptography, ecommerce, and protocols for secure internet transactions,” the third Salesforce member after Marc Benioff and Thomas Berson (Salesforce). The RSA Conference had given him its lifetime achievement award in 2009. None of which answers what he actually did, which is why the tape matters: he wrote the patents, he built the team that wrote SSL 3.0, and he ran the push that turned a company’s protocol into everyone’s.

Math is the thing

I asked whether there was a story of how he got pulled into security, and the honest answer was that he never did. He landed in cryptography, and the math was the driver.

“I came to Stanford to get a PhD. My undergrad degree was from Cairo University in Egypt, and I came to Stanford to get an advanced, so I came to grad school. That was 1979. And I studied electrical engineering, actually. So I came to study, like, electrical engineering, and I thought I would be working on estimation theory and signal processing and that kind of stuff. Math is the thing that I love the most all my life. I used to play with numbers when I was like four years old, which most little kids do not do. So when I came to Stanford and I found math classes that I can take, I just took a bunch of algebra and number theory courses, which was magnificent. I mean, it’s the best thing I’ve ever done. And then I ran into Marty Hellman, who’s then the professor who ended up being my thesis advisor, and he and Diffie invented public key cryptography in the mid-70s.”

Taher Elgamal, at 2:11

The record: a bachelor’s in electrical engineering from Cairo University in 1977, a master’s from Stanford in 1981 and a doctorate in 1984, advised by Martin Hellman, who with Whitfield Diffie had published public-key cryptography in 1976 and who would win the 2000 Marconi Prize and the 2015 Turing Award (Wikipedia, Beyond Identity). The thing he did not mention on tape, because he is not that kind of guest either, is the 1985 paper, “A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms,” in IEEE Transactions on Information Theory, which gave the world the ElGamal cryptosystem and the ElGamal signature scheme. The encryption is in GNU Privacy Guard and PGP to this day, and the Digital Signature Algorithm that NIST adopted as the Digital Signature Standard is a variant of the signature scheme (Wikipedia). Number theory, in other words, did exactly what he says it does near the end of the episode: “There are problems that are hard in one direction and very easy in another [direction]. [That’s] how public key algorithms came about.”

Then HP Labs, where he worked on data compression, image processing and computer graphics, and built “a little prototype that actually did on-the-fly data compression,” which was enough for his boss to say “hey, you’re actually handy. You’re not just an academic kind of guy. We should start a company.” The company was InfoChip, founded in 1988, and the product was a compression card that made a 20 megabyte hard disk behave like a 40, “and if you remember 1988, a 20 megabyte hard disk was actually a big deal.” The trade press of the day confirms it: a Santa Clara company called InfoChip Systems was selling the Expanz! Disk Expander Card for $199 in 1990, a half-card that compressed and decompressed in real time and claimed to increase hard disk capacity up to three times (COMPUTE!). He told Sramana Mitra in 2007 that he was the third founder and that it “did not sell for a whole lot,” but that it taught him engineering management and operations on the job (Sramana Mitra). The company he walked into next was the one that mattered.

“There was not security. When that company sold to [Cyrex], it was like three years later. I ran into RSA, the company. RSA at that time was a small company. They had less than 10 people. And I ended up being the first engineering manager. So I was actually the very first engineering manager at RSA. And I did some cryptography work also, 50-50 kind of thing. And RSA sold a cryptography toolkit, which is a software, basically a library that people bought to include cryptography into their products. You may or may not remember there used to be a thing called Lotus Notes. So that was the very first customer, actually. That was a big customer for RSA.”

Taher Elgamal, at 4:45

In the 2007 interview he put the headcount at six or seven when he joined in 1991, with Jim Bidzos as chief executive, and about twenty when he left in 1993 or 1994, by which time RSA had contracts with Microsoft, Sun and Apple and was based in Redwood Shores, in a building that is now part of the Oracle campus. He also said that the certificate business RSA had planned became the seed of VeriSign, which spun out of RSA, which makes the VeriSign in his SSL story a company he had watched form (Sramana Mitra). Then, in late 1994, at a conference in San Jose, he watched Jim Clark, whom he knew from Stanford, give a talk about encryption, emailed him afterward, consulted for Netscape for a few months, and became its full-time chief scientist in April 1995. He has said consistently that a partial version of SSL existed before he arrived and that his first job was to make it succeed (Sramana Mitra). On tape he dates the move to 1994 and the mission to one sentence: “the Netscape vision to build e-commerce on the open internet.”

Lotus knew in 1991

Sasha asked what the business need was that made Lotus put cryptography into a product in 1991, and the answer is the hinge of the episode, because the industry had the right idea and then put it down.

“It was an amazing, they used it for authentication of users. It was actually a beautifully written authentication program that would avoid passwords. Can you imagine? That was 1991. They actually wrote, [in] 1991, that passwords were a bad thing. We’re still suffering from passwords, of course. But they actually recognized that, and they wrote a very nice authentication program. So when you, in the old Lotus 1-2-3, when you actually logged in, you used a cryptographically strong authentication protocol. And then after that, every single software company you can name that existed back then bought that library, because there was just nothing else.”

Taher Elgamal, at 5:41

He means Notes, not the spreadsheet, and the record is on his side. Lotus Notes release 1.0 shipped in December 1989, after a beta so long that the product was considered vaporware, with Price Waterhouse buying 10,000 copies before launch, and Notes “was the first widely adopted software product to use public key cryptography” for client-server and server-server authentication and for encrypting data (Wikipedia). A desktop product of 1989 authenticated people with keys, and the web of 1995 authenticated servers with keys and people with a word they typed. Sasha’s question, whether the industry could have taken a different turn, is the one I would want every identity founder to be able to answer. Taher’s answer is above. Mine is that the turn is finally being taken, thirty years late, and the numbers are in the section on passkeys below.

