#Authentication

Inautilo<a href="https://mastodon.social/tags/Development" class="mention hashtag" rel="nofollow noopener" target="_blank">#Development</a> <a href="https://mastodon.social/tags/Analyses" class="mention hashtag" rel="nofollow noopener" target="_blank">#Analyses</a> Passkeys and modern authentication · Let’s consider whether this is really what we want <a href="https://ilo.im/166klm" rel="nofollow noopener" translate="no" target="_blank">https://ilo.im/166klm</a>_____ <a href="https://mastodon.social/tags/Business" class="mention hashtag" rel="nofollow noopener" target="_blank">#Business</a> <a href="https://mastodon.social/tags/BigWeb" class="mention hashtag" rel="nofollow noopener" target="_blank">#BigWeb</a> <a href="https://mastodon.social/tags/Gatekeepers" class="mention hashtag" rel="nofollow noopener" target="_blank">#Gatekeepers</a> <a href="https://mastodon.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://mastodon.social/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> <a href="https://mastodon.social/tags/PasswordManagers" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswordManagers</a> <a href="https://mastodon.social/tags/WebDev" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebDev</a> <a href="https://mastodon.social/tags/Frontend" class="mention hashtag" rel="nofollow noopener" target="_blank">#Frontend</a> <a href="https://mastodon.social/tags/Backend" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backend</a> <a href="https://mastodon.social/tags/Pitfalls" class="mention hashtag" rel="nofollow noopener" target="_blank">#Pitfalls</a>

Paco Hope #resistA small rant on passkeys and authN.I get how <a href="https://infosec.exchange/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> are meant to be good. But I feel like it’s more wealthy privilege and tech bro myopia. This blog post raises interesting (but orthogonal) points to what I will say here.If you only use modern devices with modern software, if you’re pretty competent and literate on modern tech things like passwords and such, maybe passkeys work for you. Especially if the passkey always belongs to the person sitting at the keyboard/device.As soon as you get into the real world you have people helping people. You don’t have a world where the person doing the stuff is always the principal who you are authenticating. People help elderly relatives who can’t manage on their own. People help folks who are perfectly competent to decide for themselves, but physically unable to see or do some of the things that are required. People help folks like children or certain kinds of adults who are not able to decide for themselves.These people who help people need to be different people at different times. I might be me one moment, my elderly mother-in-law the next moment, and my pre-teen child the next. Very few people login exclusively as themselves. AND THATS OK!Some folks share devices because they can’t afford each person to have their own. Auto-enrolling and storing a passkey in a browser is a terrible idea on a shared device.I knew a sysadmin who administered an online forum. He typed with a mouth stick. The process of opening an app, getting a 6-digit code, and keying that in before it expired was just not realistic. The admin accounts on that system can’t have MFA turned on, because the stupid software is all-or-none: either it’s mandatory for all admins or can’t be activated by any admins!Passkeys are an authentication system that is controlled—not by the user—but by some fickle, unregulated tech company. They don’t care and can’t be made to care.User names and <a href="https://infosec.exchange/tags/passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#passwords</a> are the worst form of <a href="https://infosec.exchange/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a>, except for all the others. <a href="https://lucumr.pocoo.org/2025/9/2/passkeys/" rel="nofollow noopener" translate="no" target="_blank">https://lucumr.pocoo.org/2025/9/2/passkeys/</a>

Some Bits: Nelson's LinkblogPasskeys in current deployment: Interesting stories from the reality of passkeys. Particularly interested how non-technical people are getting autoenrolled with them. <a href="https://lucumr.pocoo.org/2025/9/2/passkeys/" rel="nofollow noopener" translate="no" target="_blank">https://lucumr.pocoo.org/2025/9/2/passkeys/</a> <a href="https://tech.lgbt/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://tech.lgbt/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> <a href="https://tech.lgbt/tags/identity" class="mention hashtag" rel="nofollow noopener" target="_blank">#identity</a> <a href="https://tech.lgbt/tags/login" class="mention hashtag" rel="nofollow noopener" target="_blank">#login</a> #+

