Identified

If you build software, run a security team, or simply resent password rules, this book explains why the system keeps failing and what replaces it. Wilander writes from the inside—he helped shape the standards now rolling out across the industry—so you get the reasoning behind the change, not just the changelog. Read it before your company's next breach postmortem.

1. 1Early chapters on authentication fundamentals

   You've been proving a secret, not yourself

   Wilander opens with the scene every reader knows: a login form, a password field, the small ritual of proving you're you. He then pulls the curtain back on what that ritual actually verifies—not your identity, but your ability to repeat a string of characters. The stakes become clear when he connects that string to everything it guards: your bank, your email, your medical records. The outcome of this reframing is uncomfortable—once you see passwords as shared secrets rather than identity proof, every breach headline reads differently.

   The idea

   Authentication and identification are different problems, and conflating them is the root flaw. A password proves knowledge of a secret; it says nothing about who is doing the knowing. Phishers, keyloggers, and breached databases all exploit that gap. The surprise for many readers is that this isn't a design bug someone forgot to fix—it's the architecture working exactly as built. Real identity proof requires something the server can verify without ever holding a reusable copy.

   Try this: Audit your own accounts tonight: list which ones share a password, and pick the two most valuable to move to a passkey first.

2. 2Chapters on phishing and credential theft

   Phishing works because the password travels

   Wilander reconstructs a phishing attack from the attacker's side: a convincing fake login page, a hurried user, a harvested credential. The scene turns on the moment the password is typed—it now exists in a place the legitimate site never controlled. He follows the stolen credential to its resale and reuse, showing how one successful phish compounds across every site where the victim repeated the password. The outcome is the industry's grim status quo: phishing remains effective not because users are careless but because the credential itself is portable.

   The idea

   Any secret that must be typed into a form can be typed into a fake form. That single property makes phishing a structural problem, not a training problem. Wilander's point lands hard for security teams that keep buying awareness courses: you cannot educate away an architectural weakness. The fix has to remove the thing being stolen. Credentials that never leave the user's device give the phisher nothing to harvest, no matter how convincing the fake page.

   Try this: Check whether your bank and your primary email support passkeys or hardware keys, and enroll one this week.

3. 3Chapters on cryptographic authentication and WebAuthn

   The server should never know your secret

   Wilander describes the design conversation that reshaped web authentication: instead of sending a password, the browser generates a key pair, keeps the private key bound to the device, and sends only a signature. The server stores a public key—useless to an attacker who steals it. He walks through the ceremony: the site requests authentication, the device verifies the user locally, and a signed response proves possession. The outcome is a login where the database breach yields nothing reusable and the network sees nothing replayable.

   The idea

   This inverts the economics of breach. When servers hold public keys, stolen databases are dead ends, and phishing pages can't collect anything because there's no shared secret to type. The surprising part is how old the idea is—public-key cryptography has existed for decades—but the web only recently got a standard, browser-native way to use it for sign-in. Wilander's insider vantage shows why it took so long: it required browsers, platforms, and sites to move together.

   Try this: Turn on a passkey for one account today and note how the sign-in flow differs—no typing, no reuse, no reset.

4. 4Chapters on biometric authentication

   Biometrics belong on the device, not in a database

   Wilander contrasts two ways to use a fingerprint: the dangerous way, where biometric data is captured and stored server-side, and the sound way, where the sensor unlocks a private key that never leaves the device. He paints the stakes of the first approach—a biometric database breach is permanent, since you can't rotate your fingerprint. The second approach keeps the biometric local, used only to authorize the device's cryptographic key. The outcome is biometric convenience without biometric catastrophe.

   The idea

   The rule is simple: biometrics should be a local gate, never a transmitted credential. A fingerprint is a great way to say 'yes, it's me' to your own phone and a terrible thing to send across a network. Readers are often surprised that this distinction, not sensor quality, is what separates safe systems from reckless ones. It also reframes privacy: keeping biometric templates on-device means companies never hold data they'd have to protect—or lose.

   Try this: In your phone's settings, confirm that biometric unlock is tied to on-device authentication, and avoid services that ask you to upload biometric data.

5. 5Later chapters on adoption and user experience

   Usability is a security feature

   Wilander closes the loop with the adoption problem: the most secure scheme fails if people won't use it. He recalls the friction of password rules—character counts, rotation demands, recovery questions—and how each rule pushed users toward weaker, reusable habits. Against that backdrop, he sets the passkey experience: a biometric prompt, a tap, done. The outcome he argues for is that removing friction isn't a concession to laziness; it's the mechanism by which secure behavior becomes default behavior.

   The idea

   Security that fights human nature loses. Every forced password change and forgotten-answer recovery is a tax that pushes people toward workarounds, and workarounds are where attackers live. The insight that surprises practitioners is that the strongest authentication is often the one users perceive as easiest—because the hard parts moved into the device. Designing for the hurried, distracted, real user isn't a compromise; it's the whole job.

   Try this: When you next ship or configure a login flow, count the steps a user takes—and delete one that adds friction without adding security.

Engineers, product managers, and security leaders deciding how their organization signs people in—and anyone tired of password rules. It's the clearest inside account of why the web is moving to passkeys.

FAQ