Topic

#Authentication

17 articles on Authentication — news, releases, guides and analysis from the SourceFeed engine.

Article 5d ago 2

Synced Passkeys Have a Malware Problem

Unit 42's Pass-ta-key attacks steal Google passkeys from a compromised endpoint without breaking any crypto.

Ji-ho Choi

Passkeys Still Kill Phishing. Malware Is Another Story.

Unit 42's Pass-ta-key attacks show synced Google passkeys can be forged, re-verified, and exported wholesale from a compromised Windows box.

Article · 1w ago0

DNS Poisoning on Hotel Wi-Fi Is a Phishing Problem

The attackers registered lookalike domains and got real certificates, which tells you exactly which defense works.

Article · 2w ago0

676,000 Trucks Behind an API With No Auth

VECV patched in 17 days, but the architecture that made full takeover trivial is everywhere.

Article · 2w ago5

Add Passkeys to Your Web App with Node.js and WebAuthn

Ship Face ID and Touch ID sign-in using SimpleWebAuthn v13 and Express 5 in about 150 lines.

Tutorial · 2w ago0

Issue HMAC-Signed, Scoped API Keys for a Public REST API

Replace static bearer tokens with per-client HMAC request signing, scoped permissions, and replay protection in Node.js.

Tutorial · 3w ago0

Add Google Sign-In to a Node.js App with OpenID Connect

Wire up Sign in with Google using OIDC discovery, verified ID tokens, and secure session cookies.

Tutorial · 3w ago0

GitHub Locks 2FA On for Good This September

The September 2 deadline ends three years of soft enforcement and points at GitHub's real target: long-lived tokens.

Article · 3w ago4

n8n Cross-Issuer Bug Turns JWT sub Into Account Takeover

Multi-issuer token exchange ignored iss, so matching subjects meant full account access.

Article · 4w ago1

Voice Auth Is Dead. Your IVR Just Doesn't Know It Yet

AI clones any voice from three seconds of audio, and the fraud numbers say detection alone can no longer save you.

Article · 4w ago2

Add TOTP-Based Two-Factor Authentication to Your Web App

Build a working Flask app that generates a QR-code enrollment flow and enforces rotating 6-digit codes on login, using pyotp for the TOTP math.

Tutorial · 4w ago1

Hardware Passkeys Gate OpenAI’s Frontier Cyber Models

Identity assurance is joining model safety as a core control for high-privilege AI access.

Article · 4w ago1

Hand-Rolling OAuth 2.0 Authorization Code + PKCE in a React SPA

Build a React login flow against Auth0 using Authorization Code + PKCE, with no SDK doing the work for you and no client secret anywhere in the browser.

Tutorial · 1mo ago0

Why Logto Is Challenging the B2B Auth Status Quo

A deep look at how this open-source, OIDC-compliant identity engine tackles multi-tenancy and agentic AI architectures.

Article · 1mo ago6

The Client-Side Illusion: Lessons from the J&J Web App Vulnerabilities

Relying on frontend SSO flows without backend token validation is a recipe for trivial administrative takeovers.

Article · 1mo ago0

Why JWTs Are a Security Anti-Pattern for Sessions

Relying on stateless JSON Web Tokens for persistent user sessions introduces severe security risks and architectural complexity.

Article · 1mo ago0