Nishant KaushikIn my first FIDO Alliance blog post, I cut through the noise around “passkeys being hacked” and clarify that the real issues lie in compromised environments, not in the technology. For product teams and leaders evaluating authentication strategies, the takeaway is straightforward: passkeys remain one of our strongest defenses against phishing and credential theft — when they’re implemented thoughtfully and paired with good security hygiene.If you’ve been hesitant because of scary headlines, I hope this helps turn things back to reality: passkeys are here to stay, and they’re a major step forward.Read the full thoughts here: <a href="https://fidoalliance.org/passkeys-are-not-broken-the-conversation-about-them-often-is" rel="nofollow noopener" translate="no" target="_blank">https://fidoalliance.org/passkeys-are-not-broken-the-conversation-about-them-often-is</a><a href="https://infosec.exchange/tags/Passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passkeys</a> <a href="https://infosec.exchange/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://infosec.exchange/tags/Passwordless" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwordless</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/UsePasskeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#UsePasskeys</a> <a href="https://infosec.exchange/tags/Misinformation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Misinformation</a>

PrivacyDigestThe Ongoing Fallout from a <a href="https://mas.to/tags/Breach" class="mention hashtag" rel="nofollow noopener" target="_blank">#Breach</a> at <a href="https://mas.to/tags/AI" class="mention hashtag" rel="nofollow noopener" target="_blank">#AI</a> <a href="https://mas.to/tags/Chatbot" class="mention hashtag" rel="nofollow noopener" target="_blank">#Chatbot</a> Maker <a href="https://mas.to/tags/Salesloft" class="mention hashtag" rel="nofollow noopener" target="_blank">#Salesloft</a>…AI chatbot is used by a broad swath of corporate America to convert customer interaction into <a href="https://mas.to/tags/Salesforce" class="mention hashtag" rel="nofollow noopener" target="_blank">#Salesforce</a> leads, has left many companies racing to invalidate the stolen <a href="https://mas.to/tags/credentials" class="mention hashtag" rel="nofollow noopener" target="_blank">#credentials</a> before <a href="https://mas.to/tags/hackers" class="mention hashtag" rel="nofollow noopener" target="_blank">#hackers</a> can <a href="https://mas.to/tags/exploit" class="mention hashtag" rel="nofollow noopener" target="_blank">#exploit</a> them. Now <a href="https://mas.to/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#Google</a> warns the breach goes far beyond access to Salesforce data, noting the hackers responsible also stole valid <a href="https://mas.to/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://mas.to/tags/tokens" class="mention hashtag" rel="nofollow noopener" target="_blank">#tokens</a> for hundreds of online services <a href="https://mas.to/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a><a href="https://krebsonsecurity.com/2025/09/the-ongoing-fallout-from-a-breach-at-ai-chatbot-maker-salesloft/" rel="nofollow noopener" translate="no" target="_blank">https://krebsonsecurity.com/2025/09/the-ongoing-fallout-from-a-breach-at-ai-chatbot-maker-salesloft/</a>

