Research & notes

• Note ·November 2026

  Is Passwordless Authentication Secure? What the 2026 Data Actually Shows

  Nkeiruka Kalu

  Yes, passwordless authentication is secure and more secure than passwords alone. The 2026 data confirms this.

  passwordless identity passkeys
• Note ·October 2026

  HumanProof: a private, passkey-based reCAPTCHA alternative

  Trustaige Privacy Research

  Bot defence has grown into fraud platforms that score every visitor by watching them. We replaced the CAPTCHA on our own forms with a passkey: one tap proves a person was present, the site learns nothing else about them, and neither do we.

  passkeys captcha privacy-pass bot-defence fraud webauthn
• Note ·September 2026

  We removed the guest account from Trustaige ID, and organizations are the principals now

  Trustaige Identity Research

  Every directory admits an outsider by making a copy of them, and the copy outlives the job. Trustaige ID no longer has a guest account. In its place the organization itself is a principal: either side shares an application with the other, each decides which of its own people take part, and whether a person may sign in is computed every time from facts each organization owns.

  identity architecture multi-org collaboration b2b
• Note ·September 2026

  Every smartphone on sale can hold a passkey

  Trustaige Identity Research

  A sales leader asked whether a field team on old phones could use passkeys, because a ninety-day password rotation kept locking them out. We asked the people who sell phones, then traced what a passkey actually needs. The floor of the market is ready; the obstacle is a policy, not a device.

  passwordless passkeys android ios
• Note ·September 2026

  What an organization gains when it stops owning the identity

  Trustaige Identity Research

  Most identity providers create the user inside the organization's tenant and delete them with it. We built Trustaige ID so that the person and the organization are different things, and the credential that makes that possible is the passkey.

  identity webauthn architecture passkeys multi-org
• Note ·August 2026

  An MCP server for the identity plane and why it only reads

  Trustaige AI Research

  An MCP server on the identity plane, built read-only on purpose: an assistant or agent answers questions about members, devices, and the audit trail, scoped to the approving admin's own role and re-checked against live permissions on every single call.

  mcp identity ai-security ai-agents access-governance

Nothing matches that search.