#identity

Back in February I wrote about why authorization should be momentary instead of permanent, Authorization Is Momentary, and the short version of that argument is that most systems only need to answer a narrow question in the moment, is this allowed right now, and then they go and keep the answer around forever anyway, as if the identity itself were the valuable thing instead of the decision.

I did not expect to prove that argument on my own home server a few months later, but that is basically what happened.

For a while I had been hand building API tokens for the home server whenever some script needed to talk to Cloudflare, one to edit DNS, another to manage access policies, and every time a script needed one more permission the easy move was to widen an existing token rather than make a new narrow one, since narrow tokens are more work up front. After a few months of that I had a handful of long lived tokens sitting in files, each one wider than any single job actually needed, and honestly I had lost track of exactly what some of them could do.

This morning I got a call from USAA's main support number. Fraud charges at a Walmart in Los Angeles. After 24 years as a member, I recognized the number. But the questions that followed felt wrong — too many, too fast, too interested in my answers when they should have been interested in blocking the charge. I started asking questions back.

They hung up.

Here's the part that's hard to admit: I've spent 25 years in security. I know how these attacks work. And depending on how my day was going — if I'd been distracted, if I'd been between meetings, if my kid had just called — I could have fallen for it. Not because I'm careless. Because the attack was built to exploit trust, not ignorance. Twenty-four years of recognizing that number is exactly what they were counting on.

Modern security assumes identity retention is unavoidable.

We design systems that verify who someone is, store that identity, replicate it across environments, audit it for years, insure it against loss, and then build entire security programs around protecting it indefinitely. This pattern is so normalized that it rarely gets questioned.

If a system ever verifies identity, eligibility, or authorization — this concerns it.

Most modern systems are not built to remember people. They are built to make decisions. And that distinction matters.