Erik van Straten<a href="https://fedifreu.de/@smartphone" class="u-url mention" rel="nofollow noopener" target="_blank">@smartphone</a> : if the device you use to login to a server is compromised, it is game over anyway - regardless where the OTP comes from.How it works: to prevent that you have to log in again for each transaction with the website, immediately after logging in, the website sends a 1FA session cookie (or "JWT") to your browser. Your browser will include that cookie in any request or instruction sent to the server, so that the server "knows" that it's you - who has already logged in.So such a 1FA session cookie replaces your MFA login credentials!Note that there are hardly any websites that bind (bind server side) session cookies to the client's IP-address. As a result, if an attacker with backdoor access to your device copies (or steals) a 1FA session cookie from your compromised device, they can use that cookie (from any client IP-address) to access your account. That is, without having to log in, i.e. without having to enter your password, nor any 2FA (T)OTP code.Furthermore, most people are not aware that a TOTP app is a STUPID password manager: shared secrets (stored on both the server and client) need to be backed up in a secure manner (which is not typical) while such apps do not detect fake AitM (Attacker in the Middle) websites: they're not phishing resistant.Therefore: 1️⃣ Make sure your client device and browser never get compromised (that would mean "game over').2️⃣ Use a password manager that only reveals the correct credentials if the website name (aka domain name) matches the one stored in the password database. On Android and iOS/iPadOS, "Autofill" helps do just that - without requiring a browser add-on. Note: do NOT manually search the password manager database if a there is "no hit" because of an unrecognized domain name, i.e. mailchimp-sso dot com is NOT mailchimp dot com (see <a href="https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/" rel="nofollow noopener" translate="no" target="_blank">https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/</a>).3️⃣ Use a strong (long, unpredictable, not re-used but memorable) master password for your password manager and prevent "forgot it" lock-out (you may want to write it down on paper somewhere and/or share it with someone you trust).4️⃣ Make sure you back up the password manager's database after each change, preferably in multiple locations, at least one offline. Including TOTP data in the password manager database *does* increase the risk of compromising all at once, but making sure you have access to secure backups reduces the risk of account lock-out. It's always about balancing risks.5️⃣ Slightly unrelated: use a browser that supports "https only" and enable it. Said "https only" is a misnomer: it means "warn if http is used because https is not possible". NOTE: never share any confidential info with, or trust content from, a website via a non-https connection. Also note that https (including the required certificate) do NOT AT ALL warrant a trustworthy website. In fact https only guarantees a secure connection (E2EE) between your browser and the website whose "name" (domain name) is shown in your browser's address bar. Unfortunately, in case of "Men in the Middle" proxies like CloudFlare, the shown domain name may NOT point to the actual webserver (in such a case, Cloudflare knows your password as well).<a href="https://mastodon.com.br/@rodsilva" class="u-url mention" rel="nofollow noopener" target="_blank">@rodsilva</a> <a href="https://mastodon.social/@eff" class="u-url mention" rel="nofollow noopener" target="_blank">@eff</a> <a href="https://infosec.exchange/tags/Passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwords</a> <a href="https://infosec.exchange/tags/PasswordManager" class="mention hashtag" rel="nofollow noopener" target="_blank">#PasswordManager</a> <a href="https://infosec.exchange/tags/OTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#OTP</a> <a href="https://infosec.exchange/tags/TOTP" class="mention hashtag" rel="nofollow noopener" target="_blank">#TOTP</a> <a href="https://infosec.exchange/tags/Weak2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#Weak2FA</a> <a href="https://infosec.exchange/tags/WeakMFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#WeakMFA</a> <a href="https://infosec.exchange/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#MFA</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/FakeWebsites" class="mention hashtag" rel="nofollow noopener" target="_blank">#FakeWebsites</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/EvilGinx" class="mention hashtag" rel="nofollow noopener" target="_blank">#EvilGinx</a> <a href="https://infosec.exchange/tags/CloudflareIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#CloudflareIsEvil</a> <a href="https://infosec.exchange/tags/BigTechIsEvil" class="mention hashtag" rel="nofollow noopener" target="_blank">#BigTechIsEvil</a> <a href="https://infosec.exchange/tags/Risk" class="mention hashtag" rel="nofollow noopener" target="_blank">#Risk</a> <a href="https://infosec.exchange/tags/Risks" class="mention hashtag" rel="nofollow noopener" target="_blank">#Risks</a> <a href="https://infosec.exchange/tags/AccountLockout" class="mention hashtag" rel="nofollow noopener" target="_blank">#AccountLockout</a> <a href="https://infosec.exchange/tags/AccountTakeOver" class="mention hashtag" rel="nofollow noopener" target="_blank">#AccountTakeOver</a> <a href="https://infosec.exchange/tags/SessionCookie" class="mention hashtag" rel="nofollow noopener" target="_blank">#SessionCookie</a> <a href="https://infosec.exchange/tags/JWT" class="mention hashtag" rel="nofollow noopener" target="_blank">#JWT</a> <a href="https://infosec.exchange/tags/WebSession" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebSession</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a>

gtbarryNew NIST guide explains how to detect morphed imagesFace Analysis Technology Evaluation (FATE) explains morphing in simple terms and offers advice on how to respond. It is meant to help organizations set up detection systems in places where morphed photos might appear, such as passport offices or border crossings. <a href="https://mastodon.social/tags/NIST" class="mention hashtag" rel="nofollow noopener" target="_blank">#NIST</a> <a href="https://mastodon.social/tags/photography" class="mention hashtag" rel="nofollow noopener" target="_blank">#photography</a> <a href="https://mastodon.social/tags/FATE" class="mention hashtag" rel="nofollow noopener" target="_blank">#FATE</a> <a href="https://mastodon.social/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://mastodon.social/tags/images" class="mention hashtag" rel="nofollow noopener" target="_blank">#images</a> <a href="https://mastodon.social/tags/imaging" class="mention hashtag" rel="nofollow noopener" target="_blank">#imaging</a> <a href="https://mastodon.social/tags/GenAI" class="mention hashtag" rel="nofollow noopener" target="_blank">#GenAI</a> <a href="https://mastodon.social/tags/technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#technology</a> <a href="https://mastodon.social/tags/tech" class="mention hashtag" rel="nofollow noopener" target="_blank">#tech</a><a href="https://www.helpnetsecurity.com/2025/08/18/nist-guide-detect-morphed-images/" rel="nofollow noopener" translate="no" target="_blank">https://www.helpnetsecurity.com/2025/08/18/nist-guide-detect-morphed-images/</a>

