Mastodawn

@pake_preacher : I forgot the details of PAKE and SRP, but in the end the most secure client authentication requires:

1️⃣ Strong, long term, human comprehensible, *serving endpoint* authentication;
*AND*
2️⃣ TLS channel binding (enforcing known endpoints).

(Apart from those, both serving endpoint AND client MUST be trustworthy).

🚨 The -corrupt- CA/B forum breaks 1️⃣ by:
a) Advocating anonymous Domain Validated certificates, which render secure account creation IMPOSSIBLE;
b) Continuously decreasing certificate lifetime.

🚨 Furthermore, "legitimate" MitM's * break 2️⃣.

* Man in the Middle, like on-device virusscanners and firewalls that "open" TLS tunnels (both requiring installation of a dedicated root certificate) and proxies such as (definitely not limited to) Cloudflare and Fastly.

😱 Passkeys enforce NEITHER 1️⃣ NOR 2️⃣.

😱😱 Worse, because passkeys (or FIDO2 hardware keys) can be easily irretrievably "lost", servers typically provide WAY EASIER phishable authentication methods (such as "rescue codes").

@cendyne @soatok @chazh

#AitM #MitM #SecureOnlineAuthIsHARD #SecureAuthentication #OnlineAuthentication #Authentication #Impersonation #ChannelBinding #TLSchannelBinding #UTM #TLS #TLSinterception #TLSscanning #Proxy #Proxies #GoogleIsEvil #CloudflareIsEvil

TANGO EU Jun 27, 2025

📢 𝐓𝐀𝐍𝐆𝐎 𝐖𝐏4 𝐈𝐧𝐭𝐞𝐫𝐯𝐢𝐞𝐰 𝐰𝐢𝐭𝐡 𝐀𝐧𝐧𝐢 𝐊𝐚𝐫𝐢𝐧𝐬𝐚𝐥𝐨 (𝐕𝐓𝐓) 𝐍𝐨𝐰 𝐋𝐢𝐯𝐞!

The latest article in our TANGO WP Leaders Interview Series is here! Discover how SSI, Decentralized Identifiers, and Zero-Knowledge Proofs are revolutionizing identity management and privacy.

▶️ Read the full interview now: https://tango-project.eu/articles/tango-wp-leaders-interview-series-wp4-distributed-trust-management-framework

#TANGOProject #Privacy #SecureAuthentication #SSI #Innovation #WP4

Anastasis Vasileiadis May 24, 2025

🔐 Modern Password Security Threats: Protecting Your Digital Identity 🕵️‍♀️ 🛡️ 🚨

Cybercriminals use sneaky techniques to crack passwords and gain access to accounts. Here are the most common attacks:

⚒️ Brute Force – Tries every possible password
📖 Dictionary Attack – Uses common words & phrases
🌈 Rainbow Table – Cracks password hashes
👀 Shoulder Surfing – Spies on you while typing
⌨️ Keylogging – Records everything you type
🎯 Password Spraying – Tests common passwords on many accounts
🎭 Social Engineering – Tricks you into revealing passwords
🎣 Phishing – Fake emails & websites steal your login
🎟️ Credential Stuffing – Uses leaked passwords from breaches
🕵️ Man-in-the-Middle – Intercepts data over networks

🛡️ Stay Safe! Use strong, unique passwords, enable 2FA, and beware of phishing scams.

Which attack surprised you the most? Let’s discuss in the comments! ⬇️

⚠️ This content is shared strictly for educational and informational purposes only. 📚 All information is provided to help individuals and organizations better protect themselves against security threats. 🔒 The techniques discussed are presented solely to improve awareness and defensive measures, not to facilitate any unauthorized access. ✅

#PasswordSecurity #CyberSecurity #DataProtection #SecureAuthentication #IdentityProtection #InfoSec #PhishingAwareness #CyberDefense #MFA #DigitalSafety

Passlock Oct 8, 2024

In a world where data breaches are rampant, passkeys offer a resilient defense. They bind your identity to a device, making it nearly impossible for hackers to gain access. #Passkeys #SecureAuthentication

4YourData Jun 21, 2023

👤Protect your digital identity with strong authentication methods. Enable two-factor authentication, use biometric features where available, and be cautious of identity theft risks. Keep your digital self secure. #DigitalIdentity #SecureAuthentication #4YourData