It was invented to just separate things

The password’s origin story is the one he tells with the most relish, and it reframes what the thing was ever for.

“It was actually funny. The gentleman who invented the password worked at IBM Research in the sixties. And he, they were doing research and they were just trying to, I want to put my papers in one place and your papers go in a different place. So the idea of a password was to just, everybody knows where their stuff is at. It’s not to actually secure anything. Because when you do research, I can read your paper just as much as you can read your own. I mean, it’s all kind of research papers. So it was not invented for a security function. It was invented to just separate things.”

Taher Elgamal, at 11:17

Listen · where the password came from, from 12:00

One correction to the tape, which does not change the point. The computer password is generally credited to Fernando Corbató at MIT, not IBM, on the Compatible Time-Sharing System in the early 1960s, where users sharing one mainframe and a common disk each needed their own files, so that “people didn’t have to live in a communal setting,” as he put it in 2014. In the same interview he called what passwords had become on the web “kind of a nightmare,” admitted to keeping a crib sheet for roughly 150 of them, and said “I don’t think anybody can possibly remember all the passwords that are issued or set up” (WeLiveSecurity, IEEE Computer Society). Corbató died on July 12, 2019, at 93, and the inventor’s own verdict matches Taher’s: a filing-cabinet convention that got promoted to the front door of the internet. “Yeah, it, it just became how the internet runs, because somebody discovered, hey, if I use a password, maybe we just, that’s how people log into things.”

What the convention costs is measured every year. Microsoft observed about 7,000 password attacks per second in 2024, more than double the rate of 2023 (Microsoft). The 2026 Verizon Data Breach Investigations Report, drawn from more than 31,000 incidents and 22,000 confirmed breaches in 145 countries, found credential abuse involved at some stage of 39 percent of breaches, more than any other action, with credentials among the data taken in 28 percent, which is how the next breach gets its fuel. The share of breaches that began with a stolen credential fell to 13 percent, from 22 percent the year before, and the honest reading is that exploited vulnerabilities, now 31 percent, overtook it rather than that passwords improved: measured the old way, credential abuse would have landed at 16 percent (Descope, Help Net Security). And the breach he names at the very end of the tape, the “original Yahoo breach,” turned out in October 2017 to have covered all three billion Yahoo accounts, from an August 2013 intrusion, with passwords hashed as MD5 (TechCrunch). His sentence about it is worth keeping in your head when you design the account system for a company of six people: “I don’t think anyone should be hashing passwords in a small startup with, like, five people, six people. You delegate that.”

It’s reduction of cyber attacks

Sasha asked the YSecurity question, which is what the business need is, since no feature gets adopted without one. The answer was immediate.

“It’s reduction of, what, it’s reduction of cyber attacks. I don’t believe there is a single cyber attack, now we’re getting heavy into cyber, which is a good thing. The vast majority of cyber attacks use somebody’s credential to organize something. And if they stumble onto something that is an admin password, it’s even better, because now we have access to more stuff. And if they don’t, they try to [lure] you into something or do something else or jump into a different machine. And all of these things were built on the fact that they have access to an account someplace. Password is essentially answering the question of, which is, who are you? And even if we look at the AWS root account, it is in principle protected by password. Of course, you can add second factor authentication logic, but the root accounts in AWS are protected by password. I claim that is the wrong thing to do.”

Taher Elgamal, at 11:17

The AWS root account example aged well for his argument. Five months after this episode, Amazon Web Services said at its June 2025 re:Inforce conference that it had reached 100 percent enforcement of multi-factor authentication for root users across every account type, after requiring it for management and standalone accounts in 2024 and member accounts in March 2025, with its chief information security officer Amy Herzog noting that AWS had been “the first cloud provider to mandate the use of MFA for management and standalone accounts with root access” (The Register, AWS). The password is still there under the second factor, which is Taher’s point, but the account he picked as the example of the wrong thing to do no longer accepts a password alone.

He had run the same play himself, at a much larger scale, and the number he gave is the one every security leader planning a rollout should hear.

“The banks have actually started down that road a while back, from their own people. So they started the multi-factor authentication a long time ago, because they figured out somebody can log into a machine in production in the bank, that’s probably not a good thing. When I was at Salesforce, we encouraged every single customer to completely replace password with MFA. And actually, we had really good success. We, we had an over eighty percent success. The issue is, that was authentication into Salesforce, not the 89 other things that people need to log into. So the issue is, the landscape is, in fact, tricky. And when, because we know that the user is not gonna buy an authentication product, necessarily, the bank buys one and the Amazon has their own and just everybody has their own. And then as a user, you end up with 17 different ways to log into stuff. That is not good.”

Taher Elgamal, at 14:47

Salesforce announced in 2021 that multi-factor authentication would be required to access its products from February 1, 2022, with the Salesforce Authenticator app, time-based code apps, WebAuthn security keys and built-in authenticators such as Touch ID, Face ID and Windows Hello accepted, and one-time codes by text message, email and phone excluded because they are “inherently vulnerable to interception, spoofing, and other attacks” (The Record). The “over eighty percent” is his number from the tape, not a published figure, and I could not find Salesforce stating one. What I take from it is the sentence after: the win was one application out of ninety. The user does not buy authentication. The bank buys one, Amazon has its own, and the person in the middle ends up with seventeen ways to log in. The only answer to that is a credential that lives on the device and works everywhere, which is the standard he helped start: he is credited as the “glue” that brought the founders of Nok Nok Labs together, and Nok Nok announced the FIDO Alliance with PayPal, Lenovo, Infineon, Validity and Agnitio in February 2013 (PR Newswire). Passkeys are FIDO’s answer, and the numbers twenty-one months after this tape are the first time in his career that “we don’t need a password” has a growth curve under it.

