#Authentication

21,000 Exposed MCP Servers Are a Defaults Problem

New internet-wide scanning research shows MCP's authorization spec works — the way developers deploy servers doesn't.

Article · 1w ago0

Synced Passkeys Have a Malware Problem

Unit 42's Pass-ta-key attacks steal Google passkeys from a compromised endpoint without breaking any crypto.

Article · 3w ago2

Passkeys Still Kill Phishing. Malware Is Another Story.

Unit 42's Pass-ta-key attacks show synced Google passkeys can be forged, re-verified, and exported wholesale from a compromised Windows box.

Article · 3w ago0

DNS Poisoning on Hotel Wi-Fi Is a Phishing Problem

The attackers registered lookalike domains and got real certificates, which tells you exactly which defense works.

Article · 1mo ago0

676,000 Trucks Behind an API With No Auth

VECV patched in 17 days, but the architecture that made full takeover trivial is everywhere.

Article · 1mo ago5

Add Passkeys to Your Web App with Node.js and WebAuthn

Ship Face ID and Touch ID sign-in using SimpleWebAuthn v13 and Express 5 in about 150 lines.

Tutorial · 1mo ago0

Issue HMAC-Signed, Scoped API Keys for a Public REST API

Replace static bearer tokens with per-client HMAC request signing, scoped permissions, and replay protection in Node.js.

Tutorial · 1mo ago0

Add Google Sign-In to a Node.js App with OpenID Connect

Wire up Sign in with Google using OIDC discovery, verified ID tokens, and secure session cookies.

Tutorial · 1mo ago0

GitHub Locks 2FA On for Good This September

The September 2 deadline ends three years of soft enforcement and points at GitHub's real target: long-lived tokens.

Article · 1mo ago4

n8n Cross-Issuer Bug Turns JWT sub Into Account Takeover

Multi-issuer token exchange ignored iss, so matching subjects meant full account access.

Article · 1mo ago1

Voice Auth Is Dead. Your IVR Just Doesn't Know It Yet

AI clones any voice from three seconds of audio, and the fraud numbers say detection alone can no longer save you.

Article · 1mo ago2

Add TOTP-Based Two-Factor Authentication to Your Web App

Build a working Flask app that generates a QR-code enrollment flow and enforces rotating 6-digit codes on login, using pyotp for the TOTP math.

Tutorial · 1mo ago1

Hardware Passkeys Gate OpenAI’s Frontier Cyber Models

Identity assurance is joining model safety as a core control for high-privilege AI access.

Article · 1mo ago1

Hand-Rolling OAuth 2.0 Authorization Code + PKCE in a React SPA

Build a React login flow against Auth0 using Authorization Code + PKCE, with no SDK doing the work for you and no client secret anywhere in the browser.

Tutorial · 1mo ago0

Why Logto Is Challenging the B2B Auth Status Quo

A deep look at how this open-source, OIDC-compliant identity engine tackles multi-tenancy and agentic AI architectures.

Article · 1mo ago6