Inautilo<a href="https://mastodon.social/tags/Development" class="mention hashtag" rel="nofollow noopener" target="_blank">#Development</a> <a href="https://mastodon.social/tags/Guides" class="mention hashtag" rel="nofollow noopener" target="_blank">#Guides</a> An illustrated guide to OAuth · How delegated access works behind the scenes <a href="https://ilo.im/166dtf" rel="nofollow noopener" translate="no" target="_blank">https://ilo.im/166dtf</a>_____ <a href="https://mastodon.social/tags/Authorization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authorization</a> <a href="https://mastodon.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://mastodon.social/tags/OAuth" class="mention hashtag" rel="nofollow noopener" target="_blank">#OAuth</a> <a href="https://mastodon.social/tags/ClientServer" class="mention hashtag" rel="nofollow noopener" target="_blank">#ClientServer</a> <a href="https://mastodon.social/tags/ThirdParty" class="mention hashtag" rel="nofollow noopener" target="_blank">#ThirdParty</a> <a href="https://mastodon.social/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://mastodon.social/tags/WebDev" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebDev</a> <a href="https://mastodon.social/tags/Frontend" class="mention hashtag" rel="nofollow noopener" target="_blank">#Frontend</a> <a href="https://mastodon.social/tags/Backend" class="mention hashtag" rel="nofollow noopener" target="_blank">#Backend</a>

Miguel Afonso Caetano"Even the very idea that we could arrive at a broadly accepted consensus on facts – regardless of their content – has grown more remote. It is down these knowledge sinkholes that the sense of ‘selfdom’ gets further elaborated, sometimes in tragic ways, through the belief that the self is the only true source of its own enlightenment.The combination of epistemological self-centredness and hyperconnectivity makes people susceptible to diffuse forms of ‘supersense’-making (to borrow a term from Hannah Arendt). Seeking some meaningful truth, people search for significant clues scattered across the internet, using commercial algorithms and recommender systems to connect the disparate pieces of information they venture upon into some sort of coherent worldview. What may begin as a playful existential quest can easily crystallise into reality-bending beliefs that thrive on and foster new social types and politically potent associations. At its peak, QAnon exemplified the interactions between the searching disposition, digital mediations and for-profit targeting. Its members saw themselves as critical thinkers uniquely equipped to discover hidden truths and interpret byzantine clues. They ferociously denied being part of a cult, since, as one of them put it to the researcher Peter Forberg, ‘no cult tells you to think for yourself.’One might think that the advent of LLMs will counter these tendencies. Perhaps if properly integrated with a search engine, an LLM might distil vast amounts of information into coherent responses that do not pander. It can certainly provide seemingly authoritative summaries that look like answers, though its inner workings remain essentially opaque. But it is not clear whether such systems – even if they work as advertised – can solve the problem of reliable knowledge in a balkanised public sphere."<a href="https://aeon.co/essays/the-sovereign-individual-and-the-paradox-of-the-digital-age" rel="nofollow noopener" translate="no" target="_blank">https://aeon.co/essays/the-sovereign-individual-and-the-paradox-of-the-digital-age</a><a href="https://tldr.nettime.org/tags/Algorithms" class="mention hashtag" rel="nofollow noopener" target="_blank">#Algorithms</a> <a href="https://tldr.nettime.org/tags/Authenticity" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authenticity</a> <a href="https://tldr.nettime.org/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://tldr.nettime.org/tags/SelfSovereignty" class="mention hashtag" rel="nofollow noopener" target="_blank">#SelfSovereignty</a> <a href="https://tldr.nettime.org/tags/Individualism" class="mention hashtag" rel="nofollow noopener" target="_blank">#Individualism</a> <a href="https://tldr.nettime.org/tags/SocialMedia" class="mention hashtag" rel="nofollow noopener" target="_blank">#SocialMedia</a> <a href="https://aeon.co/essays/the-sovereign-individual-and-the-paradox-of-the-digital-age" rel="nofollow noopener" translate="no" target="_blank">https://aeon.co/essays/the-sovereign-individual-and-the-paradox-of-the-digital-age</a>

