Digitalcourage @digitalcourage

0 posts0 participants0 posts today

**Pyrzout** @jos1264@social.skynetcloud.site · Sep 6

Pyrzout @jos1264@social.skynetcloud.site

Making Self-Service Password Reset and Account Recovery Secure – Source: securityboulevard.com https://ciso2ciso.com/making-self-service-password-reset-and-account-recovery-secure-source-securityboulevard-com/ #rssfeedpostgeneratorecho #SecurityBloggersNetwork #CyberSecurityNews #SecurityBoulevard #Identity&Access #Risk&Compliance #authentication #Industrynews #passwordless #Perspectives #Passkeys #SBNNews

CISO2CISO.COM & CYBER SECURITY GROUP · Sep 6Making Self-Service Password Reset and Account Recovery Secure – Source: securityboulevard.comSource: securityboulevard.com - Author: Roman Kadinsky, Cofounder, President & COO, HYPR Self-service password reset (SSPR) and self-service accoun

**Nishant Kaushik** @NishantK@infosec.exchange · Sep 2 *

Sep 2 *

Nishant Kaushik @NishantK@infosec.exchange

In my first FIDO Alliance blog post, I cut through the noise around “passkeys being hacked” and clarify that the real issues lie in compromised environments, not in the technology. For product teams and leaders evaluating authentication strategies, the takeaway is straightforward: passkeys remain one of our strongest defenses against phishing and credential theft — when they’re implemented thoughtfully and paired with good security hygiene.

If you’ve been hesitant because of scary headlines, I hope this helps turn things back to reality: passkeys are here to stay, and they’re a major step forward.

Read the full thoughts here: https://fidoalliance.org/passkeys-are-not-broken-the-conversation-about-them-often-is

FIDO Alliance · Sep 2Passkeys Are Not Broken. The Conversation About Them Often Is | FIDO AllianceEvery few months, like clockwork, a talk or article appears claiming that new research has uncovered a “vulnerability” with passkeys. This can

#Passkeys #Security #Passwordless

**Pyrzout** @jos1264@social.skynetcloud.site · Jul 31

Jul 31

Pyrzout @jos1264@social.skynetcloud.site

Passwordless Future Years Away Despite Microsoft Authenticator Move – Source: www.infosecurity-magazine.com https://ciso2ciso.com/passwordless-future-years-away-despite-microsoft-authenticator-move-source-www-infosecurity-magazine-com/ #rssfeedpostgeneratorecho #InfoSecurityMagazine #InfosecurityMagazine #CyberSecurityNews #passwordless

CISO2CISO.COM & CYBER SECURITY GROUP · Jul 31Passwordless Future Years Away Despite Microsoft Authenticator Move – Source: www.infosecurity-magazine.comSource: www.infosecurity-magazine.com - Author: Password managers will remain a valuable bulwark against identity-rela

**Alvin Ashcraft** @alvinashcraft@hachyderm.io · Jul 24

Jul 24

Alvin Ashcraft @alvinashcraft@hachyderm.io

Yubico delivers PIN advancements with new YubiKey 5 – Enhanced PIN keys.

https://www.yubico.com/blog/yubico-delivers-pin-advancements-with-new-yubikey-5-enhanced-pin-keys/

#security #yubikey #passwordless

Continued thread

**ansuz / ऐरन** @ansuz@social.cryptography.dog · Jul 19

Jul 19

ansuz / ऐरन @ansuz@social.cryptography.dog

apparently family members are freaked out because microsoft is pushing their bullshit #passwordless nonsense, and there's an arbitrary deadline for August 1st on which they say they're going to delete all their passwords.

their default browser home pages have a bunch of suggested articles with scary headlines, and when they try to search for more information about it the information at the top of the page is LLM nonsense which only freaks them out more.

Continued thread

**Serge from Babka** @serge@babka.social · Jul 13

Jul 13

Serge from Babka @serge@babka.social

Another approach would be if Alice could generate multiple Passkeys and hand them out to individuals she trusts, and then retaining the ability to revoke them. Sadly many sites don't yet support Passkeys, and this model still lets someone like Mal revoke Alice's access, so that's not great.

Bitwarden has a feature whereby Alice can share a password with Eve but not let her see it or export it. This could work pretty well, except that if the site requires 2FA from a SMS text message (vs TOTP or a token) or if Eve has the knowhow to intercept the password.

I still think that what we ultimately want is attenuated scopes because then we can track all actions by the delegated party.

I do wonder if this need is niche or if the current solution of "good faith password sharing" works well enough often enough that it's not risen to the level of concern for developers.

2/2

#Authentication #Authorization #InfoSec

**Serge from Babka** @serge@babka.social · Jul 13 *

Jul 13 *

Serge from Babka @serge@babka.social

I've been thinking about delegated authority on websites lately.

It would be convenient if I could delegate certain functions to people, for example allowing someone like my accountant to have access to some of my financial records.

Some organizations make this easy, allowing me to have multiple accounts.

Other services don't offer this, nor do they offer any kind of OAuth type of delegated authorization or capabilities model.

I've been thinking about ways around this.

One very wacky way would be if Alice could have a a "special browser" that would tie into some service she runs. Bob would log in with his credentials and then behind the scenes the application logs in as Alice.

This would be very complicated to implement though.

#Authentication #Authorization #InfoSec