Hacker News Reader

Yes, passwordless is great, whether you are talking about magic links or passkeys. While we are waiting for them to get more adoption, making sure you allow (or require) users to set up additional factors of authentication is a good idea.

> Also, an advanced authorization system could take into factor some vectors that traditionally was belonged to MFA and create a better UX with advanced security.

Tell me more...

View on HN

Agree, the adoption is the key here.

Regarding AuthZ, dynamic authorization layers that combine policy as code and synchronization engines such as OPAL[1] can make the authentication session smarter and more dynamic to multiple factors. Think of AuthZ layer that combines session geolocation, IP, fingerprints, etc. that enquires every time a new vector needed for the authorization action.

1 https://github.com/permitio/opal

Ah, zero trust by another name.

Sure, makes sense. Agree that level of continuous authorization makes sense. Defense-in-depth to the max.

Reply on news.ycombinator.com