Loading video...

Video Failed to Load

Go Home

Most security programs are sleeping on Identity Exposure Management, and hackers are cashing in. The fastest path into an environment is almost always a leaked credential or a stolen session cookie sitting in an infostealer log. MFA doesn't help when the attacker already has the session. Password rotation doesn't...

29,140 views • 1 month ago •via X (Twitter)

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Most developers can't explain how Single Sign-On (SSO) works. ​ This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. ​ Here is a 5-minute overview of how Single Sign-On works. ​ We all hate passwords; the less we use them, the better, and SSO helps with that. ​ When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: ​ • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. ​ Here is what happens when you try to access one application for the first time: ​ 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. ​ 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. ​ 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. ​ 4. Your browser grabs the token and presents it to YouTube. ​ 5. YouTube checks the token, and if it is valid, lets you in. ​ But then you want to access Google Drive: ​ 1. You go to Google Drive, and the application redirects you to the IDP. ​ 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. ​ 3. Instead, the IDP generates a new token for Drive. ​ 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. ​ You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! ​ But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. ​ Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! ​ They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website: ​

Santiago

204,826 views • 1 year ago

🚨 HOLY SH*T! GLOBAL ELITES BEGIN AI-ENFORCED BIOMETRIC CONTROL: “THIS IS THE LAST YEAR YOU WILL EVER USE A PASSWORD” On stage in the UAE, Tony Blair explains what must come first for AI-run governments to function properly: cloud services, massive data centers, and a unified digital identity - the “basic digital infrastructure” required so the rest of the system can work effectively. Then Larry Ellison says the most frightening part: “This is the last year you will ever log on with a password.” Ellison argues passwords are too easily stolen, too flexible, too human. The replacement isn’t a better password - it’s AI-assisted biometric verification, where the system recognizes your face, your voice, and even your fingerprint, and then decides whether it is “absolutely certain” that you are who you claim to be. Read that carefully. AI doesn’t help you log in - it judges your identity. Your body becomes the credential. Your biology becomes the key. Logging in is no longer something you do; it’s something that’s done to you. And once identity is centralized into digital ID systems tied to cloud infrastructure and AI enforcement, access stops being a right and starts becoming conditional. There is no password reset for your face. No workaround for your voice. No anonymity once your identity is the system. If AI decides you’re not you, you don’t just lose an account - you lose access: to banking, services, systems, travel, and participation itself. This isn’t about convenience or security. It’s about control at scale, announced calmly, publicly, and without apology. When your face is the password, how do you opt out without erasing yourself?

HustleBitch

156,662 views • 4 months ago