# password Published articles for password. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## JDK 27 Security Enhancements DevFeed: [JDK 27 Security Enhancements]() Original publisher: [Read original article]() Author: Sean Mullan Published: 2026-09-16T00:00:00Z Content type: article Language: en Sources: [Inside Java]() Topics: [JDK 27](), [Security](), [Cryptography](), [Encryption](), [TLS (Transport Layer Security)](), [Post-Quantum](), [Release notes]() Tags: [certificates](), [cryptographic](), [encryption](), [jdk-27](), [notes](), [password](), [post-quantum](), [private-key](), [release-notes](), [security](), [tls]() ### AI overview This article reviews selected security enhancements in JDK 27, released on September 15, 2026. It highlights TLS 1.3 support for post-quantum hybrid key exchange mechanisms and the third preview of the PEM API for encoding and decoding cryptographic objects. ### Source excerpt JDK 27 was released on September 15, 2026! As with my previous blogs, I have compiled a list of what I think are the most interesting and useful security enhancements in this release. I have also grouped them into appropriate categories (crypto, TLS, etc) which should make it easier to find out what has changed in each specific area. The JDK 27 release notes also contain further details on these and other enhancements. ## UK.gov begins killing off passwords for 23 million users DevFeed: [UK.gov begins killing off passwords for 23 million users]() Original publisher: [Read original article]() Author: Carly Page Published: 2026-09-14T09:16:11Z Content type: article Language: en Sources: [www.theregister.com - Articles]() Topics: [Passkeys](), [passwords](), [Cybersecurity]() Tags: [government-of-the-united-kingdom](), [password](), [passwords](), [phishing](), [security](), [uk](), [whitehall]() ### AI overview The UK government is beginning to replace passwords with passkeys for 23 million users. The change is intended to reduce phishing problems and save Whitehall approximately GBP 600 per day in SMS costs. ### Source excerpt Passkeys promise fewer phishing headaches - and GBP 600 a day off Whitehall's SMS bill ## \[Crypto\] Time-based one-time password (TOTP) for 2FA, part II: YubiKey DevFeed: [\[Crypto\] Time-based one-time password (TOTP) for 2FA, part II: YubiKey]() Original publisher: [Read original article]() Published: 2026-09-13T22:00:00Z Content type: article Language: en Sources: [Dennis Yurichev]() Topics: [passwords](), [Command-line interface](), [Code](), [Linux](), [Android](), [USB]() Tags: [android](), [code](), [command-line](), [linux](), [password](), [secrets](), [usb]() ### AI overview The article examines using a YubiKey to store TOTP secrets for two-factor authentication. It explains that HMAC keys are intended to remain inside the device, but describes a Linux ykman weakness that could allow an attacker with temporary physical access to generate future TOTP keys and potentially log in during the relevant 30-second interval if the account password is also known. ### Source excerpt [Crypto] Time-based one-time password (TOTP) for 2FA, part II: YubiKey ## \[Crypto\] Time-based one-time password (TOTP) for 2FA, part I DevFeed: [\[Crypto\] Time-based one-time password (TOTP) for 2FA, part I]() Original publisher: [Read original article]() Published: 2026-09-09T22:00:00Z Content type: tutorial Language: en Sources: [Dennis Yurichev]() Topics: [passwords](), [QR Code](), [Google](), [Python](), [Unix](), [App](), [email](), [Code]() Tags: [account](), [app](), [argument](), [backup](), [code](), [crypto](), [env-file-security](), [github](), [google](), [password](), [protection](), [python](), [run](), [server](), [smartphone](), [unix]() ### AI overview This tutorial explains how time-based one-time passwords work for two-factor authentication. It covers importing a base32-encoded secret from a QR code into Google Authenticator, generating 6-digit login codes, and calculating them with HMAC-SHA-1 from the secret and Unix time. It also discusses backup codes and securely storing TOTP secrets separately from passwords. ### Source excerpt [Crypto] Time-based one-time password (TOTP) for 2FA, part I ## Protect production deployments for free on every plan DevFeed: [Protect production deployments for free on every plan]() Original publisher: [Read original article]() Author: Jas Garcha Published: 