authentication

Authorizer: Open-source authentication and authorization for your apps

authentication, cybersecurity, Don't miss, GitHub, News, open source /

Authorizer: Open-source authentication and authorization for your apps 2026-09-28 at 08:30 By Mirko Zorz Authorizer is an open-source server for sign-in and access control in web and mobile apps. Teams run it on their own infrastructure and keep user accounts in a database they choose. Its maintainers have built a permissions engine and an interface […]

Authorizer: Open-source authentication and authorization for your apps Read More »

Your passkeys can now move between password managers on Android

Android, authentication, Google, News, passkeys, password management, passwords /

Your passkeys can now move between password managers on Android 2026-09-10 at 19:00 By Anamarija Pogorelec Google turned on a transfer feature in Android that moves passwords and passkeys straight from one password manager to another, with no file to download along the way. You start it from inside the app you are switching to, […]

Your passkeys can now move between password managers on Android Read More »

Post-quantum migration gets harder when every user holds a key

authentication, blockchain, CISO, CXO, cybersecurity, Don't miss, Features, Hot stuff, News, opinion, passwords, quantum computing, strategy, tips /

Post-quantum migration gets harder when every user holds a key 2026-08-12 at 09:00 By Mirko Zorz In this Help Net Security interview, Christopher Smith, CEO of Quantus, discusses what cryptographic inventories turn up in banks and hospitals, including default passwords and admin keys still held by former employees. He explains where post-quantum key sizes break […]

Post-quantum migration gets harder when every user holds a key Read More »

Microsoft Entra ID is removing an extra MFA hurdle for Windows Hello and macOS PSSO users

authentication, MFA, Microsoft, Microsoft Entra ID, News /

Microsoft Entra ID is removing an extra MFA hurdle for Windows Hello and macOS PSSO users 2026-08-10 at 16:19 By Sinisa Markovic Microsoft is changing how Entra ID handles MFA for people who sign in with Windows Hello for Business (WHfB) or macOS Platform Single Sign-On (PSSO). The rollout reaches worldwide and GCC tenants starting […]

Microsoft Entra ID is removing an extra MFA hurdle for Windows Hello and macOS PSSO users Read More »

Exposed BMCs hand out password hashes before login

authentication, Don't miss, hardware, HPE, News, passwords, research, Supermicro, vulnerability /

Exposed BMCs hand out password hashes before login 2026-07-28 at 15:00 By Sinisa Markovic An attacker who reaches UDP port 623 on a server’s baseboard management controller can ask it for a password hash and receive one before logging in. The exchange is part of the IPMI 2.0 handshake, built on an authentication protocol introduced […]

Exposed BMCs hand out password hashes before login Read More »

Claude can now sign into websites with 1Password without exposing your credentials

1Password, Anthropic, authentication, Claude Code, credentials, cybersecurity, News, Privacy /

Claude can now sign into websites with 1Password without exposing your credentials 2026-07-17 at 12:17 By Anamarija Pogorelec 1Password has introduced 1Password for Claude, a beta integration that lets Anthropic’s AI assistant complete browser tasks requiring authentication without accessing users’ passwords or other secrets. The integration is available to paid Claude subscribers (Pro, Max, Team, […]

Claude can now sign into websites with 1Password without exposing your credentials Read More »

Microsoft makes Windows SSO prompts easier to manage

authentication, cybersecurity, Microsoft, Microsoft Entra ID, News, policy, SSO, Windows /

Microsoft makes Windows SSO prompts easier to manage 2026-07-16 at 11:47 By Anamarija Pogorelec Microsoft is introducing a new registry-based policy that lets IT administrators automatically accept Windows SSO permissions on Windows 11 versions 24H2 and 25H2 devices managed with Microsoft Entra ID. Users with personal Microsoft accounts and devices outside policy-managed environments will continue […]

Microsoft makes Windows SSO prompts easier to manage Read More »

Google adds FIDO2 keys and phone passkeys to Windows login via GCPW

2FA, authentication, cybersecurity, Google, Google Workspace, hardware, News, security key /

Google adds FIDO2 keys and phone passkeys to Windows login via GCPW 2026-07-14 at 13:35 By Anamarija Pogorelec Google has started rolling out FIDO2-compliant physical security key support as a second factor for authentication in Google Credential Provider for Windows (GCPW) to all Google Workspace customers. GCPW is a free tool that lets users sign […]

Google adds FIDO2 keys and phone passkeys to Windows login via GCPW Read More »

Microsoft Entra ID authentication overhaul to start in September 2026

authentication, MFA, Microsoft, Microsoft Entra ID, News, passkeys /

Microsoft Entra ID authentication overhaul to start in September 2026 2026-07-14 at 11:49 By Anamarija Pogorelec Microsoft will begin rolling out passkeys as the default authentication experience for Microsoft Entra ID in the public cloud on September 1, 2026. Organizations with SMS or voice authentication enabled will automatically be enabled for passkeys. The next time […]

Microsoft Entra ID authentication overhaul to start in September 2026 Read More »

Fake OAuth client IDs are helping attackers slip past sign-in logs

authentication, credentials, cybercrime, Don't miss, Microsoft, Microsoft Entra ID, News, OAuth, Proofpoint, spoofing /

