IdentityBriefing
TopicsIdentity AttacksAI & Agent IdentityAuthenticationStandards & RegulationVendor MovesCommunity & Events
Topic

Authentication

Passkeys, FIDO, MFA and how people and machines prove who they are. What is shipping, what is breaking, and what it means for enterprise authentication rollouts.

  1. authentication

    103 Websites Had Passkeys. None Got Implementation Right

    Louis Jannett's USENIX-award-winning research found 18 critical and 53 high-severity vulnerabilities across 103 real-world passkey deployments. The biggest companies were the worst offenders.

  2. identity attacks · authentication

    Attackers are going after the password reset, not the password

    A critical Keycloak flaw, a Kerberos attack called ResetNightmare and a wave of helpdesk social engineering all point at the same gap: recovery is weaker than the login it replaces.

  3. authentication

    OpenAI will sell you a YubiKey now

    A custom two-pack under the Advanced Account Security programme. Hardware-backed passkeys are becoming a consumer product, not a privileged-user control.

  4. identity attacks · authentication

    Three Black Hat papers broke passkey deployments. None of them broke passkeys.

    Pass-the-Passkey, Pass-Ta-Key and a Windows Hello abuse technique all reached privileged access without ever touching a private key.

  5. identity attacks · authentication

    Entra ID makes passkeys the default. Attackers went for enrolment first.

    Microsoft flips the default in September 2026. Okta has already documented a threat actor phoning users through a fake enrolment flow.

  6. authentication · ai & agent identity

    OpenAI will gate its most capable cyber models behind a physical key

    Identity used to gate a capability rather than data. From 1 September, Trusted Access for Cyber needs a hardware-backed passkey.

The fortnightly read for identity practitioners.

Original data from identity leaders, one proper deep dive, and the fortnight's news that actually matters. Free, every two weeks.

Read the latest issue →

You're subscribed. Read the latest issue →