Alexander HanffSo I <a href="https://eupolicy.social/tags/created" class="mention hashtag" rel="tag">#created</a> an <a href="https://eupolicy.social/tags/app" class="mention hashtag" rel="tag">#app</a> that opens a mixed <a href="https://eupolicy.social/tags/immersive" class="mention hashtag" rel="tag">#immersive</a> space and anchors to the head of the user (creating a HUD effect).Then I added wake word functionality so it would work like <a href="https://eupolicy.social/tags/Siri" class="mention hashtag" rel="tag">#Siri</a> Then I went back to my <a href="https://eupolicy.social/tags/Agent" class="mention hashtag" rel="tag">#Agent</a> code and added some new <a href="https://eupolicy.social/tags/OpenAI" class="mention hashtag" rel="tag">#OpenAI</a> compatible <a href="https://eupolicy.social/tags/API" class="mention hashtag" rel="tag">#API</a> endpoints with <a href="https://eupolicy.social/tags/authentication" class="mention hashtag" rel="tag">#authentication</a> Then I connected my VisionOS app to the API... now I have a fully functioning AI Agent directly in VisionOS but that wasn't enough...

Pyrzout :vm:New NIST guide explains how to detect morphed images <a href="https://www.helpnetsecurity.com/2025/08/18/nist-guide-detect-morphed-images/" rel="nofollow noopener" translate="no" target="_blank">https://www.helpnetsecurity.com/2025/08/18/nist-guide-detect-morphed-images/</a> <a href="https://social.skynetcloud.site/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://social.skynetcloud.site/tags/cybercrime" class="mention hashtag" rel="nofollow noopener" target="_blank">#cybercrime</a> <a href="https://social.skynetcloud.site/tags/Don" class="mention hashtag" rel="nofollow noopener" target="_blank">#Don</a>'tmiss <a href="https://social.skynetcloud.site/tags/research" class="mention hashtag" rel="nofollow noopener" target="_blank">#research</a> <a href="https://social.skynetcloud.site/tags/how" class="mention hashtag" rel="nofollow noopener" target="_blank">#how</a>-to <a href="https://social.skynetcloud.site/tags/scams" class="mention hashtag" rel="nofollow noopener" target="_blank">#scams</a> <a href="https://social.skynetcloud.site/tags/News" class="mention hashtag" rel="nofollow noopener" target="_blank">#News</a> <a href="https://social.skynetcloud.site/tags/NIST" class="mention hashtag" rel="nofollow noopener" target="_blank">#NIST</a> <a href="https://social.skynetcloud.site/tags/tips" class="mention hashtag" rel="nofollow noopener" target="_blank">#tips</a>

Threat InsightProofpoint threat researchers have uncovered a way to sidestep FIDO-based authentication, a protection method used to block credential phishing and account takeover (ATO).Blog: <a href="https://www.proofpoint.com/us/blog/threat-insight/dont-phish-let-me-down-fido-authentication-downgrade" rel="nofollow noopener" translate="no" target="_blank">https://www.proofpoint.com/us/blog/threat-insight/dont-phish-let-me-down-fido-authentication-downgrade</a>While the tactic has not yet been observed in the wild, the discovery is a significant emerging threat and exposes targets to adversary-in-the-middle (AiTM) threats.Read our blog to understand how this potential threat questions the reliability of FIDO (Fast Identity Online) passkey implementations, an authentication method currently viewed as robust for verifying user identities and recommended for improving online security. <a href="https://infosec.exchange/tags/FIDO" class="mention hashtag" rel="nofollow noopener" target="_blank">#FIDO</a> <a href="https://infosec.exchange/tags/authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#authentication</a> <a href="https://infosec.exchange/tags/ATO" class="mention hashtag" rel="nofollow noopener" target="_blank">#ATO</a> <a href="https://infosec.exchange/tags/MFA" class="mention hashtag" rel="nofollow noopener" target="_blank">#MFA</a>

