#аутентификация
-
Microsoft Authenticator Flaw on Android Let Permissionless Apps Steal Work Account Tokens
Microsoft has fixed CVE-2026-80097 in Authenticator for Android, which let a malicious app with no permissions pose as Teams and obtain tokens for a work account. Users should update to version 6.2606.4246.
-
Passkeys Are a Trap: The Hidden Dial Inside an Elegant Technology
The Non-Functional blog argues that passwords aren't being replaced by simply "more secure keys," but by a whole catalogue of different things sharing one name — and that the most dangerous of them is called attestation.
-
39 Ways to Bypass Passkeys Without Breaking FIDO2 Cryptography
Researchers have documented at least 39 methods for compromising passkey-based authentication. None of them requires breaking the cryptography—they attack everything around it.
-
Chrome is testing an email verification protocol with no emails and no one-time codes
Google has launched an origin trial for the Email Verification API — a mechanism that lets a site confirm a user owns the address they entered, without sending them an email with a link or a code.
-
BeyondTrust Warns of Critical Vulnerabilities in Remote Access Software
BeyondTrust has urged customers to immediately address two critical vulnerabilities in its Remote Support and Privileged Remote Access products. The flaws allow attackers to bypass authentication.
-
The Challenge of Identifying AI Agents in Security
The blog's author raises the topic of securing the identity of autonomous AI agents. The piece was published on codon.org.uk.