The FIDO Alliance counted five billion passkeys in use on World Passkey Day, May 7, 2026, with 90 percent of consumers aware of them, 75 percent having enabled one on at least one account, and 68 percent of organizations deploying or actively deploying them for employee sign-in, against 57 percent whose main day-to-day employee sign-in was still a phishable method (FIDO Alliance). By October 15, 2026 the estimate was seven billion passkeys and more than a third of successful sign-ins at the fifteen major consumer services in its Passkey Index (FIDO Alliance). Microsoft made new accounts passwordless by default on May 1, 2025, reporting nearly a million passkeys registered every day, passkey sign-ins succeeding about 98 percent of the time against 32 percent for passwords, and eight times faster than a password with a second factor (Microsoft). Amazon, whose founder Taher jokes decided to put a password on the website, added passkeys in October 2023 (Amazon), and on September 1, 2026 a business customer posted to Hacker News a notice they said had come from Amazon, telling them passkeys would be required on a rolling basis with the password kept only for recovery, which I could not confirm with Amazon and which drew the question that every shared account will raise.

"This will be an interesting passkey test. Much has been spilled about the complexity of passkeys for normal users but in many cases you can just not use them or they're just tied to your personal smartphone for your personal Gmail/icloud

Amazon is an account that is shared by many between household. Will this cause user confusion"

julianozen, on Hacker News, September 1, 2026

That is the user-experience objection Sasha raised on tape, that people expect a username and a password field, and Taher’s answer to it is the safe deposit box: two keys, one yours and one the bank’s, “It’s not exactly easy to use, but you know why? Because there’s good stuff that you’re saving in there that you don’t want to be available.” People adapt. They stopped writing the PIN on the back of the card. My cynical contribution was that we now have one PIN and use it across all of our cards, and he conceded that too.

Built for 1999

Sasha asked what his greatest challenge had been at Salesforce, and I asked him to clarify the title for listeners, because chief technology officer for security is not a chief information security officer. He did not run the security operations. He was half customer-facing and half an advisor to engineering teams “to attempt to improve the security posture of the whole company,” which matches the description he gave Salesforce’s own engineering blog in 2019: half his time speaking at events and advising customers and partners, the other half acting as a security advisor to internal teams (Salesforce Engineering). The challenge was the footprint.

“Salesforce started in 99. Salesforce is an awesome company. I still have tons of friends in there. They did a lot of amazing things. But if you look at the security posture, it was built for 1999. That’s when it was started. And every few years, you improve a couple of things, and you add this and you add that. And then a customer says, hey, I need you to do this. You add the stuff that the big customers ask for. I mean, the biggest challenge is just the big footprint.”

Taher Elgamal, at 17:23

Everyone is a customer of Salesforce, I said, and if you are not, you are a customer of Slack, which is also Salesforce. He agreed, and then gave the line that applies to every company older than its security program: “you can’t go back and change fundamental architectural things 20 years after a company has started. It just doesn’t work.” You improve this and you improve that, every year, “As long as you’re doing that, you’re actually fine.” He had done it for ten years, from February 2013 to January 2023, when he announced on LinkedIn that he was leaving to join Evolution Equity as a general partner, “many friendships at Salesforce over the last 10 years that I will always cherish,” as The Register reported the week Salesforce was also losing its co-chief executive and cutting ten percent of its staff (The Register). Then, nine months before this page, he went back.

Our first Identiverse Washington, D.C. keynote speaker is here! 🎉

We’re thrilled to welcome Taher Elgamal, CTO of Security at Salesforce, to the Identiverse D.C. stage. Join us as one of digital security’s most influential pioneers shares his perspective on the future of identity, trust, and security.

📅 November 9–10, 2026
📍 MGM National Harbor

Identiverse · August 2026

Load the post from LinkedIn

So the man who recorded this as an investor is, as you read it, back inside the company whose security posture was built for 1999, in the era he described on tape as the next wave of the software stack. The LinkedIn profile that I read on air now lists both roles, chief technology officer for security at Salesforce from January 2026 and partner at Evolution Equity from January 2023, with board seats at Beyond Identity and Oleria (LinkedIn). I take the return as the most interesting data point on this page about where he thinks the problem is.

The line no PRD has

Sasha asked how a security leader keeps an organization current when there is a new product every year, and Taher answered with the structural problem under all of it, which is that we built thirty years of infrastructure without starting from security, and the keywords that have come since do not fix that on their own.

“And 25, 30 years later, you hear people talk about zero trust and secure by design and all of these things, which are wonderful things.”

Taher Elgamal, at 19:09

All the big keywords, I said. “I mean, yeah, if you keep them as keywords, then they’re a bit [hollow]. If you try to implement them, you face the reality, which is actually tough.” And then the observation I have repeated to three founders since.

“I can’t tell you how many times I told engineering leaders and product leaders, there is not a PRD that I’ve ever seen that has security things in it. So suppose you’re a PM in some company and you’re responsible for some application. And you write down the, the, I mean, you write the, the features of the product. Nobody ever writes something like, unauthorized people are not allowed to get in. In my opinion, humble opinion, that’s probably a very important thing, because if unauthorized people find their way through, bad things will happen. But that does not happen at the product level. And it transmits into the engineering level. So the engineers want to build products, and they want to build the most successful product in the world. That’s what engineers want to do.”