Fake OAuth client IDs are helping attackers slip past sign-in logs 2026-07-13 at 15:10 By Mirko Zorz Attackers running account enumeration against Microsoft cloud tenants have added a step that keeps their probing out of the usual telemetry. They spoof the OAuth client ID, the globally unique identifier assigned to an application and passed as […]

Fake OAuth client IDs are helping attackers slip past sign-in logs Read More »

Only 28% of financial workforce MFA is phishing-resistant

authentication, cybersecurity, financial industry, identity protection, MFA, News, passwordless, report, SaaS, Secret Double Octopus /

Only 28% of financial workforce MFA is phishing-resistant 2026-07-10 at 08:41 By Anamarija Pogorelec Passwords remain part of many workforce authentication flows in financial organizations, making phishing and credential theft major identity security risks, according to a new Secret Double Octopus report. Key challenges preventing universal implementation of phishing-resistant MFA (Source: Secret Double Octopus) Workforce […]

Only 28% of financial workforce MFA is phishing-resistant Read More »

AWS gives its ERP agent deny-by-default rules and a separate identity

agentic AI, AI, authentication, automation, AWS, News, SAP /

AWS gives its ERP agent deny-by-default rules and a separate identity 2026-07-10 at 08:00 By Sinisa Markovic Accounts receivable teams at large companies spend hours each day matching incoming bank payments to invoices by hand. When those payments sit unmatched for days, cash flow suffers and days sales outstanding climbs. The same pattern repeats across […]

AWS gives its ERP agent deny-by-default rules and a separate identity Read More »

Non-interactive SSH attacks dominate after login

authentication, bot, cybersecurity, device fingerprinting, Don't miss, honeypots, Hot stuff, LLMs, News, research, SSH, Threat Intelligence /

Non-interactive SSH attacks dominate after login 2026-07-03 at 08:30 By Sinisa Markovic Anyone who runs a server with SSH exposed to the internet sees the same pattern in the logs. A steady stream of automated scanners tries to log in, hour after hour, from addresses all over the world. The common picture of what comes […]

Non-interactive SSH attacks dominate after login Read More »

Securing digital keys when your phone unlocks the car

authentication, automotive security, car, Car Connectivity Consortium, Don't miss, Features, hardware, Hot stuff, Internet of Things, News, opinion /

Securing digital keys when your phone unlocks the car 2026-06-18 at 09:00 By Mirko Zorz In this interview with Help Net Security, Alysia Johnson, President of the Car Connectivity Consortium (CCC), explains how the CCC Digital Key has grown from a single-brand feature into a standard meant to work across phones, automakers, and suppliers. She […]

Securing digital keys when your phone unlocks the car Read More »

China-linked spies backdoored authentication stack to stay hidden for years

APT, authentication, Don't miss, enterprise, Hot stuff, intrusion detection, Linux, News, remediation, Sygnia, threat hunting /

China-linked spies backdoored authentication stack to stay hidden for years 2026-06-15 at 18:27 By Zeljka Zorz A China-linked cyber espionage group known as Velvet Ant spent nearly a decade inside the internal network of an unnamed organization without being detected, according to the results of a forensic investigation published by cybersecurity firm Sygnia. The group’s […]

China-linked spies backdoored authentication stack to stay hidden for years Read More »

Apple Intelligence can now replace weak passwords without user intervention

agentic AI, apple, authentication, cybersecurity, iOS, iPad, iPhone, macOS, News, password management, Privacy /

Apple Intelligence can now replace weak passwords without user intervention 2026-06-09 at 15:21 By Anamarija Pogorelec Apple’s next generation of Apple Intelligence, the company’s personal intelligence system, expands its capabilities and introduces new security features in Passwords. Automatically Fix Passwords (Source: Apple) Introduced as a standalone app in 2024, Passwords gives users a central place […]

Apple Intelligence can now replace weak passwords without user intervention Read More »

Let’s Encrypt works toward post-quantum certificates at web scale

authentication, certificate authority, certificates, Encryption, Let's Encrypt, News, quantum computing /

Let’s Encrypt works toward post-quantum certificates at web scale 2026-06-05 at 15:49 By Anamarija Pogorelec Let’s Encrypt plans to pursue a post-quantum-safe Web PKI through Merkle Tree Certificates (MTCs), a new approach that adds post-quantum authentication to the web without sacrificing the speed and reliability that have made TLS universal. The project is targeting late […]

Let’s Encrypt works toward post-quantum certificates at web scale Read More »

Thieves can pull off keyless car theft in under a minute and here’s how to stop them

attack, authentication, Bluetooth, car, car hacking, Don't miss, EU, Europe, Germany, GPS, hardware, News, threats /

Thieves can pull off keyless car theft in under a minute and here’s how to stop them 2026-06-05 at 09:24 By Mirko Zorz A keyless car can be stolen in under a minute. Two people, a pair of cheap radio amplifiers, and a fob sitting on a hallway table inside the house. That is enough. […]

Thieves can pull off keyless car theft in under a minute and here’s how to stop them Read More »

Scroll to Top