Erik van Straten<a href="https://kolektiva.social/@LukefromDC" class="u-url mention" rel="nofollow noopener" target="_blank">@LukefromDC</a> wrote: > "Some people (myself included) will never reveal a real birthday online and will respond to a request for a birthday with a fake, will check an "I am over 18" box or button, but will close the tab for anything more."Sure, but the European Commission wants civillians to start using EUDIW (EUropean Digital Identity Wallet, aka EDIW) soon. If a website demands authentication using such an app, cheating will not be easy. You'll have two choices: abort or do what's being asked.Website owners mostly, if not always, demand more PII than strictly necessary. Lying will become a lot harder when using EDIW than filling in forms.> "I have NoScript (on the desktop) and Privacy Browser(on phones) set up to block 3ed party code unless explicitly enabled every time."I too use NoScript as much as possible. However, IMO it does not solve any risks associated with mandatory authentication.> "Any unique age verification token is a tracker by definition BTW."That is not necessarily true, at least according to the app's specification. There are all kinds of (possibly unexpected) tricks using (asymmetric) cryptography that can be played.All of which does not mean that I'm a fan, on the contrary. Reliable authentication (including partial, such as proving being e.g. 18+), online in particular, is HARD.It gets even harder if neither the verifier, nor the person being (partially) authenticated, benefits.And the more privacy-friendly the less reliable it becomes - and the harder it gets to detect fraud.<a href="https://sigmoid.social/@drgroftehauge" class="u-url mention" rel="nofollow noopener" target="_blank">@drgroftehauge</a> <a href="https://manganiello.social/users/fabio" class="u-url mention" rel="nofollow noopener" target="_blank">@fabio</a> <a href="https://chaos.social/@SylvieLorxu" class="u-url mention" rel="nofollow noopener" target="_blank">@SylvieLorxu</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/AgeVerification" class="mention hashtag" rel="nofollow noopener" target="_blank">#AgeVerification</a> <a href="https://infosec.exchange/tags/Fraud" class="mention hashtag" rel="nofollow noopener" target="_blank">#Fraud</a> <a href="https://infosec.exchange/tags/IdentityFraud" class="mention hashtag" rel="nofollow noopener" target="_blank">#IdentityFraud</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/EDIW" class="mention hashtag" rel="nofollow noopener" target="_blank">#EDIW</a> <a href="https://infosec.exchange/tags/EUDIW" class="mention hashtag" rel="nofollow noopener" target="_blank">#EUDIW</a> <a href="https://infosec.exchange/tags/eID" class="mention hashtag" rel="nofollow noopener" target="_blank">#eID</a> <a href="https://infosec.exchange/tags/OnlineAuthentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#OnlineAuthentication</a> <a href="https://infosec.exchange/tags/RemoteAuthentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#RemoteAuthentication</a>

Erik van Straten<a href="https://kolektiva.social/@LukefromDC" class="u-url mention" rel="nofollow noopener" target="_blank">@LukefromDC</a> : it won't be that bad (it will be bad, but in a different way).ANY website may ask a user to confirm they are 18+ (or whatever age).There will be a huge amount of AitM (Attacker in the Middle) websites where naive people will be lured to (using fake emails, SMS, chat app messages or falsified QR-codes) and asked to confirm their age.That AitM website will subsequently obtain a "ticket" (session cookie) from a real "relying party" website (with a potentially very different type of content than the victim is told).Those "tickets" will be sold (or traded for watching ads and/or paying with privacy).Reliable authentication requires a trustworthy identity verifier (even if identification is restricted to age+).<a href="https://sigmoid.social/@drgroftehauge" class="u-url mention" rel="nofollow noopener" target="_blank">@drgroftehauge</a> <a href="https://manganiello.social/users/fabio" class="u-url mention" rel="nofollow noopener" target="_blank">@fabio</a> <a href="https://chaos.social/@SylvieLorxu" class="u-url mention" rel="nofollow noopener" target="_blank">@SylvieLorxu</a> <a href="https://infosec.exchange/tags/AgeVerification" class="mention hashtag" rel="nofollow noopener" target="_blank">#AgeVerification</a> <a href="https://infosec.exchange/tags/ByPass" class="mention hashtag" rel="nofollow noopener" target="_blank">#ByPass</a> <a href="https://infosec.exchange/tags/Phishing" class="mention hashtag" rel="nofollow noopener" target="_blank">#Phishing</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/IdentityVerification" class="mention hashtag" rel="nofollow noopener" target="_blank">#IdentityVerification</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/ForSale" class="mention hashtag" rel="nofollow noopener" target="_blank">#ForSale</a>