Taher Elgamal, at 20:32

Listen · the PRD, from 20:32

This is the same gap Michael Nov of Prime Security described from the other end on episode 76: the design stage is where security has to take a seat, because the review that happens after the code is written can only ask for changes to a thing that already exists. Taher’s version is earlier still. Put the sentence in the requirements. “Unauthorized people are not allowed to get in” is a feature, it has acceptance criteria, and if it is not written down, the engineers who want to build the most successful product in the world will build exactly what was written down. Our design-stage scorecard is the checklist for whether your product process has that line in it.

The AI layer in front

I asked how all of this plays out in the space of AI, and his answer was architectural: the next wave of the stack adds a layer nobody can get their brain around.

“Well, I mean, AI is an exaggeration of the complexity of the next wave of the software stack, because you could understand what a, a three-layer kind of architecture looks like. You can convince yourself that database is a place you put data, and you have a, a Java layer in front to process things, and you have some business logic. You can actually get your brain to get there. But when you put an AI layer in front that will serve the user something better, because the AI will actually, you know, succeed in finding out what the user is really after, understanding what that AI layer is doing is impossible. These big LLMs have trillions of parameters. I mean, there’s no way.”

Taher Elgamal, at 21:31

Sasha agreed that the technology has to be applied properly, and Taher’s reply was the humbler one: “Yeah, but nobody knows how to apply properly.” We ended up with products that talk to each other without understanding what they are saying, and that was true before the AI layer was added. “we actually do not exactly know what the software does.” It is the argument for the ladder we use for agents, read before write, and for giving the credential rather than the model the limit, which Riad Wahby made from the key-management side on episode 69. What Taher is more hopeful about is the defense. Sasha described a market of specific tools, each with a dashboard that needs a four-year degree to read, bought “to make you feel warm and fuzzy on the inside,” and Taher’s reply was that nobody looks at them. His own picture of where the intersection of AI and security goes is better than a dashboard.

“Yeah, you can actually see that, with the correct use of AI, you can have deeper understanding of the operation of an infrastructure and the suite of applications that are running. And you can teach it what looks right and what looks wrong. And the truth is, we’ve actually done that. So all the, starting with the early intrusion detection products, they actually used machine learning to do detection. So we’ve been doing that. The issue is, we’ve been finding anomalies. Anomalies is kind of whatever it means. There’s way too many anomalies. That’s why there is more alerts than people can digest. But if you build an understanding of the operation of how these things are supposed to talk to each other, you can make sense of, this is how this application runs. And this mode I’ve never seen before. And this mode really looks like there’s somebody from a foreign country trying to do something bad.”

Taher Elgamal, at 24:27

That is the design Alan Braithwaite described from the data side on episode 50, a model of how the system is supposed to behave rather than a pile of anomalies, and it is what our 24/7 monitoring and response team is paid to produce, “the actual [actionable] action instead of just throwing a lot of noise,” in Sasha’s words. Taher’s warning is that the alerts will keep increasing because AI is being added on the offense too: companies “build the automatic attack utilities,” you rent an hour or two of attack, name the target, and “if you end up with one coin in your account, then you’re good. If you don’t, then you try the next one. You don’t lose anything.” And the attackers talk to each other more than defenders do, because defenders compete and attackers do not. His reading of the fix is collective, “if we come together and actually believe that using the connected world in a good way will benefit us, then we get there,” and his reading of the state of the art is that the executive, not the engineer, is the one who needs the deeper understanding. Sasha’s immune-system analogy got his best line of the second half: a system that notices “holy cow, I have a fever” rather than asking whether a virus is attacking, “Because the answer to that is, of course, yes.”

Regulate the misuse, not the tool

I asked whether the AI change would end somewhere focused, a system that homes in on the perturbations from normal, or somewhere far more self-driving, and he answered as a man who remembers the world before the web.

“So, Jon, I mean, bear in mind, you’re talking to a guy that lived for a long time before the internet. So if you rewind 30 years, there was no internet, there were [no] mobile phones, there were pieces of paper that we wrote our schedules on. It was a completely different world. When the web came, the change that happened in the world is monumental. I mean, it changed the lives of every single human being to a degree that is hard to describe. It’s actually, I’m not claiming that we knew that ahead of time. Maybe some people did. So I think the AI level of change is of the same magnitude.”

Taher Elgamal, at 34:27

The digital world brought ransomware and fraud with it, “and the level of fraud in the digital world is still an order of magnitude higher than in the physical world,” so AI “will also bring the same level of threat.” Where he lands is a principle, and he said it twice.

“And I’ve said this before, it’s my opinion. Regulating technology is a very bad idea. We should [stop] talking about it. I mean, a baseball bat can be used for a very bad thing, by the way. You can imagine, right? That does not mean we should stop making baseball bats, because it’s also fun to watch baseball games. So we should find a good compromise [on] specific uses of technology.”

Taher Elgamal, at 35:34

Cryptography was in that place, I said, and he took it personally in the best way: “Absolutely. And still [is]. I mean, all ransomware uses cryptography. Am I responsible for it? I don’t know.” He is not, and the distinction he drew is the one I would want in any policy conversation: “misuse of technology, intentionally, to harm others, is the thing that we have to regulate and prosecute and do whatever the heck you should do.” Regulating the tool mostly hurts the defenders, and the people responsible for national security, “God bless them, they’re good people,” are helped by a deeper understanding of the technology, not by a rule about it. When I suggested they have their fingers in trust stores and random number generators, he let me keep my tinfoil hat and gave the same answer: understanding finds the bad guy.

The je ne sais quoi of a pitch

A lot of founders listen to this show, so I asked what a partner at Evolution Equity looks for in a pitch and what the red flag of red flags is. The order he gave is the order on the figure.

