Top all-time · #3069
Stytch
Company blog · stytch.com/blogsecurityweb
Stytch is the company blog at stytch.com, writing about security and web. Since 2021, 25 different Hacker News readers have linked it 92 times, most often “<IsAgent/>”. No feed was found, so read it on the site itself.
Rarely recommended · 1 of 40 sampled comments recommend it?
Why HN links it
HN readers link Stytch's blog for technical posts on authentication, WebAuthn, AI agent detection and bot fraud. Most links are cited as background or related reading in threads, and one commenter called a detection post a great article.
- Recommended for · 1 comments
- Called the 'Detecting AI agent use and abuse' post a "great article".1
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
APIs and SDKs to integrate authentication and security into your app.
Most-linked posts?
- /5 people · 13 mentions · first linked 2022-03-03
- <IsAgent/>2 people · 5 mentions · first linked 2025-08-01
- Show HN: APIs for Passwordless Authentication2 people · 5 mentions · first linked 2021-07-15
- The Age of Agent Experience2 people · 2 mentions · first linked 2025-02-07
- If an AI agent can't figure out how your API works, neither can your users2 people · 2 mentions · first linked 2025-05-20
- How we built a codegen solution for SDKs to create humanlike code2 people · 2 mentions · first linked 2023-07-18
- Simplicity can become a false idol in SaaS pricing2 people · 2 mentions · first linked 2023-04-24
- An engineer’s guide to mobile biometrics: step-by-step2 people · 2 mentions · first linked 2023-05-03
- /docs/llms.txt2 people · 2 mentions · first linked 2025-09-13
- Detecting AI agent use and abuse2 people · 2 mentions · first linked 2025-02-14
What Hacker News says?
I like the terminology "crawler" vs. "fetcher" to distinguish between mass scraping and something more targeted as a user agent. I've been working on AI agent detection recently (see https://stytch.com/blog/introducing-is-agent/ ) and I think there's genuine value in website owners being able to identify AI agents to e.g. nudge them towards scoped access flows instead of fully impersonating a user with no controls.…
Comment linking /blog/introducing-is-agent/
on “Perplexity is using stealth, undeclared crawlers to evade no-crawl directives”Submitted Detecting AI agent use and abuse as a story · 160 points
HN discussionThere are options beyond auth walls for detecting/enforcing behavior as well since these scrapers have very recognizable device signatures: https://stytch.com/blog/detecting-ai-agent-use-abuse/
Comment linking /blog/detecting-ai-agent-use-abuse/
on “FOSS infrastructure is under attack by AI companies”Submitted The Age of Agent Experience as a story · 109 points
HN discussionHere's a bit more background on WebAuthn: https://stytch.com/blog/an-introduction-to-webauthn/ What makes it unphishable is that the authentication is not based upon something that a user can be deceived into sharing with an attacker. Passwords and one-time passcodes (OTPs) can both be remotely acquired from users when attackers convince users to share these text-based verifications with them. Because WebAuthn valid…
Comment linking /blog/an-introduction-to-webauthn/
on “Uber investigating breach of its computer systems”Submitted If an AI agent can't figure out how your API works, neither can your users as a story · 97 points
HN discussion100%. The common thread in all of these recent attacks (Uber, Twilio, Okta, etc) is the “phishability” of the authentication methods involved -- as you mention, the unphishability of WebAuthn is what makes it particularly compelling. What’s head-scratching to me is why tech-forward enterprises haven’t been faster to adopt unphishable forms of authentication like WebAuthn. I’m biased as I run an identity and access m…
Comment linking /products/webauthn
on “Uber investigating breach of its computer systems”Submitted The challenge of AI agent permissions–and how OAuth scopes help as a story · 15 points
HN discussionThe common thread in all of these recent attacks (Uber, Twilio, Okta, etc) is the “phishability” of the authentication methods involved. Remote attacks like this only work when you can socially engineer an employee and phish sensitive credentials like a password from them (or a SMS one-time passcode during the MFA step). What’s head-scratching to me is why tech-forward enterprises haven’t been faster to adopt unphis…
Comment linking /products/webauthn
on “Uber investigating breach of its computer systems”Submitted Bears, mice, and moles aren't enough: a better approach for preventing fraud as a story · 14 points
HN discussionStytch | Remote (US) | Hybrid in SF/NY or Remote | https://stytch.com Stytch is building a developer platform for passwordless authentication. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.co…
