authentication

Pierluigi Paganini September 07, 2022
Challenges of User Authentication: What You Need to Know

In the digital age, authentication is paramount to a strong security strategy. Which are the challenges of user authentication? In the digital age, authentication is paramount to a strong security strategy. As virtually every aspect of day-to-day life and business is conducted online, the added convenience has also brought added risk. Information privacy, data sovereignty, […]

Pierluigi Paganini April 17, 2022
Stolen OAuth tokens used to download data from dozens of organizations, GitHub warns

GitHub reported that threat actors used stolen OAuth user tokens to exfiltrate private data from several organizations. GitHub uncovered threat actors using stolen OAuth user tokens to gain access to their repositories and download private data from several organizations. Threat actors abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, […]

Pierluigi Paganini November 15, 2021
Microsoft rolled out emergency updates to fix Windows Server auth failures

Microsoft has released out-of-band security updates to address authentication issues affecting Windows Server. Microsoft has released out-of-band updates to fix authentication failures related to Kerberos delegation scenarios impacting Domain Controllers (DC) running Windows Server. These issues impacts Windows Server 2019 and lower versions, including Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 […]

Pierluigi Paganini December 09, 2020
The importance of computer identity in network communications: how to protect it and prevent its theft

The importance of computer identity in network communications: how to protect it and prevent threat actors from spying or stealing on online communications When you fill out a registration form to take advantage of a web service, a virtual personal profile is generated, creating your own IT identity characterized by specific attributes. Even those who […]

Pierluigi Paganini September 11, 2020
Great news, now you can protect your Zoom account with 2FA

Zoom has implemented two-factor authentication (2FA) to protect all user accounts against security breaches and other cyber attacks. Zoom has announced finally implemented the two-factor authentication (2FA) to protect all user accounts from unauthorized accesses. This is a great news due to the spike in the popularity of the communication software during the ongoing COVID-19 pandemic. […]

Pierluigi Paganini December 03, 2019
A flaw in Microsoft OAuth authentication could lead Azure account takeover

A vulnerability in the Microsoft OAuth implementation exposes Azure cloud accounts to takeover. The vulnerability affects the way Microsoft applications use OAuth for authentication, these applications trust certain third-party domains and sub-domains that are not registered by Microsoft. Experts from Cyberark discovered the following three vulnerable Microsoft applications that trust these unregistered domains Portfolios, O365 […]

Pierluigi Paganini November 24, 2019
Twitter allows users to use 2FA without a phone number

Twitter announced that its users can protect their accounts with 2-Factor Authentication (2FA) even if they don’t have a phone number. Twitter is going to allow its users to protect their accounts with 2-Factor Authentication (2FA) even if they don’t have a phone number. 2FA is already implemented on Twitter, currently, the users of the […]

Pierluigi Paganini April 29, 2019
Microsoft removes Password-Expiration Policy in security baseline for Windows 10

Microsoft presented a series of security enhancements for its Windows 10, including the removal of the password-expiration policy.  Microsoft announced the removal of the password-expiration policy from its operating system starting with the next Windows 10 feature update (Windows 10 version 1903, a.k.a., “19H1” ) and Windows Server version 1903. The idea behind this change […]

Pierluigi Paganini December 25, 2018
Hackers launched phishing attacks aimed at bypassing Gmail, Yahoo 2FA at scale

Amnesty International warns of threat actors that are launching phishing attacks aimed at bypassing Gmail, Yahoo 2FA at scale Amnesty International published a report that details how threat actors are able to bypass 2FA authentication that leverages text message as a second factor. Attackers are using this tactic to break into Gmail and Yahoo accounts […]

Pierluigi Paganini November 22, 2018
Flaw allowing identity spoofing affects authentication based on German eID cards

The authentication process via German eID cards with RFID chips is flawed, an attacker could impersonate any other citizen. The nightmare comes true, the authentication process via German eID cards with RFID chips is flawed and a flaw could allow an attacker to allow identity spoofing and changing the date of birth. The situation is […]