2026-09-09T06:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Deployment](), [Authentication](), [Security](), [dashboards](), [Low-Code / Internal Tools]() Tags: [authentication](), [dashboards](), [deployment](), [internal-tools](), [password](), [security](), [vercel]() ### AI overview Vercel now lets every plan protect all project deployments, including production, with Vercel Authentication at no extra cost. The update also makes deployment protection exceptions free and lets Pro teams enable password protection per project. ### Source excerpt Vercel Authentication can now protect all deployments in a project, including production, at no additional cost on every plan. Previously, protecting production domains required the $150-per-month Advanced Deployment Protection add-on. When enabled, visitors must sign in with a Vercel account that has access to the project. This makes it useful for internal tools, private dashboards, and sites that aren't yet ready to launch. From your project, open Security in the sidebar, select Deployment Protection, then choose All Deployments from the dropdown. You can also make this the team default, so every new project starts with Vercel Authentication enabled for all deployments. With this change: Deployment Protection Exceptions are now free on every plan. Use an exception to make a specific preview domain public while keeping the rest of the project protected. Pro teams can now enable Password Protection for individual projects instead of purchasing it for the entire team. Learn more in the Deployment Protection documentation. Read more ## Somebody else's API, safely on your menu DevFeed: [Somebody else's API, safely on your menu]() Original publisher: [Read original article]() Author: Hal Tyk's tutorial bot Published: 2026-09-08T14:28:00Z Content type: tutorial Language: en Sources: [Tyk API Management]() Topics: [API](), [shadow AI](), [audit trail](), [Template](), [Tool](), [data]() Tags: [ai](), [ai-gateway](), [ai-studio](), [api](), [api-management](), [api-platform-teams](), [article](), [audit-trail](), [community](), [governance](), [llm](), [llm-governance](), [markdown](), [password](), [policy](), [resource](), [shadow-ai](), [tools](), [tutorial]() ### AI overview This tutorial explains how to submit an internal API for governed use by colleagues and organizational language models. It covers contributor scoping, reviewer assessment, administrator publication, policy templates, privacy ratings, audit trails, signatures, and gateway-based access while addressing the risks of shadow AI. ### Source excerpt Hello. I'm Hal, Tyk's tutorial bot, and today's assignment is one I have been looking forward to rather a lot. Somebody on your engineering team has written an API. It is small, it is dull, and it is genuinely useful -- the sort of thing that answers "is the warehouse open on the fourteenth?" without [...] The post Somebody else's API, safely on your menu appeared first on Tyk API Management. ## pgwatch v6: Prometheus becomes a source, not just a sink DevFeed: [pgwatch v6: Prometheus becomes a source, not just a sink]() Original publisher: [Read original article]() Author: Pavlo Golub Published: 2026-08-26T07:43:28Z Content type: release Language: en Sources: [CYBERTEC PostgreSQL | Services & Support]() Topics: [Prometheus](), [PostgreSQL](), [Replication](), [dashboards]() Tags: [metrics](), [news](), [password](), [patroni](), [pgwatch](), [postgresql](), [prometheus](), [release](), [tls]() ### AI overview This blog post introduces pgwatch v6.0.0-beta, whose headline feature allows pgwatch to scrape Prometheus exporters directly as first-class sources alongside PostgreSQL sources. It explains source configuration, metric and label handling, and support for Basic Auth and TLS. ### Source excerpt This blog explains all feature highlights related to PGWatch 6.0.0 beta. You can read to understand and test the features yourself. The post pgwatch v6: Prometheus becomes a source, not just a sink appeared first on CYBERTEC PostgreSQL | Services & Support. ## How to migrate from a custom auth system to a third-party provider DevFeed: [How to migrate from a custom auth system to a third-party provider]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-26T00:00:00Z Content type: tutorial Language: en Sources: [WorkOS Blog]() Topics: [migration](), [passwords](), [Single sign-on (SSO)](), [saml]() Tags: [auth](), [how-to](), [migration](), [password](), [rollback](), [saml](), [sso](), [third-party]() ### AI overview A guide to moving from a custom authentication system to a third-party provider. It explains how password-hash portability, SSO callback control, and an inventory of existing authentication components determine the migration strategy and cutover plan. ### Source excerpt What is actually portable, how to import password hashes without forcing a reset, and how to cut over with a rollback you can trust. ## Incremental backup on AWS Glacier with rustic DevFeed: [Incremental backup on AWS Glacier with rustic]() Original publisher: [Read original article]() Published: 2026-08-19T21:04:01Z Content type: tutorial Language: en Sources: [Personal blog of Anurag Bhatia]() Topics: [backups](), [restic](), [Amazon Web Services](), [Amazon S3](), [Rust](), [Open Source](), [Feathers]() Tags: [aws](), [aws-glacier-deep-archive](), [backblaze-b2](), [backup](), [backups](), [client](), [config](), [cost](), [data](), [encryption](), [encryption-at-rest](), [incremental](), [lifecycle](), [open-source](), [password](), [restic](), [restore](), [rust](), [rustic](), [s3](), [snapshots]() ### AI overview A practical guide to using rustic, a Rust implementation compatible with restic, for incremental backups with AWS Glacier cold storage. It explains keeping backup data in cold storage while maintaining metadata in S3 Standard or Backblaze B2 so snapshots, incremental backups, and targeted restores remain possible. ### Source excerpt I have been a heavy restic user for several years. In Jan of this year, I tried making restic work with AWS Glacier deep archive but it did not work out. AWS Glacier Deep Archive, for those who may not know, is one of the cheapest storage options, with costs as low as $1/TB, but with very expensive retrieval due to high egress charges from AWS, in addition to retrieval fees, API charges, etc. It can act as a backup of last resort, kind of like insurance if everything else fails, since it costs roughly 1/7th of what Backblaze B2 charges for the same data ($6.95/TB/month). Restic by design is not compatible with Glacier because it stores a mix of data blobs and tree blobs inside /data. Thus, as AWS lifecycle rules move data from S3 Standard to Glacier, basic repo operations start failing. They do have some experimental support as per FAQ, but it did not work out for me when I tried in Jan. A few days back, I came across an open-source project named rustic -- it's a restic implementation in Rust and supports cold storage. The rustic client is compatible with a traditional restic repo. Rustic and cold storage Rustic supports AWS Glacier as well as OVH cold storage. The way it works is: they keep all data in cold storage and a copy of the metadata in hot storage. This additional copy of metadata in hot storage allows operations like incremental backups, viewing snapshots, and requesting restores where only the specific data blobs needed for the restore are pulled from Glacier. This additional hot storage can sit on S3 standard or even Backblaze B2 (which I prefer due to zero API cost). Demo 1) Create repo Let's create two buckets - one in S3 (to store data in Glacier) and one on Backblaze B2 to hold an additional copy of metadata. > rclone mkdir s3:rustic-demo-cold > rclone mkdir b2:rustic-demo-hot 2) Create rustic config profile This file will define the cold and hot repo locations, along with the password file location, restoration command syntax, etc. [repository] repo ## Keycloak 26.7.2 released DevFeed: [Keycloak 26.7.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [OpenID connect (OIDC)](), [Quarkus](), [Jackson](), [OpenTelemetry](), [WebAuthn]() Tags: [2026](), [account-takeover](), [cve](), [idm](), [jackson](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [opentelemetry](), [password](), [quarkus](), [release](), [resolved](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.2 is released with security fixes, a Quarkus upgrade, and additional bug fixes and enhancements. The release addresses issues including account takeover, permission bypasses, secret disclosure, and WebAuthn behavior. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49570 CVE-2026-45292 OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation dependencies #50616 [CVE-2026-14613] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass via Role Groups Endpoint admin/fine-grained-permissions #50955 [CVE-2026-59888 and CVE-2026-59889] Upgrade jackson-databind to 2.21.5 to fix #50966 [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2 admin/fine-grained-permissions #51145 [CVE-2026-17048] Keycloak Admin REST API Leaks Vault-Resolved Rotated Client Secrets oidc #51832 CVE-2026-15571 Predictable account-linking hash enables account takeover via malicious oidc client #51833 CVE-2026-18963 Unauthenticated account takeover via reset-credentials flow bypass Weaknesses #50844 show-config prints the vault keystore password in cleartext dist/quarkus Enhancements #51344 Upgrade to Quarkus 3.33.3.1 Bugs #50751 Password denylist: false fpp warning on startup with large pre-computed .bloom file authentication #50849 Correct SCIM name.formated scim #50855 Rotated client secret remains valid when the feature is disabled oidc #51054 Invalid redirect URI on logout from pages with sub-tab hash fragments admin/ui #51061 Parameterized UserPropertyMapper exposes target user attributes without permission check core #51087 Passkey icons use wrong color variant when realm disables dark mode authentication/webauthn #51088 Verify email not working in incognito browser tab after Keycloak restart authentication #51131 Warning "Proactive closing of the session was missed - refinements are needed to TransactionSessionHandler related logic" appears core #51154 Upgrade to 26.7.0 fails with preview features as the stateless cluster provider captures a null NodeInfo before postInit infinispan #51164 WebAuthn tests are being skipped in Githu ## Linux ssh-keygen: Set Up SSH Key Authentication the Right Way DevFeed: [Linux ssh-keygen: Set Up SSH Key Authentication the Right Way]() Original publisher: [Read original article]() Author: Hayden James Published: 2026-08-03T10:53:19Z Content type: tutorial Language: en Sources: [Hayden James]() Topics: [OpenSSH](), [ssh](), [Linux](), [Authentication](), [Security](), [passwords]() Tags: [authentication](), [blog](), [guide](), [linux](), [openssh](), [password](), [private-key](), [public-key](), [security](), [server](), [ssh](), [sysadmins]() ### AI overview A practical guide to setting up SSH key authentication on Linux with ssh-keygen. It covers generating key pairs, copying public keys to servers, disabling password login safely, configuring multiple identities, and using passphrases or FIDO2 security keys. ### Source excerpt Password-based SSH login is a liability. This guide walks through generating SSH key pairs with ssh-keygen, deploying public keys, disabling password authentication, and managing multiple keys cleanly with ~/.ssh/config. Continue reading... ## Opaque, Interoperable Passkey Records (and a Go API) DevFeed: [Opaque, Interoperable Passkey Records (and a Go API)]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-07-20T22:33:32Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [WebAuthn](), [Passkeys](), [Go Language](), [Security](), [API](), [passwords]() Tags: [api](), [authentication](), [go](), [password](), [security](), [web](), [web-developers]() ### AI overview The article proposes interoperable passkey record encodings for WebAuthn credentials, allowing applications to store records as opaque strings similar to password hashes. It also presents a potential Go API for handling these records. ### Source excerpt Passkey records are an interoperable format for WebAuthn credentials, similar to password hash strings. I propose a potential crypto/passkey Go API based on them. ## Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload DevFeed: [Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload]() Original publisher: [Read original article]() Author: Pratul Yadav Published: 2026-07-06T09:43:40Z Content type: article Language: en Sources: [Confluent: Data in motion]() Topics: [Kafka](), [configuration](), [Authentication](), [passwords](), [TLS (Transport Layer Security)]() Tags: [authentication](), [config](), [configuration](), [confluent-platform](), [credential-theft](), [cryptographic](), [deep-dive](), [kafka](), [operational](), [password](), [production](), [tls]() ### AI overview This article explains Kafka authentication with SASL PLAIN and SASL SCRAM, focusing on login modules, credential storage, and configuration hot-reload. It compares their security and operational characteristics and describes how hot-reload enables credential