In a previous blog post, we explored the technical side of passkeys (also known as discoverable credentials or resident keys), what they are, how they work, and why they’re a strong alternative to passwords. If you’re a curious techie, check that out first.| blog.compass-security.com
As CEO of HYPR, I spend a lot of time thinking about the future of identity security. And right now, one of the most significant shifts we're witnessing is driven by the rapid advancement of Artificial Intelligence. While AI offers incredible potential, it also presents formidable challenges, particularly in the realm of identity verification. The uncomfortable truth is that the era of relying solely on scanning a driver's license or passport to prove someone is who they claim to be is rapidl...| HYPR Blog
Why the Troy Hunt Phishing Attack is a Wake-Up Call for MFA Inadequacy| blog.hypr.com
Unlock Seamless Security: Combining Physical and Digital Access with HYPR and IDEMIA Your organization spans a physical and a virtual environment, but how well aligned are your strategies for securing both? With the rise of hybrid work models, the challenge of securing sensitive information against increasingly sophisticated online and in-person threats has become more critical than ever. In a groundbreaking move to address these challenges, HYPR and IDEMIA have joined forces. This powerful p...| HYPR Blog
The 2025 State of Passwordless Identity Assurance Report revolves around the Identity Renaissance: the exploration of business success when it’s unburdened by security vulnerabilities and inefficiencies.| blog.hypr.com
SMS-based, two-factor authentication (2FA) has long been a staple security measure for many online services, including Gmail. However, as the tech industry shifts towards more secure authentication methods, it has become evident that SMS codes are no longer the ideal solution. In a recent reveal, a Gmail spokesperson has confirmed that Google is planning to phase out SMS codes for authentication, marking a significant change for billions of users worldwide.| HYPR Blog
My talk from NDC Oslo 2020. Learn how current user authentication isn't good enough and how you can solve the password problem with FIDO2 and WebAuthn.| Scott Brady - scottbrady.io
Physical biometrics, such as fingerprint or facial recognition, are super useful when logging into mobile apps. So why can't you use biometrics in the browser?| Scott Brady - scottbrady.io
My experience with OpenSK, an open-source FIDO2 authenticator implementation, using a VirtualBox VM and FIDO2 for ASP.NET.| Scott Brady
Learn how Evilginx can phish common multi-factor authentication implementations, and how you can defeat it using FIDO2.| Scott Brady - scottbrady.io
Getting to grips with FIDO2 and WebAuthn, including a basic implementation in ASP.NET Core| Scott Brady
Attackers continually refine their methods to compromise user identities and gain unauthorized access to sensitive systems. One particularly insidious threat is Evilginx, a phishing framework designed to bypass traditional multi-factor authentication (MFA) by operating as an adversary-in-the-middle (AitM) — sometimes known as man-in-the-middle (MitM) — proxy. Evilginx intercepts and manipulates communication between users and legitimate sites, enabling attackers to steal credentials, sess...| HYPR Blog
Today Yubico announced the general availability of its YubiKey Bio - Multi-protocol Edition, which supports biometric authentication for FIDO and Smart Card/PIV protocols. Like other YubiKey Bio Series, the new multi-protocol keys incorporate a fingerprint sensor, enabling secure, convenient biometric and PIN-based passwordless login across devices and platforms. The multi-protocol keys, however, offer additional flexibility for enterprises, especially when combined with the HYPR platform.| HYPR Blog
Financial services are one of the most targeted industries in the world for cyberattacks, suffering nearly 20% of all attacks in 2023. This is understandable considering the high-value outcomes of successful attacks and the fact that, despite supposed security improvements, attacks are still relatively successful, with 84% of finance organizations hit by a cyberattack going on to experience at least one breach.| HYPR Blog
Yesterday at the Black Hat conference, Microsoft announced the public preview of Entra FIDO2 provisioning APIs. HYPR worked closely with Microsoft on these critical enhancements, which make it easier for Entra customers to provision passkeys for their users. Like the EAM integration unveiled a few months ago, collaborative development of such features is essential to fuel adoption of secure, phishing-resistant authentication methods. We are honored that Microsoft named HYPR as a fully-tested ...| HYPR Blog
Identity verification has traditionally played an important but limited role in the world of identity and access management (IAM). To establish someone’s identity, you need to prove that they are who they say they are, linking their digital identity to their real-world identity. For employees, this verification typically occurs during onboarding; for customers, it happens when they open a new account. Once validated, they receive credentials, are granted appropriate authorizations, and en...| HYPR Blog
Virtual private networks (VPNs) form a staple of the modern work environment. VPNs provide an essential layer of protection for employees working remotely or across multiple office locations, encrypting data traffic to stop hackers from intercepting and stealing information. Usage of VPNs skyrocketed in the wake of the COVID-19 pandemic and remains high — 77% of employees use VPN for their work nearly every day, according to the 2023 VPN Risk Report by Zscaler.| HYPR Blog
Many strictly regulated industries such as banking and finance rely heavily on identity and access management solutions to secure their systems and infrastructure. Unfortunately, as demonstrated by the Okta security breach last year, these organizations are attractive targets for hackers due to the nature and quantity of the information they handle. While hackers use sophisticated ransomware once access is gained, they obtain that access through surprisingly low-tech means: for example, by ca...| HYPR Blog
The National Security Agency (NSA), in conjunction with the Cybersecurity and Infrastructure Security Agency (CISA), recently released its “Top Ten Cloud Security Mitigation Strategies” for organizations to make their cloud environments more secure. The report contains a Cybersecurity Information Sheet (CSI) for each strategy, which includes MITRE ATT&CK and D3FEND mappings and cloud-specific mitigation guidance.| HYPR Blog
When it comes to cyberattacks, March has come in like a lion for Microsoft. Last week, Microsoft said in an SEC filing that that information stolen in a hack of senior leaders’ email accounts is now being used to “gain or attempt to gain access” to company source code repositories and other internal systems. The fallout remains unknown. Just a few days earlier, threat researchers at Proofpoint reported a phishing campaign by the well-known threat group TA577 that targets Windows NT LAN ...| HYPR Blog
My old laptop’s wifi went on the fritz, so I got a new Lenovo P50. Fedora 23 wouldn’t work with the Skylake architecture, so I had to jump headfirst into the Fedora 24 beta. I’ve since hit one new issue: Yubikeys wouldn’t work for FIDO U2F authentication. Logging into a site using a Yubikey (inserting […]| Where's Walden?
HYPR has partnered closely with Microsoft on the new Entra ID external authentication methods and is excited to be a preferred public preview integration.| blog.hypr.com
Learn how hackers leverage AI to bypass traditional identity security and how these attacks can be defeated using deterministic identity assurance controls| blog.hypr.com
Check out the project on GitHub. A while back, I wrote about how I use javacard chips for all kind of systems. One of the authentication protocols these chips support (given a compatible applet is installed) is FIDO2. I won’t go into what FIDO is or why it is such a big deal, you can find plenty of resources on… Read More →| CHRZ Engineering
FIDO is how we're tackling passwordless authentication. Have you ever wondered how it works?| syfuhs.net