@svpino: Back in 2010, we could get away with SSH keys and API tokens in .env files. We can't do that anymore. I went down a rab…
Summary
The post argues that static credentials like SSH keys and API tokens are no longer sufficient, and identity-based access is a better alternative.
View Cached Full Text
Cached at: 05/14/26, 04:41 PM
Back in 2010, we could get away with SSH keys and API tokens in .env files.
We can’t do that anymore.
I went down a rabbit hole to understand how identity-based access is much better (and it’s replacing) static credentials. https://t.co/aFCpgEeW9s
Similar Articles
Securing agentic identity
A security expert discusses the challenge of securing identity tokens for LLM agents that access sensitive resources, and proposes a proxy-based approach to bind tokens to specific environments to prevent credential theft.
What's the best way to do authentication in modern applications
The article discusses the security implications of storing authentication tokens in localStorage versus cookies, emphasizing the risks of XSS attacks and the benefits of using httpOnly cookies for sensitive apps.
CLI Authentication, the Right Way
This article critiques the common OAuth loopback authentication pattern used by many CLI tools, which fails on headless machines, and advocates for alternative methods like device code flow that have been standard since 2019.
Stop Using JWTs
An opinion piece arguing against the use of JSON Web Tokens (JWTs) for authentication and session management, citing security and design concerns.
@dreamsofcode_io: Really good time to consider putting your SSH Keys on a hardware security key, such as a Yubikey.
A tweet recommends using hardware security keys like Yubikey for SSH keys, referencing an active cross-ecosystem supply chain attack (TrapDoor) on npm, PyPI, and Crates.io involving malicious packages and crypto-stealing malware.