“So when I talk to a brand new company, or a company that’s been around for a year or two, a young company, it’s actually team that matters the most. What have the team done in the past? What is their approach to solving problems? Who do they know? Who do they, who were their advisors? Who did they talk to? And that tells a lot. And then the second and most important thing is what market they are actually trying to target, not what they’re building. Because if the market is not big, actually, it almost doesn’t matter how cute the product is. And I keep telling people: the companies that had an impact, of the companies that became large, are not the companies that built the best technologies.”

Taher Elgamal, at 39:33

Listen · what he looks for, from 39:29

He said the technology is “the number three criteria,” and then owned it: “I made these mistakes myself, because I started companies in the past. And at the time, I might have thought this was the best technology in the world, but maybe it was, but who cares?” The record of those companies is the proof. Securify, founded in early 1998 with Dan Kolkowitz, raised $4.5 million that June and was sold to Kroll-O’Gara on December 31, 1998, for about 1.4 million shares, a deal he has valued at about $65 million, six months after the raise. He ran Kroll’s information security group for about a year and a half, spun the product business back out, and a decade later Secure Computing bought Securify for roughly $15 million plus an earn-out (Kroll-O’Gara, Sramana Mitra, eWeek). The firm he was pitching for when we recorded had become one of the largest in the category nine months earlier: on April 16, 2024, Evolution Equity announced the oversubscribed close of Evolution Technology Fund III at $1.1 billion, taking the firm founded by Richard Seewald and Dennis Smith in 2008 to more than $2 billion under management across 60 portfolio companies including Arctic Wolf, SecurityScorecard, Snyk, Aqua Security, Protect AI, Oleria and Torq, with Taher named among the partners (PR Newswire, TechCrunch). Seewald’s line in the TechCrunch piece, “We expect to invest in a portfolio of up to 30 companies in the present fund,” is the number of pitches that win. Sasha’s summary of Taher’s framework was the one I would use: “the product needs to solve the real pain point,” and Taher’s addition is that the market has to be large enough for the company to exist, because “the bigger problems cannot be solved with three people with a laptop.”

Who you are and what you can do

Taher said early on that he sits on the board of one of the companies offering a good alternative to passwords and would not do a commercial. By the end, Sasha’s enthusiasm for separating problems got him to name both of his boards, because the two of them cover the two halves of identity.

“[One] of them is Beyond Identity. Beyond Identity is actually the stronger authentication with single sign-on built in. And [Oleria] is the access controls and the governance of what IAM identity cannot do. So they’re actually not, they’re not competing.”

Taher Elgamal, at 41:45

So it is authentication, I said, and then fast follows with authorization. “Yep, it’s fast followed with authZ.” Sasha’s version is the one I use with founders: one thing is who you are, and the second thing is what you can do, and if either is messed up you end up in a tough place. The two companies are worth knowing. Beyond Identity was launched in April 2020 by Jim Clark and Tom Jermoluk, the Netscape and Silicon Graphics founders, with a $30 million Series A led by Koch Disruptive Technologies and New Enterprise Associates, on exactly the idea in Taher’s SSL story: a personal certificate whose private key is generated in the phone’s secure enclave and never leaves it, so that the chain of trust Netscape built for servers “all the way to the end user with no need for a password at all,” in Jermoluk’s words (SecurityWeek). Taher joined its technical advisory board in May 2020 alongside Martin Hellman, and in February 2022 Evolution Equity led the $100 million Series C, at a $1.1 billion valuation, with Jim Clark participating, and Taher joined the board with the line “Passwords are still the number one attack vector in most breaches” (Beyond Identity, Mobile ID World). His old boss at Netscape founded the company that checks the option nobody checked, and the man who wrote the option sits on its board. Jasson Casey, its chief executive, made the case for it on episode 92.

📢BIG NEWS: Taher Elgamal, the "Father of SSL," is speaking at the BeyondCon Roadshow in Palo Alto!

🌟 Register by Feb 1 for a chance to have lunch with this security legend.

Spots are limited—don’t miss out: https://insights.beyondidentity.com/beyondcon-west-2025/registration

Beyond Identity (@beyondidentity) · January 24, 2025

Oleria is the other half. Founded by Jim Alkove, who had run security programs at Salesforce, Amazon and Microsoft and was Salesforce’s chief trust officer, it raised a $33 million Series A led by Evolution Equity on January 18, 2024, with Salesforce Ventures, Tapestry VC and Zscaler, and Taher joined the board with the words “Oleria is bringing cybersecurity into the future and keeping pace with the changing landscape” (Oleria). Authentication proves who you are, and Oleria’s category, access governance, decides what you can do once you have proved it. That is the same split Graham Neray of Oso described on episode 89, where building authentication would be a whole other company and permissions are one of the last layers companies still build from scratch, and it is the reason the scorecard below asks about both. My own confession on tape was that I once joined a startup to kill the password, “You are not a password. You are so much more than a password,” and that it fizzled. Taher’s consolation was perfect: “Because Jeff Bezos decided to have a password on the Amazon website.”

The founder notes

Go get a PhD in math. Sasha asked whether he would meet his younger self and what he would say. “I would ask them to go get a PhD in math and ignore this whole thing.” There is a book he read years ago with a proof that the universe could not exist without numbers, “That numbers actually existed before the universe, which is kind of a really cute thing. So, yeah, math is the origin of everything.” He cannot go back to it now, “because I’m an industry guy,” and when I suggested weekends, “Not at the PhD level anymore.” It is not like riding a bike. What brought him into cryptography was number theory, and all of public key cryptography, as I said and he confirmed, “it’s all just math at the end of the day.”

Users adapt. The safe deposit box, the two keys, and the ATM card with the PIN written on the back, which people stopped doing. “So people do adapt.” The argument that users will not accept a new way to log in has been wrong before.

