» Tag
authentication
30 postsBeyond login: encrypting data with passkeys and WebAuthn PRF
WebAuthn's PRF extension turns passkey login into an encryption key source; pknotes shows a master-password-free, end-to-end encrypted architecture.
$13,337 Bounty: Google Device Code Flow Account Takeover Bug
Google paid a $13,337 bounty for a confused-deputy flaw in its RFC 8628 device authorization flow enabling account takeover.
A Portable Passkey Record Format and Go API Proposal
A proposed portable string format for WebAuthn passkey records, plus a stateless Go API draft, aiming to simplify interoperable credential storage.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comSAML Replay Flaw: Signed Assertion, Unsigned Response Envelope
SAML's InResponseTo field is unsigned and strippable, letting attackers bypass replay protection; the fix is binding checks to the signed assertion ID.
Why AI Agents Must Never Choose Their Own Acting Subject
AI agents shouldn't self-assign identity via tool arguments. Learn why acting subjects must come from trusted boundaries, not model output.
OIDC MFA Bypass: How One URL Parameter Skipped the Second Factor
An OIDC login flow let attackers skip MFA by editing a return URL; the fix moves enforcement from the login page to the token-issuing endpoint.
IETF Publishes Best Current Practice for Cross-Device Flow Security
New IETF BCP (RFC 10027) details cross-device flow security threats, real-world exploits, and mitigation strategies for engineers and architects.
freeq ties AI model spend to identity, not shared API keys
freeq extends its DID-based protocol to gate AI model spend by identity, letting agents borrow bounded capacity without sharing API keys.
Critical Auth Bypass in Gitea Docker Images Exposed
Learn about the critical authentication bypass in Gitea Docker images. Update promptly to enhance your security.
Environments Are Not Features: A Real Sandbox Architecture
One frontend, many environments: how proxy-based routing, identity copying and hard reloads build a real sandbox architecture that holds up.