What happens when your identity provider becomes the kill chain

Colin Constable (CTO at Atsign) argues that identity providers have become a central attack vector because attackers can steal session cookies, tokens, or consent grants to traverse authentication barriers; TLS and MFA are insufficient when intermediaries or phishing/device compromise expose shared secrets. He reviews mitigation ideas (IP pinning, mutual TLS, token binding, TPM-based approaches) and contends the web’s shared-secret architecture needs fundamental redesign.