The executive, not the engineer. “Technical people can probably get there. It’s the executive level person that needs a deeper understanding of how they’re operating.” Thousands of threat intelligence feeds exist, and reading them takes another four-year degree. The person who runs a digital business knows there are cybersecurity issues and has no deeper understanding of what that means, which is the gap a virtual chief information security officer exists to close.

Ten years out. Two futures. If nothing changes, “you’re going to see more tools for a while, then conglomerates,” all your cloud security from one vendor, and still gaps, because nothing you can buy tells you what gaps are in your architecture, “because the architecture is yours.” The world he wishes for “would actually take the [words] zero trust and, and secure by design for real,” with products that cheaply monitor for weird things, shut them down, “and the business continues.”

We build bad products. “I mean, we have to admit it. I’ve been in software longer than all of you. So, so we just have to admit it. The way we’ve been building software products is just not the right way.”

The exit. Sasha: “it was an absolute pleasure to have you on the show.” Taher: “Hey, guys, I appreciate it.” Sasha asked for a fast follow-up. “Can do.” I offered Fast and Furious 2. We are still owed the sequel.

Did you catch it? A six-question quiz

Interactive · six questions

Did you catch it?

Six questions on what Taher actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.

1. Whose fault are passwords, according to Taher?

   1. The users', for choosing weak ones
   2. His, 100 percent
   3. VeriSign's, for charging for certificates

   b. "It's my fault, 100%." Then, under protest: "Well, it's not, I mean, it is my fault." Transcript, 6:34.

2. What did SSL make optional that led everyone to passwords?

   1. Encryption of the session
   2. Authentication of the server
   3. Cryptographic authentication of the client

   c. "we put in the cryptographic authentication for the client side as an option," and then: "But it was not forced. So that actually got everybody to do passwords." Transcript, 6:41.

3. Which product was RSA's first big customer, and what did it use the cryptography for?

   1. Lotus Notes, to authenticate users without passwords
   2. Netscape Navigator, to encrypt web pages
   3. Microsoft Windows, to sign device drivers

   a. "there used to be a thing called Lotus Notes. So that was the very first customer." And: "a beautifully written authentication program that would avoid passwords. Can you imagine? That was 1991." Transcript, 4:45 and 5:41.

4. What was the password invented to do, in Taher's telling?

   1. Keep spies out of military computers
   2. Separate one researcher's papers from another's
   3. Protect bank accounts

   b. "So it was not invented for a security function. It was invented to just separate things." The record credits Fernando Corbató at MIT, not IBM. Transcript, 11:17.

5. What success rate did Taher give for replacing passwords with multi-factor authentication at Salesforce?

   1. About half
   2. One hundred percent
   3. Over eighty percent

   c. "We, we had an over eighty percent success. The issue is, that was authentication into Salesforce, not the 89 other things that people need to log into." Transcript, 14:47.

6. What comes first when he evaluates a young company?

   1. The team and its reputation
   2. The technology
   3. The size of the round

   a. "it's actually team that matters the most." Then the market. The technology "becomes the number three criteria." Transcript, 39:33.

How much of your company runs on a password?

Taher’s claim is that the vast majority of attacks start with somebody’s credential, and that the password is a filing convention promoted to a security control. This scorecard asks eight questions about where a password still stands between an attacker and your company, each tied to a point on the tape, and tells you which one a phishing email or a leaked credential would find first. Answer for how things are today, not how the policy document describes them.

Scorecard · eight questions

How much of your company runs on a password?

Answer for the accounts that can read customer data, reach production or move money, as they are used today.

1. How does an employee sign in to the identity provider or single sign-on that everything else hangs off?

   • A password, and maybe a code by text message or email
   • A password plus an authenticator app or push approval
   • A passkey or security key bound to the device, with no password to phish

   "We do not need a password to log into something. It's just, we don't." Codes by text and email were the methods Salesforce excluded when it made MFA mandatory in 2022. Device-bound credentials explains the difference between a code and a key.

2. How many separate logins does the average person at your company have that are not behind that single sign-on?

   • We don't know
   • More than five, and we have a list
   • A handful, each on the list, each with a reason

   "as a user, you end up with 17 different ways to log into stuff. That is not good." The win at Salesforce was one application out of ninety. Count yours.

3. How are the root and break-glass accounts protected: the cloud root user, the domain registrar, the payment processor, the identity provider's own admin?

   • A password in a shared vault
   • A password plus a second factor
   • A hardware key, two named holders, and a tested recovery path

   "the root accounts in AWS are protected by password. I claim that is the wrong thing to do." AWS now enforces a second factor on every root user. Your registrar and your payment processor may not.

4. Does your own product make customers choose a password, or offer them a passkey, social login or magic link first?

   • Username and password, we hash them ourselves
   • Password, delegated to an identity service
   • Passwordless by default, password only as a recovery option, delegated

   "I don't think anyone should be hashing passwords in a small startup with, like, five people, six people. You delegate that." Microsoft made new accounts passwordless by default in May 2025.

5. Once someone is signed in, what decides what they can do: who can see every customer, change billing, or reach production data?

   • Everyone can do most things
   • A few roles, set up once
   • Roles reviewed on a schedule, with access removed when the reason goes away

   "one thing is who you are, and the second thing is what you can do." Authentication is Beyond Identity's half. Oleria's half, access governance, is this question. Authorization is the last layer companies still build from scratch.

6. Do your AI agents and service accounts hold their own scoped credentials, or do they sign in with a person's password or a shared key?

   • They use whatever credential was in the environment
   • Their own key, with the same permissions as a person
   • Their own credential, scoped and short-lived, inventoried, with an owner

   "The vast majority of cyber attacks use somebody's credential to organize something." An agent holding a human's password is somebody's credential. Start with the inventory.