Erik van Straten<a href="https://social.wildeboer.net/@jwildeboer" class="u-url mention" rel="nofollow noopener" target="_blank">@jwildeboer</a> : modern certificates are used for authentication only, not for secure connections.OTOH, if you have no certainty that your software is communicating with the server you intended, a secure connection to it is pointless - but the connection remains secure.Using TLS v1.3, the connection is even secured before the server is authenticated (if, after encrypting the connection, the authentication of the server fails, then the client should at least warn the user - if not immediately disconnect).Yes, I know, these are boring details, but they are misunderstood way too often by people who SHOULD know how this works (I know you do, but please don't simplify things too much). <a href="https://infosec.exchange/tags/TLS" class="mention hashtag" rel="nofollow noopener" target="_blank">#TLS</a> <a href="https://infosec.exchange/tags/https" class="mention hashtag" rel="nofollow noopener" target="_blank">#https</a> <a href="https://infosec.exchange/tags/X509" class="mention hashtag" rel="nofollow noopener" target="_blank">#X509</a> <a href="https://infosec.exchange/tags/Certificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#Certificates</a> <a href="https://infosec.exchange/tags/Certs" class="mention hashtag" rel="nofollow noopener" target="_blank">#Certs</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/TLSv1_3" class="mention hashtag" rel="nofollow noopener" target="_blank">#TLSv1_3</a> <a href="https://infosec.exchange/tags/ForwardSecrecy" class="mention hashtag" rel="nofollow noopener" target="_blank">#ForwardSecrecy</a> <a href="https://infosec.exchange/tags/DH" class="mention hashtag" rel="nofollow noopener" target="_blank">#DH</a> <a href="https://infosec.exchange/tags/DHE" class="mention hashtag" rel="nofollow noopener" target="_blank">#DHE</a> <a href="https://infosec.exchange/tags/DiffieHellman" class="mention hashtag" rel="nofollow noopener" target="_blank">#DiffieHellman</a>

|7eter l-|. l3oling 🧰ANN: :ruby: omniauth-identity v3.1.4Release Notes: <a href="https://dev.to/galtzo/ann-omniauth-identity-v314-2371" rel="nofollow noopener" translate="no" target="_blank">https://dev.to/galtzo/ann-omniauth-identity-v314-2371</a><a href="https://ruby.social/tags/Ruby" class="mention hashtag" rel="nofollow noopener" target="_blank">#Ruby</a> <a href="https://ruby.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://ruby.social/tags/Security" class="mention hashtag" rel="nofollow noopener" target="_blank">#Security</a> <a href="https://ruby.social/tags/Rails" class="mention hashtag" rel="nofollow noopener" target="_blank">#Rails</a>

