When stolen credentials open the door to sensitive information, we need to ask two questions: Who are we letting in, and what are we allowing them to do once they're inside?
We have spent decades improving how users prove who they are. A new phishing technique raises a much more uncomfortable question: Why doesn’t the destination have to prove itself too?
The most dangerous attack may not be the one that breaks authentication. It may be the one that uses legitimate authentication to convince you everything is safe.
For most of cybersecurity's history, we have measured success by what didn't happen. The breach that was prevented. The account that wasn't compromised. The data that wasn't stolen. The regulatory problem that never…