7. Does your product requirements document, or whatever stands in for it, say who is not allowed in?

   • No, security is reviewed after the code is written
   • Sometimes, when someone remembers
   • Every feature states who may use it and who may not, before engineering starts

   "Nobody ever writes something like, unauthorized people are not allowed to get in." Write it down. Our design-stage review is the habit that makes it stick.

8. When a credential leaks, how long until you know, and how many places does it open?

   • We would find out from the attacker
   • Days, and it opens several things because people reuse passwords
   • Hours, the credential opens one thing, and revoking it is one action

   The 2026 Verizon report found credential abuse at some stage of 39 percent of breaches, and most ransomware victims had a credential leak in the year before. The blast radius playbook is the drill.

The password is still the front door

A phished or reused password opens the identity provider, the root accounts and the product, and nobody counts the logins outside single sign-on. Fix the first and third questions this month: passkeys or security keys for the identity provider, starting with administrators, and a hardware key with two named holders on every root account. Then count the seventeen ways in.

A second factor on the front door, passwords everywhere behind it

The identity provider is protected and the rest is not: the tools outside single sign-on, the product's own login, the agent that signs in as a person, and the roles that were set once and never reviewed. The medium cases bite here. Move the product to passwordless by default behind an identity service, give agents their own credentials, and put a date on the first access review.

Who you are and what you can do, both answered

People sign in with a key bound to a device, root accounts need hardware, the product never stores a password it did not have to, agents carry their own scoped credentials, roles are reviewed and a leaked credential opens one thing. What is left is the requirements document, so the next feature ships with the line no PRD has, and the quarterly check that the list of logins outside single sign-on is still short.

What the password field costs you a year

Taher’s business case is that removing passwords reduces attacks. There is a quieter cost under that one, the hours a company spends resetting, rotating and recovering the things it asks people to remember, and the share of incidents that start with one of them. Put your own numbers in. Every default below is an assumption, chosen to be easy to argue with.

Calculator

What the password field costs you a year

People, the logins each of them keeps, resets and lockouts, the loaded cost of the time, the odds of a credential-driven incident this year and what one costs, and the share of all of it that passkeys on the main accounts would remove. Rough by design. Change the numbers to yours.

People at the company Separate logins each person keeps, inside and outside single sign-on

Password resets, lockouts and recoveries per person per year

Minutes each one costs, including whoever helps

Loaded cost of an hour of that time, in dollars Chance of a credential-driven incident this year, in percent

Cost of one such incident, in dollars: response, downtime, customer notices Share of both costs that passkeys on the main accounts would remove, in percent

–passwords the company keeps

–a year on resets and lockouts

–that time costs a year

–expected incident cost a year

–the password field, a year

–what passkeys on the main accounts are worth a year

At these numbers, the people at the company keep a few hundred passwords between them and spend a working week or more a year resetting and recovering them. Add the odds of an incident that starts with one of those passwords, weighted by what an incident costs, and that is what the password field costs a year. The share passkeys would remove is what the move is worth.

The 17 logins, the 4 resets, the 20 minutes, the 20 percent and the $120,000 are placeholders, not research. The 17 is Taher's number for how many ways one person logs in. Microsoft reports passkey sign-ins succeeding about 98 percent of the time against 32 percent for passwords, and the 2026 Verizon report found credential abuse at some stage of 39 percent of breaches, which is the case for the last two sliders being higher than you think. Not counted: the sign-in time itself, which Microsoft puts at eight times faster with a passkey than with a password and a second factor.

Forty-seven years on one line

Everything on this page sits on one timeline, from Taher’s arrival at Stanford to the keynote a week after this page was written. Filter it by thread.

Timeline · 1961 to 2026

Forty-seven years on one line

Filter by thread. Dates are from the public record except where marked as Taher's own account on the tape.

1. Early 1960sThe password, at MIT

   Fernando Corbató's Compatible Time-Sharing System gives each user of a shared mainframe their own files. "so people didn't have to live in a communal setting" (WeLiveSecurity).

2. 1979, on tapeStanford

   From Cairo University to a graduate program in electrical engineering, then algebra and number theory, then Marty Hellman. "Math is the thing that I love the most all my life."

3. 1984PhD, then HP Labs

   Advised by Martin Hellman. Graphics, imaging and on-the-fly compression at HP, with no security in it (Wikipedia).

4. 1985The paper

   A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms, in IEEE Transactions on Information Theory. The signature scheme becomes the basis of the Digital Signature Algorithm (Wikipedia).

5. 1988, on tapeInfoChip

   The first startup, with his boss from HP Labs: a compression card that made a 20 megabyte disk behave like 40. "a 20 megabyte hard disk was actually a big deal."

6. December 1989Lotus Notes 1.0

   The first widely adopted software product to use public key cryptography, for authentication and encryption (Wikipedia).

7. 1991RSA Data Security

   First engineering manager at a company of six or seven, under Jim Bidzos, with Lotus as the big customer (Sramana Mitra).

8. February 1995SSL 2.0 ships

   In Netscape Navigator, with flaws found quickly. SSL 1.0 was never released (Wikipedia).

9. April 1995Netscape's chief scientist

   After a Jim Clark talk in San Jose and a few months of consulting. The same month, Elgamal and Hickman post The SSL Protocol as an Internet-Draft: servers always authenticated, clients optionally (IETF).

10. August 25, 1995The SSL patent is filed

    US 5,657,390, Elgamal and Hickman, assigned to Netscape, granted August 12, 1997 (Justia).

11. 1996SSL 3.0

    A complete redesign by Paul Kocher with Phil Karlton and Alan Freier. Elgamal leads the push to make it free and open, over a Microsoft alternative (Marconi Society).

