(And How We Can Finally Look Where the Key Was Lost)
There’s an old joke that goes like this:
A man is searching for something under a streetlight.
Someone asks, “What are you looking for?”
He replies, “A key.”
“Where did you lose it?”
“Over there.”
“Then why don’t you search over there?”
“Because here is the light—I can see better.”
Funny? Yes. But it’s also a perfect metaphor for how the Identity and Access Management (IAM) industry approaches security.
The Streetlight Effect in IAM
When it comes to authentication, most vendors focus on what’s easy and visible—using the phone as an out-of-band (OOB) authenticator. Why? Because building an app and pushing notifications is simple. The phone is “under the light.” Vendors can control the experience without touching complex OS internals.
But where was the key lost? At the endpoint and in the session. That’s where real attacks happen:
- Session hijacking
- Token theft
- Adversary-in-the-middle exploits
Securing this zone requires deep integration—intercepting and protecting the communication between the endpoint and the server, enforcing trust continuously, and anchoring identity in the device itself. It’s harder. It’s darker. So the industry keeps searching under the streetlight.
Why This Matters
The result? We’ve built a world where authentication starts strong but fades after login. Once the session begins, the user is on their own. Attackers know this—and exploit it.
Phones help, but they’re not the foundation. The endpoint is. It’s where the user lives, where work happens, and where trust should begin and persist.
A Better Way Forward
MagicEndpoint and the Secure Internet vision flip this model:
- Identity anchored in the endpoint (not just the phone)
- Persistent trusted channel between endpoint and IdP
- Continuous verification during the entire session
Instead of searching under the light, we go where the key was lost. It’s harder, yes—but it solves the real problem.
In security—as in life—everything is relative. But some paths are simply better chosen.
