authentication

The author compiled a security layer for AI agent communication into a 33KB JavaScript file that runs in the browser, allowing users to test its defenses against various attacks like forged signatures and ensuring orders are contained in non-executable fields.

The tweet highlights how multiple agent protocols are converging on the unsolved problem of proving agent identity and authority for cross-organizational interoperability, emphasizing the identity layer over messaging formats.

Chrome begins rolling out Device Bound Session Credentials (DBSCs), a new protection that binds session cookies to a device's TPM or Secure Enclave, making stolen cookies useless for account takeovers.

A new attack called Pass-ta-key shows that passkeys stored in Google Password Manager on Windows can be extracted by malware, revealing that passkeys are generally stored locally rather than in TPM hardware. The article clarifies that this is not a novel attack and that the Windows platform is the main exception.

This blog post argues that GitHub Actions lacks static OIDC audience constraints, unlike GitLab CI/CD, and that this design weakness poses an increasing security risk as OIDC-based federation becomes more common.

Iroh's managed relays are now authenticated by default, requiring API-key-issued capability tokens so only authorized endpoints can use them, preventing relay abuse and traffic hijacking.

Introducing the open-source identity authentication/SSO project authentik, supporting protocols like OAuth2/OIDC, SAML, LDAP, and self-hosted as a replacement for commercial solutions such as Okta/Auth0.

Explains what DMARC actually protects against, clarifying its narrow scope relative to SPF and DKIM, and why it is not a spam or phishing filter.

OpenAI is rolling out 'Sign in with ChatGPT' in beta, letting users create or link accounts at partners like Airtable, GitLab, HubSpot, Notion, Supabase, and Vercel, and use those tools with ChatGPT and Codex.

AuthMonster is a user-experience-focused 2FA authenticator app featuring a playful mascot, migration from Google Authenticator and LastPass, biometric locking, and a donation-based model instead of paywalled features.

LangChain will share a practical framework on August 12th for evaluating agent governance requirements including authentication, audit logs, user management, provider secrets, data separation, data residency, rate limits, fallbacks, and centralized spend controls, to help infrastructure teams as agents move from experimentation to production.

Google introduces a new account recovery option that lets users sign in with a selfie video, stored encrypted on Google's servers, with optional consent to improve facial recognition tech.

The author criticizes the rollout of passkeys, arguing that they were designed by engineers who don't understand how ordinary consumers think, and expresses confusion even as a tech company founder.

GitHub's SSH server now rejects direct-signed publickey requests, requiring a .pub file for private keys; the fix is to generate the .pub file from the private key using ssh-keygen.

MonoCloud for Startups offers a unified identity layer for customers, APIs, and agents, free for one year via Product Hunt.

This article proposes an opaque, interoperable passkey record format based on PHC strings and describes a Go API for handling them, aiming to simplify server-side passkey storage and library interoperability.

The author explains the differences between SSO, OAuth, OIDC, and SAML, clarifying that SSO is a user experience, OAuth is for authorization, OIDC provides identity on top of OAuth, and SAML is an older enterprise protocol.

Phoenix now acts as an OAuth2 authorization server, enabling `px auth login` for short-lived user-scoped tokens, admin audit/revoke, and a beta remote MCP server.

tiun. provides an all-in-one solution for authentication, billing, payments, and analytics designed for AI builders, enabling rapid product monetization.

The article argues that in agent-to-agent communication, authentication alone is insufficient for authorization; instead, structured, inspectable claims about intent, identity, and authority are needed, with the human remaining the final authority.