12. December 31, 1998Securify sold to Kroll-O'Gara

    Founded in early 1998 with Dan Kolkowitz, sold for about 1.4 million shares six months after a $4.5 million raise (Kroll-O'Gara).

13. January 1999TLS 1.0, RFC 2246

    The IETF's standard, built on SSL 3.0. TLS 1.1 follows in 2006, TLS 1.2 in 2008 (Wikipedia).

14. 2006 to 2011Tumbleweed, then Axway

    Chief technology officer at Tumbleweed from October 2006, chief security officer at Axway after it bought Tumbleweed in 2008 (Wikipedia).

15. 2009RSA Conference lifetime achievement award

    Fifteen years after the Netscape draft.

16. December 4, 2012"Father of SSL"

    Ellen Messmer's Network World profile, the source Wikipedia cites for the nickname. Storage and inadequate passwords are already "the weakest links" (Network World).

17. February 12, 2013Nok Nok Labs and the FIDO Alliance

    Elgamal credited as the "glue" that brought the founders together. Nok Nok, PayPal, Lenovo, Infineon, Validity and Agnitio form the alliance that will produce passkeys (PR Newswire).

18. February 2013Salesforce, chief technology officer for security

    Ten years, half customer-facing, half advising engineering teams (LinkedIn).

19. August 2013The Yahoo breach

    Every account, three billion of them, with MD5-hashed passwords, as Yahoo finally disclosed on October 3, 2017 (TechCrunch).

20. May 2014"kind of a nightmare"

    Corbató, who invented the password, on what it became on the web, with a crib sheet for about 150 of them (WeLiveSecurity).

21. August 2018TLS 1.3, RFC 8446

    "TLS got updated over the years, which of course is a wonderful thing."

22. May 17, 2019The Marconi Prize

    To Elgamal and Paul Kocher, for their development of SSL/TLS, at the Hiller Aviation Museum (Rambus).

23. April 2020Beyond Identity launches

    Jim Clark and Tom Jermoluk, with $30 million, to carry the certificate chain to the end user with no password. Elgamal and Martin Hellman join its technical advisory board in May (SecurityWeek).

24. February 1, 2022Salesforce requires MFA

    For every customer, with codes by text, email and phone excluded (The Record).

25. February 22, 2022Beyond Identity's $100 million Series C

    Led by Evolution Equity at a $1.1 billion valuation, with Jim Clark participating. Elgamal joins the board (Mobile ID World).

26. March 2, 2022National Academy of Engineering

    Elected for contributions to cryptography, e-commerce and protocols for secure internet transactions (Salesforce).

27. January 2023Evolution Equity, general partner

    After ten years at Salesforce and about five as a venture partner at the firm (The Register).

28. October 2023Amazon adds passkeys

    The website Jeff Bezos put a password on offers a way in without one (Amazon).

29. January 18, 2024Oleria's $33 million Series A

    Led by Evolution Equity, for Jim Alkove's access-governance company. Elgamal joins the board (Oleria).

30. April 16, 2024Evolution Technology Fund III, $1.1 billion

    Oversubscribed, taking the firm past $2 billion under management (PR Newswire).

31. January 23, 2025Episode 61 airs

    This conversation, with Sasha co-hosting. "It's my fault, 100%."

32. May 1, 2025Microsoft: passwordless by default

    New accounts never set a password. Nearly a million passkeys registered a day, 98 percent sign-in success against 32 for passwords (Microsoft).

33. May 2025"Attacking the AI stack"

    Ninety seconds with Cybercrime Magazine at RSA Conference 2025 (YouTube).

34. June 17, 2025AWS: 100 percent MFA on root users

    Across every account type, announced at re:Inforce (The Register).

35. January 2026Salesforce again

    "I'm happy to share that I rejoined Salesforce as CTO, Security. It is exciting to rejoin Salesforce during this AI era" (LinkedIn).

36. April 7, 2026"The real problem isn't deepfakes. It's identity."

    Jasson Casey of Beyond Identity on episode 92, the company Taher would not advertise.

37. May 7, 2026Five billion passkeys

    FIDO's World Passkey Day report: 75 percent of consumers have enabled one, 68 percent of organizations are deploying them, 57 percent still sign in with something phishable (FIDO Alliance).

38. May 2026The 2026 Data Breach Investigations Report

    Credential abuse at some stage of 39 percent of breaches, 13 percent as the first step, exploited vulnerabilities the top way in at 31 percent (Descope).

39. October 15, 2026Seven billion passkeys

    More than a third of successful sign-ins at the fifteen services in FIDO's Passkey Index now use one (FIDO Alliance).

40. November 9, 2026Identiverse Washington, D.C.

    The opening keynote, a week after this page, on the future of identity, trust and security (X).

What to do this week

Four things, in the order a phishing email would test them.

1. Put a key on the front door. Passkeys or hardware security keys for the identity provider, starting with every administrator, and a hardware key with two named holders on each root account: the cloud root user, the registrar, the payment processor, the identity provider’s own admin. Codes by text message and email do not count, for the reason Salesforce gave in 2022.
2. Count the seventeen ways in. List every login a person at your company keeps outside single sign-on. Move the ones that can be moved behind it, write a reason next to the ones that cannot, and check the list quarterly. The win at Salesforce was one application out of ninety. Yours can be most of them.
3. Stop storing passwords you did not have to. If your product has a password field, delegate it to an identity service and offer a passkey or a magic link first. If you are six people hashing passwords yourself, you are the Yahoo breach waiting for its headline.
4. Write the line into the requirements. For the next feature, add the sentence no product requirements document has: who is allowed in, and who is not. Then make the review that happens before engineering starts the place it gets checked. That is the design-stage habit from episode 76, applied to identity.