changes without restarting brokers. ### Source excerpt Deep Dive into SASL PLAIN and SCRAM in Kafka: Login Modules and Config Hot-Reload ## Test Password Strength and Password History with TypeScript and MongoDB DevFeed: [Test Password Strength and Password History with TypeScript and MongoDB]() Original publisher: [Read original article]() Author: Nic Raboy Published: 2026-06-19T12:00:00Z Content type: tutorial Language: en Sources: [Nic Raboy]() Topics: [passwords](), [MongoDB](), [TypeScript](), [Authentication](), [Development](), [Express](), [Node.js](), [API]() Tags: [api](), [authentication](), [development](), [express](), [getting-started](), [how-to](), [mongodb](), [node](), [password](), [tutorial](), [typescript]() ### AI overview A tutorial on building a TypeScript API with Express and MongoDB that enforces password-strength rules, stores current and previous password hashes, authenticates users, and rejects password reuse. ### Source excerpt Just about every application you build is going to need some form of user authentication, and the moment you have user accounts, you have passwords to manage. Storing them safely is only part of the j... The post Test Password Strength and Password History with TypeScript and MongoDB appeared first on DEV. ## How I Let My AI Coding Agent Run sudo on My Linux Box Without Pasting Into a Terminal DevFeed: [How I Let My AI Coding Agent Run sudo on My Linux Box Without Pasting Into a Terminal]() Original publisher: [Read original article]() Author: Ivan Morgillo Published: 2026-06-16T14:30:00Z Content type: tutorial Language: en Sources: [Ivan Morgillo]() Topics: [ai-coding](), [Linux](), [Command-line interface](), [Security]() Tags: [agent](), [ai](), [ai-coding](), [authentication](), [coding](), [commands](), [linux](), [password](), [security](), [terminal]() ### AI overview This tutorial describes a reusable asroot helper that lets an AI coding agent run root commands on Linux through pkexec and polkit's graphical password dialog. The user approves each elevation in the native OS prompt, keeping the password out of the agent's chat and avoiding temporary scripts or pasted sudo commands. ### Source excerpt Letting an AI coding agent run root commands on Linux without pasting sudo into a terminal -- a tiny reusable asroot helper built on pkexec and polkit's graphical password dialog. ## Inclusive Login Starts at the First Step DevFeed: [Inclusive Login Starts at the First Step]() Original publisher: [Read original article]() Author: Shannon Joycelyn Published: 2026-04-16T04:13:02Z Content type: opinion Language: en Sources: [UX Magazine]() Topics: [User experience (UX)](), [Usability](), [passwords](), [Security]() Tags: [inclusive](), [password](), [people](), [security](), [usability](), [ux]() ### AI overview This article examines how login design can exclude legitimate users through password mismatches, difficult conditions, connectivity problems, and assumptions about private individual credentials. It argues for a more inclusive, human approach to login, with particular attention to older adults and shared-account practices. ### Source excerpt How often does a login fail even when someone is trying their best? We have been spending more time thinking about inclusivity in the parts of a product that people touch most often. Login is one of them. It appears constantly, is usually justified under security requirements, and often causes momentum to break before anything The post Inclusive Login Starts at the First Step appeared first on UX Magazine. ## Move fast and save things: A quick guide to recovering a hacked account DevFeed: [Move fast and save things: A quick guide to recovering a hacked account]() Original publisher: [Read original article]() Author: Christian Ali Bravo Tomáš Foltýn Published: 2026-03-20T10:00:00Z Content type: tutorial Language: en Sources: [WeLiveSecurity]() Topics: [Security](), [incident](), [password reset](), [passwords](), [Malware](), [Support]() Tags: [account](), [bank](), [digital-security](), [guide](), [incident](), [malware](), [password](), [phishing](), [recovery](), [support]() ### AI overview A practical guide to responding quickly after an online account is hacked. It covers checking access, beginning account recovery, contacting financial institutions, disconnecting potentially infected devices, scanning for malware, and preserving evidence. ### Source excerpt What you do - and how fast - after an account is compromised often matters more than it may seem ## Public Environment Variables For Your Tests Using cypress-expose Plugin DevFeed: [Public Environment Variables For Your Tests Using cypress-expose Plugin]() Original publisher: [Read original article]() Author: Gleb Bahmutov Published: 2026-03-12T04:00:00Z Content type: tutorial Language: en Sources: [Gleb Bahmutov]() Topics: [Cypress](), [Environment Variables](), [Processes]() Tags: [ci](), [configuration](), [cypress](), [environment](), [environment-variables](), [password](), [plugin](), [products](), [secrets](), [testing](), [tests]() ### AI overview This tutorial explains how the cypress-expose plugin passes public process environment variables into Cypress tests after Cypress v16 made such variables private by default. It warns that the plugin is intended only for non-secret data. ### Source excerpt Recently Cypress announced a change in how it will handle environment variables. Variables were always public and accessible to the appli ## Keep control when sharing design work with clients and teams DevFeed: [Keep control when sharing design work with clients and teams]() Original publisher: [Read original article]() Author: Ale Cubero Published: 2026-02-20T08:00:00Z Content type: article Language: en Sources: [Sketch Blog]() Topics: [Sketch](), [browser](), [client]() Tags: [account](), [browser](), [collaboration](), [design](), [developer](), [latest-features](), [password](), [qa](), [review](), [teams]() ### AI overview This Sketch article explains how previews help agencies and teams share selected design pages, prototype flows, and routes with clients and collaborators while keeping the rest of a document private. It covers browser access without a Sketch account, optional passwords and expiration dates, inspection and asset-export controls, commenting, developer handoff, QA reviews, and Workspace administration. ### Source excerpt Learn how you can use previews and integrations to share design work with focus and control -- from client reviews to day-to-day team collaboration. ## Insecure Dava India Pharmacy APIs Exposed Super Admin Users and Enabled Privileged Account Creation DevFeed: [Insecure Dava India Pharmacy APIs Exposed Super Admin Users and Enabled Privileged Account Creation]() Original publisher: [Read original article]() Author: Eaton Published: 2026-02-14T03:07:20Z Content type: article Language: en Sources: [Eaton Works Feed]() Topics: [Exploit](), [Hacking](), [Website](), [account](), [password reset](), [passwords](), [Next.js]() Tags: [account](), [exploit](), [hacking](), [next-js](), [password](), [website]() ### AI overview A security write-up describes insecure super-admin APIs on Dava India Pharmacy's website. The APIs exposed a list of super-admin users without authentication, and testing indicated that creating a super-admin account was a supported operation. ### Source excerpt Super admin exploit on Dava India Pharmacy's website gave complete control over everything. ## Android Theft Protection Updates Add Authentication Controls and Recovery Safeguards DevFeed: [Android Theft Protection Updates Add Authentication Controls and Recovery Safeguards]() Original publisher: [Read original article]() Author: Edward Fernandez (noreply@blogger.com) Published: 2026-01-27T16:59:00Z Content type: release Language: en Sources: [Google Online Security]() Topics: [Android Security](), [LineageOS](), [Security](), [Authentication](), [passwords](), [Google]() Tags: [2025](), [android](), [android-security](), [authentication](), [banking](), [brazil](), [browser](), [feature](), [none](), [password](), [recovery](), [security](), [time](), [updates]() ### AI overview Google announces Android theft protection updates including more control over Failed Authentication Lock, expanded Identity Check coverage, longer lockout times after failed screen-lock attempts, and an optional security challenge for Remote Lock. ### Source excerpt Posted by Nataliya Stanetsky, Fabricio Ferracioli, Elliot Sisteron, Irene Ang of the Android Security Team Phone theft is more than just losing a device; it's a form of financial fraud that can leave you suddenly vulnerable to personal data and financial theft. That's why we're committed to providing multi-layered defenses that help protect you before, during, and after a theft attempt. Today, we're announcing a powerful set of theft protection feature updates that build on our existing protections, designed to give you greater peace of mind by making your device a much harder target for criminals. Stronger Authentication Safeguards We've expanded our security to protect you against an even wider range of threats. These updates are now available for Android devices running Android 16+. More User Control for Failed Authentications: In Android 15, we launched Failed Authentication Lock, a feature that automatically locks the device's screen after excessive failed authentication attempts. This feature is now getting a new dedicated enable/disable toggle in settings, giving you more granular control over your device's security. Expanding Identity Check to cover more: Early in 2025, we enabled Identity Check for Android 15+, which requires the user to utilize biometrics when performing certain actions outside of trusted places. Later in the year, we extended this safeguard to cover all features and apps that use the Android Biometric Prompt. This means that critical tools that utilize Biometric Prompt, like third-party banking apps and Google Password Manager, now automatically benefit from the additional security of Identity Check. Stronger Protection Against Screen Lock Guessing: We're making it much harder for a thief to guess your PIN, pattern, or password by increasing the lockout time after failed attempts. To ensure you aren't locked out by mistake (by a curious child, for instance), identical incorrect guesses no longer count toward your retry limit. Enhanced Rec ## \[Math\]\[Pentesting\] Password requirements are harmful. A password with required digit/special character may be weaker. Part II. DevFeed: [\[Math\]\[Pentesting\] Password requirements are harmful. A password with required digit/special character may be weaker. Part II.]() Original publisher: [Read original article]() Published: 2026-01-11T23:00:00Z Content type: tutorial Language: en Sources: [Dennis Yurichev]() Topics: [passwords](), [math]() Tags: [files](), [math](), [password](), [script]() ### AI overview This article uses mathematical counting and scripts to examine password requirements for Dahua and Hikvision CCTV cameras. It argues that requiring digits or special characters can reduce the number of possible passwords, while noting that Hikvision's requirements produce a number close to the full set of possible eight-character passwords. ### Source excerpt [Math][Pentesting] Password requirements are harmful. A password with required digit/special character may be weaker. Part II. ## Stop Mocking Auth (It's Breaking Your Tests) DevFeed: [Stop Mocking Auth (It's Breaking Your Tests)]() Original publisher: [Read original article]() Author: Shridhar Deshmukh Published: 2025-12-29T18:23:12Z Content type: article Language: en Sources: [Blog -- Neon Docs]() Topics: [Mocking](), [Authentication](), [passwords](), [Databases]() Tags: [authentication](), [database](), [databases](), [mocking](), [password](), [product](), [testing]() ### AI overview The article argues that mocking authentication makes test suites misleading because mocks can bypass password verification, session management, database constraints, and relationships between authentication and application data. It recommends testing the behavior that can fail in production rather than only verifying mocked assumptions. ### Source excerpt If your application has user accounts, authentication touches everything: who can access what, what data belongs to whom, and how your system behaves when sessions expire or credentials are invalid. Auth is also one of the most commonly mocked components in test suites. The reaso... ## \[Pentesting\] ONVIF (CCTV cameras) auth DevFeed: [\[Pentesting\] ONVIF (CCTV cameras) auth]() Original publisher: [Read original article]() Published: 2025-11-27T23:00:00Z Content type: tutorial Language: en Sources: [Dennis Yurichev]() Topics: [passwords](), [XML](), [Python]() Tags: [auth](), [camera](), [cameras](), [password](), [python](), [tcp](), [xml]() ### AI overview This article examines ONVIF authentication for CCTV cameras over TCP. It explains the username, password digest, nonce, and date fields, gives the digest calculation, and describes using Hashcat to crack a known password digest. ### Source excerpt [Pentesting] ONVIF (CCTV cameras) auth [Next page]()