Erik van Straten<a href="https://infosec.exchange/@adfichter" class="u-url mention" rel="nofollow noopener" target="_blank">@adfichter</a> : I'm trying to warn people for such holes.Published earlier this month: <a href="https://www.heise.de/en/news/BSI-and-ANSSI-warn-against-VideoIdent-for-the-EU-digital-wallet-10476045.html" rel="nofollow noopener" translate="no" target="_blank">https://www.heise.de/en/news/BSI-and-ANSSI-warn-against-VideoIdent-for-the-EU-digital-wallet-10476045.html</a> (there of course is a German version as well).It refers to a recent joint publication (in English) by the German BSI and the French ANSSI titled:"Remote ldentity Proofing for EUDI Wallet Onboarding: Strengthening Assurance Against Evolving Threats"(EUDI Wallet = European Digital Identity Wallet aka EDIW aka EUDIW).It's about the risks of VideoIdent (getting bigger every day, see e.g. <a href="https://www.theverge.com/report/714402/uk-age-verification-bypass-death-stranding-reddit-discord" rel="nofollow noopener" translate="no" target="_blank">https://www.theverge.com/report/714402/uk-age-verification-bypass-death-stranding-reddit-discord</a> - not to mention AI).However, like in their previous publication (PDF: <a href="https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/ANSSI-BSI-joint-releases/ANSSI-BSI_joint-release_2023.pdf?__blob=publicationFile&v=3" rel="nofollow noopener" translate="no" target="_blank">https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/ANSSI-BSI-joint-releases/ANSSI-BSI_joint-release_2023.pdf?__blob=publicationFile&v=3</a>) they ignore one HUGE risk: AitM's (Attacker in the Middle).The unmentioned gaping security hole here are fake websites, where people are being directed to via falsified emails, SMS, chat app messages and possibly QR-codes.Step 1️⃣: ———— Victim (contacts AitM site as instructed) | | "Please give me my EDIW" v AitM site: contacts site below and forwards | | "Please give me my EDIW" v True EDIW identity verification siteStep 2️⃣: ———— Victim ^ | "Please perform VideoIdent" | AitM site: forwards ^ | "Please perform VideoIdent" | True EDIW identity verification siteStep 3️⃣: ———— Victim | | VideoIdent showing victim v AitM site: forwards | | VideoIdent showing victim v True EDIW identity verification siteStep 4️⃣: ———— Victim ^ | "Something went wrong" | AitM site: stores victim's EDIW on their device ^ | EDIW | True EDIW identity verification siteThe same may happen to people who are tricked into *authenticating* using EDIW on AitM websites.<a href="https://mastodon.nl/@ellent" class="u-url mention" rel="nofollow noopener" target="_blank">@ellent</a> <a href="https://infosec.exchange/tags/EDIW" class="mention hashtag" rel="nofollow noopener" target="_blank">#EDIW</a> <a href="https://infosec.exchange/tags/EUDIW" class="mention hashtag" rel="nofollow noopener" target="_blank">#EUDIW</a> <a href="https://infosec.exchange/tags/AitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#AitM</a> <a href="https://infosec.exchange/tags/MitM" class="mention hashtag" rel="nofollow noopener" target="_blank">#MitM</a> <a href="https://infosec.exchange/tags/VideoIdent" class="mention hashtag" rel="nofollow noopener" target="_blank">#VideoIdent</a> <a href="https://infosec.exchange/tags/OnlineAuthentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#OnlineAuthentication</a> <a href="https://infosec.exchange/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://infosec.exchange/tags/Impersonation" class="mention hashtag" rel="nofollow noopener" target="_blank">#Impersonation</a> <a href="https://infosec.exchange/tags/Identification" class="mention hashtag" rel="nofollow noopener" target="_blank">#Identification</a> <a href="https://infosec.exchange/tags/IdentityFraud" class="mention hashtag" rel="nofollow noopener" target="_blank">#IdentityFraud</a> <a href="https://infosec.exchange/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a>

Serge from BabkaAnother approach would be if Alice could generate multiple Passkeys and hand them out to individuals she trusts, and then retaining the ability to revoke them. Sadly many sites don't yet support Passkeys, and this model still lets someone like Mal revoke Alice's access, so that's not great.Bitwarden has a feature whereby Alice can share a password with Eve but not let her see it or export it. This could work pretty well, except that if the site requires 2FA from a SMS text message (vs TOTP or a token) or if Eve has the knowhow to intercept the password.I still think that what we ultimately want is attenuated scopes because then we can track all actions by the delegated party.I do wonder if this need is niche or if the current solution of "good faith password sharing" works well enough often enough that it's not risen to the level of concern for developers.2/2<a href="https://babka.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://babka.social/tags/Authorization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authorization</a> <a href="https://babka.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://babka.social/tags/Passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwords</a> <a href="https://babka.social/tags/Passwordless" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwordless</a> <a href="https://babka.social/tags/Programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#Programming</a>

Serge from BabkaI've been thinking about delegated authority on websites lately.It would be convenient if I could delegate certain functions to people, for example allowing someone like my accountant to have access to some of my financial records.Some organizations make this easy, allowing me to have multiple accounts.Other services don't offer this, nor do they offer any kind of OAuth type of delegated authorization or capabilities model.I've been thinking about ways around this.One very wacky way would be if Alice could have a a "special browser" that would tie into some service she runs. Bob would log in with his credentials and then behind the scenes the application logs in as Alice.This would be very complicated to implement though.1/<a href="https://babka.social/tags/Authentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authentication</a> <a href="https://babka.social/tags/Authorization" class="mention hashtag" rel="nofollow noopener" target="_blank">#Authorization</a> <a href="https://babka.social/tags/InfoSec" class="mention hashtag" rel="nofollow noopener" target="_blank">#InfoSec</a> <a href="https://babka.social/tags/Passwords" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwords</a> <a href="https://babka.social/tags/Passwordless" class="mention hashtag" rel="nofollow noopener" target="_blank">#Passwordless</a> <a href="https://babka.social/tags/Programming" class="mention hashtag" rel="nofollow noopener" target="_blank">#Programming</a>

Recent searches

Search options

Administered by:

Server stats: