Tag: authentication
16 Groups Warn FCC’s New ‘Robocall Plan’ Is Really About Dramatically Undermining Privacy
Back in May I noted how the Trump FCC had unveiled a brand new plan to “stop robocalls.” I also noted how the plan doesn’t actually stop robocalls because a well-lobbied U.S. government (1) refuses to hold big companies accountable or collect fines, (2) constantly embraces weak rules that make telemarketers and debt collectors happy...
Malachite: ATProto OAuth CLI and did:web Support
Malachite gains OAuth-based CLI authentication for ATProto and did:web DID resolution, alongside a restructured web frontend.
e555 — One Two, One Two
Photo by Michael Martine: The Bean in Millennium Park, Chicago, IL, June 2019 Published 25 May 2026 e555 with Andy, Michael and Michael - Ploopy’s The Bean and Lenovo’s TrackPoint, The Guild, The Movie, AI in commencement speeches, AI in podcasts, Virtual Worlds and Virtual OS museums and a whole lot more! Andy, Michael and...
Adding OAuth to an MCP Server: From API Keys to Browser Login
MixCraft started with static API keys—generate one from the web portal, paste it into your Claude Code config. The mx_ prefixed keys had no expiration, lived in shell history and dotfiles, and revoking one meant generating a new key and updating every client. Service tokens from third-party APIs expired after an hour with no refresh mechanism, so users would get silent failures mid-session. I needed to replace the whole auth model with OAuth. But worse, it didn't work well with claude.ai because
Passkey PRFs and the Passkey Loss Blast Radius
Exploring the way passkey PRFs increase the blast radius of
Bereket Engida - Better-Auth
Bereket Engida walks through building better-auth, the extensible authentication library taking the JavaScript community by storm.
Better Logic For Showing Auth Windows With Your Local MCP Server
Parent WAM authentication dialogs to MCP clients like VS Code and Claude Desktop by traversing the process hierarchy to find a usable window handle.
Secure Remote MCP Servers With Entra ID And Azure API Management
Building an Entra ID-protected remote MCP server with Azure API Management as the auth gateway and Azure Functions handling the protocol implementation.
Old Security Rakes In New MCP Yards
MCP brings back classic security problems around local execution and remote authentication, and the industry seems determined to ignore lessons already learned.
The Missing Intro To Flexible Federated Identity Credentials
Set up Entra ID flexible FIC to authenticate GitHub Actions workflows against Azure resources like Key Vault without storing client secrets.
Can passkeys replace passwords
"Passkeys and the WebAuthn specification were intended to make public key cryptography accessible to average users, rather than just the domain of the tech-savvy. If done right, they could seriously improve security on the Web." @drbruced@aus.social summarises why passkeys are such a good idea in theory and explains where current implementations of the technology fall...
Deceiving Authenticator Apps On Apple And Google Devices
App Store and Play Store ads routinely surface look-alike authenticator apps above the legitimate ones. Here is how to spot and avoid them.
New Features For MSAL Python - Managed Identity and macOS Broker
Recent additions to MSAL Python - managed identity support for Azure-hosted services and a new macOS authentication broker for richer interactive sign-in flows.
The different ways to load your OpenID configuration for Angular Auth OIDC Client
How to configure the provideAuth function from the Angular Auth OIDC Client library to load your OpenID configuration synchronously or asynchronously.
Signals in Angular Auth OIDC Client
Version 18 of the angular-auth-oidc-client library adds Signal support to access the authenticated state and user data.
Simpler MSAL Logins With The Windows Auth Broker
Use the Windows Web Account Manager (WAM) broker with MSAL to delegate OAuth token acquisition to the OS and skip redirect URL plumbing in client apps.
A hacker’s perspective: social media account takeover prevention guide
"If you watched the SEC Twitter account hack that moved markets yesterday and wondered how to prevent account takeover for your personal, business, or high profile social media account, here's an Account Takeover Prevention Guide for you and/or your organization." @racheltobac@infosec.exchange neatly summarises the steps you should take to prevent the hijacking of your online accounts.
Sending Your MSAL Telemetry To Azure Application Insights
Wiring MSAL.NET 4.58.0 OpenTelemetry support to the Azure Monitor exporter so authentication metrics from production apps land in Application Insights.
Docs As Part Of The Developer Experience For MSAL
How the MSAL team approaches developer-facing documentation - making engineers core contributors, not delegating writing to a separate content org.
Restricting An Azure App Service To Specific Microsoft Accounts
Restrict an Azure App Service to a specific allow-list of Microsoft Accounts using built-in AAD authentication and a custom claims rule.
Experimenting With Managed Identity In MSAL.NET
Using MSAL.NET managed identity APIs to authenticate to Azure Key Vault from an Azure Batch job without storing credentials in environment variables.
Reading Azure Active Directory Recommendations From PowerShell
Pull Azure Active Directory tenant recommendations from PowerShell using the Microsoft Graph API, with sample code for auth and parsing the JSON output.
First Explorations of Twitter Verification API
Tracing the network calls behind Twitter's relaunched verification eligibility check, revealing the internal API the new self-service flow relies on.
It Is Time To Ditch SMS 2-Factor Verification
Why SMS-based two-factor auth is exposed to SIM swap and SS7 attacks, and what to use instead: TOTP authenticator apps and hardware security keys.
Last.fm API For A Windows Phone App - Auth
Implementing Last.fm mobile session auth from a Windows Phone 7.5 app, including the MD5-signed parameter signature required by auth.getMobileSession.
HTTP signatures
It looks like I'm not the only person who likes the idea of signed HTTP requests as an authentication method. Joyent and Digital Bazaar have co-written an Internet draft for cryptographically signed HTTP requests: Several web service providers have invented their own schemes for signing HTTP requests, but to date, none have been placed in the public domain as a standard. This document serves that purpose. There are no techniques in this proposal that are novel beyond previous art, however, thi
Goalfinger and Mozilla Persona
A few days ago, I released Goalfinger, a simple website that aims to help you decide what to do with your life. There are three stages: First, you enter at least 30 life goals. These can be as small or large as you like - anything, really, as long as they're real goals of some kind. Be happy, get fit and get a haircut all count. Once you've added enough goals, Goalfinger makes it easy to rank them, by only showing two at a time. This poses some surprisingly interesting questions: Then, final
User authentication with webapp2 on Google App Engine
Google App Engine for Python ships with the capability to manage user accounts without the need of any additional library. This functionality is, however, insufficiently documented. This post is a step-by-step tutorial addressing user registration, login, password reset and a few other details.