Tag
7 articles tagged #Authentication.
P.01Unit 42 researchers found three ways local Windows malware can hijack Google Password Manager's synced passkeys, no biometric prompt or PIN required. Here's how the attacks work and what changes for anyone treating passkeys as unphishable.
P.025 billion passkeys are in active use and 75% of people have enabled one, but 57% of organizations still rely on phishable logins. Here's what the 2026 FIDO adoption data means for your roadmap.
P.03OAuth 2.1 is still an IETF draft, not a finished RFC, but most providers already enforce it. Here's what actually changed from OAuth 2.0 and a real checklist for auditing your implementation.
P.04OAuth handles authorization, OIDC adds identity on top of it, and SAML is the older enterprise SSO standard that still runs a lot of the corporate world. Here's how to pick the right one without reading three RFCs.
P.05Three real authentication options for Next.js apps, with different trade-offs on control, cost, and setup time. Here's what each one actually involves.
P.06The implicit flow is dead, and most tutorials still teach it. Here is how authorization code flow with PKCE actually works, how tokens should be stored, and where most SPA auth implementations go wrong.
P.07Passkeys are no longer an experimental feature. Apple, Google, and Microsoft all support them natively. Here's what WebAuthn actually looks like in code and when passkeys make sense for your app.