A third of European companies with DMARC records lack reporting addresses, leaving their email authentication policies blind to spoofing and misconfigurations. Among those with reporting configured, most send feedback to external domains rather than their own, distributed across thousands of providers.
Device Bound Session Credentials (DBSC) is an experimental web standard implemented in ASP.NET Core that ties session cookies to a device's private key, preventing cookie replay attacks. When a stolen cookie is copied to another machine, it becomes useless for session refresh since only the original device can sign the cryptographic challenge. This significantly reduces the attack window from weeks to minutes by forcing short-lived cookies that require device-based proof to refresh.
Shodan has indexed over 47,000 exposed Ollama instances without authentication, allowing attackers to run prompts, steal models, and exploit vulnerabilities on systems including cloud GPUs.
A construction company founder describes implementing a "heartbeat" monitoring system for AI agents to detect unauthorized changes to their core identity and behavior. The system creates cryptographic fingerprints of agent prompts and verifies them before each run, and the founder is extending this approach outward as a lens for external agents to verify the company's claims and values.
Signal has launched phone number-less registration in beta for Android 8.28, addressing a long-requested feature. The $2.99 one-time fee prevents spam while protecting user privacy through zero-knowledge proofs, with accounts secured via Account ID, Account Key, and optional 2FA.
A browser-based tool that converts cookies between Netscape cookies.txt and JSON formats (Cookie-Editor, Puppeteer, key-value, or raw headers), with an additional feature to check whether Claude session cookies are still active and display account plan and usage limits.
Signal 8.28 beta introduces optional phone-number-free registration for $3 USD via in-app purchase, using zero-knowledge proofs to prevent payment-account linkage. Users receive an Account ID and Account Key for access, with optional username and two-factor authentication support via TOTP, though account recovery is impossible if credentials are lost.
Apple is launching a photo verification feature for iPhone 18 Pro that cryptographically signs sensor data to prove authenticity and prevent deepfake tampering. The system uses a secure camera mode that signs pixel data at capture, processes it through Apple's Private Cloud Compute with quantum-resistant encryption, and produces a verifiable digital certificate for the final image.
LLMjacking is a cybersecurity threat where attackers use stolen cloud credentials to gain unauthorized access to victims' paid AI model services and computing resources. The tactic has evolved from simple freeloading to building offensive attack tools, with threat actors now leveraging compromised LLMs for malicious purposes rather than just personal use. IT professionals should implement defenses like short-lived credentials, least-privilege access, usage monitoring, and strong authentication practices.
LaunchPad-Lite is a free, open-source Next.js 15 starter template featuring authentication via Better Auth, Drizzle ORM with PostgreSQL, and a pre-built dashboard with dark mode support. Built by BZDevelopments and MIT licensed, it provides a foundation for full-stack applications with no additional dependencies or costs.
AI providers face obstacles accessing fresh internet data as publishers monetize access and domains block scraper bots. Authentication requirements emerge as a solution, but raise privacy concerns similar to UK age-verification laws. Residential proxies—IP addresses from ordinary broadband users—offer a workaround to bypass VPN detection and access restrictions.
Signal has launched Signal Login, an optional registration method allowing users to create accounts without phone numbers, first on Android then iOS. The feature requires a one-time $2.99 payment to prevent spam, uses zero-knowledge proofs for privacy, and remains optional alongside traditional phone-number-based registration.