Comment linking /
on “Ask HN: Who is hiring? (July 2024)”Submitted How to create a closed source Objective-C++ framework for Swift Package Manager as a story · 14 points
HN discussionStytch | San Francisco, New York City, or Remote (US) | Onsite or Remote | https://stytch.com Stytch is building a developer platform for passwordless authentication. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile:…
Comment linking /
on “Ask HN: Who is hiring? (August 2022)”Submitted Sam Altman was wrong: AI didn't defeat auth. Single factors did as a story · 10 points
HN discussionStytch | SF (US) | Onsite or Remote | https://stytch.com Stytch is the most powerful identity platform built for developers. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. Our open positions: * Engineering Manager, Platform: https://jobs.ashbyhq.com/stytch/146ef566-c5fc-4d9b-bd60-4339... * Experienced Backend Engineer: https://jobs.ashbyhq.com…
Comment linking /
on “Ask HN: Who is hiring? (February 2024)”Submitted How to Go Passwordless as a story · 10 points
HN discussionStytch ( https://www.stytch.com ) | San Francisco & Remote (US only)| Full-time | Visa Transfer We build user infrastructure that makes it easy to onboard, authenticate, and engage your users. Improve security and user experience with flexible, passwordless authentication solutions. Open positions include: * Software Engineers - Frontend / Backend / Platform * Product Designer - Consumer Experience * Product Manager…
Comment linking /about
on “Ask HN: Who is hiring? (July 2021)”Submitted Connecting AI Agents to Every App as a story · 8 points
HN discussionStytch | Remote (US) | Onsite or Remote | https://stytch.com Stytch is building a developer platform for passwordless authentication. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.com/stytch…
Comment linking /
on “Ask HN: Who is hiring? (June 2022)”Submitted How to block AI web crawlers as a story · 7 points
HN discussionStytch | Remote (US) | Hybrid in SF/NY| * We have a mix of remote and hybrid roles, please look at the location when you apply. https://stytch.com Stytch is building a developer platform for passwordless authentication. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. To learn more about who we are, our engineering culture, and whether this is t…
Comment linking /
on “Ask HN: Who is hiring? (August 2024)”Submitted How we built a codegen solution for SDKs to create humanlike code as a story · 7 points
HN discussionStytch | SF (US) | Onsite or Remote | https://stytch.com Stytch is the most powerful identity platform built for developers. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. Our open positions: * Engineering Manager, Platform: https://jobs.ashbyhq.com/stytch/146ef566-c5fc-4d9b-bd60-4339... * Experienced Backend Engineer: https://jobs.ashbyhq.com…
Comment linking /
on “Ask HN: Who is hiring? (March 2024)”Submitted Show HN: APIs for Passwordless Authentication as a story · 7 points
HN discussion> whether we can take advantage of people’s tendencies towards learned behaviour like this See, thoughts like that turn into billion dollar valuations at Series B for, among other things, a login button that emails you a login link, taking advantage of people's tendencies towards behavior like this: https://stytch.com/products/email-magic-links https://stytch.com/blog/announcing-series-b/ (Or maybe turn into Tell HN…
Comment linking /blog/announcing-series-b/
on “The "email is authentication" pattern”Submitted An engineer’s guide to mobile biometrics: event- vs. result-based as a story · 6 points
HN discussionStytch | San Francisco, New York City, or Remote (US) | Onsite or Remote | https://stytch.com Stytch is building a developer platform for passwordless authentication. Our APIs make it simple to seamlessly onboard, authenticate, and engage users – while simultaneously improving security. To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile:…
Comment linking /
on “Ask HN: Who is hiring? (July 2022)”Submitted Our $30M Series A to Make Passwords a Thing of the Past as a story · 5 points
HN discussion> I've found that the primary benefit for subagents is context/focus management. For example, I'm doing auth using Stytch. What I absolutely don't want to do is load https://stytch.com/docs/llms.txt and instructions for leveraging it in my CLAUDE.md. > But it's perfect for my auth agent, and the quality of the output for auth-related tasks is far higher as a result. What about just using a sub agent specifically to…
Comment linking /docs/llms.txt
on “How to use Claude Code subagents to parallelize development”Submitted <IsAgent/> as a story · 4 points
HN discussion
