A vulnerability in Okta's AD/LDAP DelAuth was identified on October 30, 2024, allowing users to authenticate using only the username if it exceeds 52 characters and a cache key was previously generated. The issue was resolved the same day by switching cryptographic algorithm from bcrypt to PBKDF2.
Okta has confirmed a security vulnerability where usernames of 52 characters or more allowed account access without a password.
The FIDO Alliance's new Passkey standard aims to make password-less authentication a reality, but the real challenge lies in getting users to adopt the technology.
Aegis is a free, open source Android app that securely manages 2-step verification tokens. It supports HOTP and TOTP, is compatible with thousands of services, and offers features like screen capture prevention, biometric unlock, and automatic backups.
Learn about JSON Web Tokens (JWT) authentication, its working, components, benefits, and implementation with examples using Node.js and Express. This guide covers the process, key components, and security of JWT.
This blog post explains why JWTs (JSON Web Tokens) are not suitable for authorization despite their popularity in authentication scenarios. It discusses the proper use of JWTs for verification, the risks of misusing them for authorization, and alternative solutions.
The article discusses the JSON Web Token (JWT), a self-contained authentication token used for secure communication between server and client. JWT consists of three parts: Header, Payload, and Signature.
The header contains information about the token type and the hashing algorithm used for creating the signature. The payload contains user-specific information, such as issuer, subject, and expiration time, in a JSON object format. The signature is a key or token created by taking the header and payload and appending it with the secret key, which is then hashed using the hashing algorithm provided in the header.
The header contains information about the token type and the hashing algorithm used for creating the signature. The payload contains user-specific information, such as issuer, subject, and expiration time, in a JSON object format. The signature is a key or token created by taking the header and payload and appending it with the secret key, which is then hashed using the hashing algorithm provided in the header.
