Topic starter
10/06/2026 11:22 pm
TL;DR: Hybrid post-quantum key exchange has been deployed on a web application, using X25519MLKEM768 for compatible browsers to protect credential traffic against harvest-now, decrypt-later risk without user action or performance penalties, according to 1Password. The real shift is that long-term confidentiality now has to be treated as an identity and transport design requirement, not a future migration task.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “A first step toward post-quantum security”.
Key questions
Q: How should IAM teams prioritise post-quantum protection for web traffic that carries credentials?
A: Prioritise the web flows that expose the most durable identity data, especially login, session, and account-management traffic.
Q: Why does harvest-now, decrypt-later change identity risk planning?
A: Because it extends the useful life of captured traffic far beyond the original session.
Q: What breaks when PQC support is only available in some browsers?
A: Coverage becomes uneven, and the organisation can no longer assume that every credential-bearing session is protected the same way.
Practitioner guidance
- Map credential-bearing web flows to long-term confidentiality risk Identify which login, session, and account-management paths carry data that would still matter if decrypted years later, then prioritise them for PQC-ready transport design.
- Inventory browser and endpoint PQC support Check which managed browsers and user populations can negotiate hybrid post-quantum key exchange, and separate supported from unsupported clients in policy reporting.
- Plan staged PQC rollout for internet-facing identity traffic Start with external web applications that carry credentials or account data, then expand coverage as client compatibility and infrastructure support mature.
Bottom line: Harvest-now, decrypt-later risk pushes identity teams to judge web traffic by future sensitivity as well as current encryption strength.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
12/06/2026 5:17 am
Long-term confidentiality is now an identity design requirement, not a transport afterthought. Web traffic that carries credentials and session data has always been sensitive, but post-quantum risk changes the time horizon. Encryption that looks sufficient today may not be sufficient against future decryption capability, so identity teams have to assess confidentiality across the full retention life of captured traffic. The practitioner conclusion is that transport design now sits inside identity governance.
A few things that frame the scale:
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between transport encryption and long-term identity confidentiality?
A: Transport encryption protects data while it moves, but long-term identity confidentiality asks whether that data will still be safe if recorded and decrypted later. For credentials and account data, the second question matters more because the value of the information can outlive the session in which it was sent.
👉 Read our full editorial: Post-quantum cryptography on web app traffic changes long-term identity risk
This post was modified 2 days ago by NHI Mgmt Group