Search posts, papers, and topics
Passkeys improve phishing resistance but introduce higher lock‑out risk for individuals. Hardware keys have low per‑device account limits and no backup, while synced passkeys tie you to Apple/Google and can be lost if the provider bans you. Third‑party managers are still immature. For most users, a strong password + TOTP combo remains safer than current passkey ecosystems.
GitLab.com will tie API rate limits to subscription tiers: free users (and unauthenticated IPs) get 60 req/hr, while Premium/Ultimate get higher per‑user and per‑group caps starting Oct 19 2026 (free) and Jan 2027 (paid). Authenticated requests use the plan’s limits; hitting a limit returns 429 with Retry‑After. Preview “brownout” windows on Oct 7 and 14 let you test the new caps. If you need mor…
A step‑by‑step tutorial for building a zero‑trust WebAuthn passkey recovery flow in Node.js/TypeScript. It covers generating 128‑bit backup codes, hashing them with Argon2id, rate‑limited verification, time‑boxed JWT recovery sessions, and orchestrating new credential registration with @simplewebauthn/server while revoking lost credentials and rotating codes.
Auth0 announced a new integration with the AI‑powered low‑code platform v0 that lets developers generate full‑featured authentication (Auth0 tenant, apps, connections, SDK wiring, B2B orgs, MFA, etc.) directly from prompts, without leaving the v0 workflow.
The article proposes a rights‑respecting approach to age‑assurance, assigning actuation to services, using devices for privacy‑preserving signal creation, offering user choice of providers, and leveraging zero‑knowledge credentials. It argues that policy must enforce open standards and end‑to‑end risk assessment to avoid privacy, security, and competition harms.
The datasette-auth-github plugin now reaches 1.0, fixing a bug where cookies lacked a Max‑Age attribute and thus expired at session end. The fix ensures longer‑lasting sessions and the release is tested against recent Datasette versions.
Auth0 announced the early‑access Identity Conversion Suite, which adds two features—Anonymous Sessions (tracking a user before they log in via OAuth‑compatible tokens) and Experiment Center (feature‑flag‑driven A/B testing of auth flows). The post explains the intended use cases (guest checkout, secure anonymous API access, passwordless sign‑up, MFA sizing) but provides no implementation details,…
CIAM in 2026 has moved from static login checks to a continuous trust layer that must handle AI agents, deep‑fake attacks, and zero‑friction authentication, requiring a split between an identity authority and a real‑time trust orchestration layer.
Okta is ending support for Self-Service Registration, Desktop SSO (IWA), and Device Trust on its Classic Engine by March 5, 2027. Users must migrate to Okta Identity Engine to retain these capabilities and gain access to modern security features like passwordless authentication and device assurance.
