What credential stuffing is, and why 2FA does not stop it
A second factor protects the account, but it does not stop the attacker from learning which passwords are valid. That distinction decides where the control belongs.
Read the article
Technical blog
Articles on credential stuffing, mTLS and certificate pinning, written for the people who have to implement it rather than the people who have to approve it.
mTLS vs API keys for authenticating mobile apps
An API key in a mobile app is not a secret: it is a string inside a file anyone can download. The difference with mTLS is not one of strength, it is one of kind.
Read the articleHow to implement certificate pinning on Android without breaking updates
Nearly every pinning incident reads the same: the app worked, the certificate was renewed, and older versions stopped connecting. Two decisions taken before you ship prevent it.
Read the article