SecureCodeReviews
Category Hub

Identity & Access Security Guides

Use this hub to navigate SecureCodeReviews coverage on identity & access, common failure modes, and fixes that matter in production systems.

Authentication
FIDO2
MFA
Passkeys
Phishing
WebAuthn
Zero Trust

Articles

1

Latest Update

January 29, 2026

Top Tags

7

Related Topic Hubs

Higher-intent paths built around specific security questions.

OAuth and Modern Auth Security Hub

Guides on OAuth 2.0, PKCE, redirect URI validation, JWT vs sessions, and delegated access design decisions.

Editorial standards

Security guides backed by a real operating company.

These category hubs group original security content written for engineers, buyers, and reviewers. We keep author names visible on articles, maintain public policy pages, and update important guidance when the underlying risk picture changes.

Named authors

Each guide links to a visible author and publish history.

Update history

Important posts show when they were revised, not just published once.

Public trust pages

Editorial, company, contact, privacy, and terms pages stay easy to verify.

Verify the site context

Readers can review how we publish, who we are, and how to request corrections or help.

Editorial policy and content standards
Company and contact pages for accountability
Consistent legal and product navigation
Identity & Access

Phishing-Resistant MFA: Passkeys, WebAuthn & the End of Passwords in 2026

Traditional MFA is defeated by real-time phishing proxies like Evilginx2. This guide covers phishing-resistant authentication — FIDO2/WebAuthn, passkeys, hardware keys, and why SMS OTP is no longer acceptable.

SCR Security Research Team
Jan 29, 2026
19 min read
Read article

Need this category reviewed in your own stack?

The articles here are a good starting point. If you need a targeted review for a release, feature, or audit scope, we can assess the concrete implementation rather than the generic pattern.