Building a smarter lock for startups

Startups Magazine · William Thackeray

Digital identity systems are shifting from treating successful password and MFA logins as fully trustworthy toward using broader signals to detect adversary-in-the-middle session theft and other sophisticated login attacks. The article highlights Microsoft Entra Conditional Access considering login geography and compares login timings, including examples where a Singapore login happens 30 minutes after a UK login. Access controls now use stage-gated decisions like triggering an extra MFA check and increasingly revalidate tokens during the session instead of relying on a single authentication event.

Why it matters

As most homeowners will know, an authentic-looking identity card may be enough to allow a supplier through the front door.