Loading video...

Video Failed to Load

Go Home

Most security programs are sleeping on Identity Exposure Management, and hackers are cashing in. The fastest path into an environment is almost always a leaked credential or a stolen session cookie sitting in an infostealer log. MFA doesn't help when the attacker already has the session. Password rotation doesn't...

Jhaddix's profile picture

JS0N Haddix

175,565 subscribers

29,140 views • 4 months ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

You can't pretend you care about security if you are still sharing API tokens in .env files or sharing SSH keys. This might be good enough to provide simple access to a resource, but it's a horrible way to do security when it really matters. Look into "Identity-Based Access". The state of the art today is Identity-Based Access. With traditional security, you have to present a key to get access to the resource (an API key, a password, or an SSH key). These are long-lived keys you need to keep secret somehow. If somebody steals your key, they become you and get the same access you had. With Identity-Based Access, you need to prove who you are instead. If you are a human, you can prove this with a passkey, SSO with Google or GitHub, or Multi-Factor Authentication. If you are a computer, you can use AWS IAM, Kubernetes, a cloud service account, or any other trusted environment. Once the system verifies your identity, it checks your permissions and gives you a short-lived credential. Prove identity → Permissions → Short-lived credential → Access The difference here is huge, because those credentials are: • Short-lived • Tied to a specific identity • Scoped to specific permissions • Automatically expired • Much easier to audit In practice, implementing this is as simple as integrating with Teleport, which will handle everything for you. Here is a full explanation of how Teleport works and how you can start using it: Thanks to the Teleport team for partnering with me on this post.
5:46

You can't pretend you care about security if you are still sharing API tokens in .env files or sharing SSH keys. This might be good enough to provide simple access to a resource, but it's a horrible way to do security when it really matters. Look into "Identity-Based Access". The state of the art today is Identity-Based Access. With traditional security, you have to present a key to get access to the resource (an API key, a password, or an SSH key). These are long-lived keys you need to keep secret somehow. If somebody steals your key, they become you and get the same access you had. With Identity-Based Access, you need to prove who you are instead. If you are a human, you can prove this with a passkey, SSO with Google or GitHub, or Multi-Factor Authentication. If you are a computer, you can use AWS IAM, Kubernetes, a cloud service account, or any other trusted environment. Once the system verifies your identity, it checks your permissions and gives you a short-lived credential. Prove identity → Permissions → Short-lived credential → Access The difference here is huge, because those credentials are: • Short-lived • Tied to a specific identity • Scoped to specific permissions • Automatically expired • Much easier to audit In practice, implementing this is as simple as integrating with Teleport, which will handle everything for you. Here is a full explanation of how Teleport works and how you can start using it: Thanks to the Teleport team for partnering with me on this post.

Santiago

20,971 views • 17 days ago

.travis kalanick on finding your business soulmate: "I like to say you go out on a date with an idea. Was it a good date? Did it go well? How did you and the idea get along? Who you are is going to be a big part of which idea works for you. [I call this] finding your sport or your business soulmate. If you're in touch with who you are then when the right idea comes your way you just know."
0:42

.travis kalanick on finding your business soulmate: "I like to say you go out on a date with an idea. Was it a good date? Did it go well? How did you and the idea get along? Who you are is going to be a big part of which idea works for you. [I call this] finding your sport or your business soulmate. If you're in touch with who you are then when the right idea comes your way you just know."

David Senra

18,236 views • 24 days ago

"Maybe 1 billion people are hybrid aliens" Disclosure Day's first trailer said "7 billion people have the right to know the truth" while the finished film says 8 billion people. That is not an oversight you make on a film at that budget level. "Either they don't know how many people are on the planet, which seems unlikely, or maybe it doesn't take place in the present." "Or maybe a billion people are alien hybrids or whatever." "Is this the Mandela effect? Like, what is going on?" "That's not an oversight that you make on a movie of that level of budget." "Hundreds of people saw that, including Spielberg."
1:32

"Maybe 1 billion people are hybrid aliens" Disclosure Day's first trailer said "7 billion people have the right to know the truth" while the finished film says 8 billion people. That is not an oversight you make on a film at that budget level. "Either they don't know how many people are on the planet, which seems unlikely, or maybe it doesn't take place in the present." "Or maybe a billion people are alien hybrids or whatever." "Is this the Mandela effect? Like, what is going on?" "That's not an oversight that you make on a movie of that level of budget." "Hundreds of people saw that, including Spielberg."

American Alchemy

279,672 views • 2 months ago

Most developers can't explain how Single Sign-On (SSO) works. ​ This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. ​ Here is a 5-minute overview of how Single Sign-On works. ​ We all hate passwords; the less we use them, the better, and SSO helps with that. ​ When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: ​ • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. ​ Here is what happens when you try to access one application for the first time: ​ 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. ​ 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. ​ 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. ​ 4. Your browser grabs the token and presents it to YouTube. ​ 5. YouTube checks the token, and if it is valid, lets you in. ​ But then you want to access Google Drive: ​ 1. You go to Google Drive, and the application redirects you to the IDP. ​ 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. ​ 3. Instead, the IDP generates a new token for Drive. ​ 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. ​ You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! ​ But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. ​ Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! ​ They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website: ​
4:57

Most developers can't explain how Single Sign-On (SSO) works. ​ This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. ​ Here is a 5-minute overview of how Single Sign-On works. ​ We all hate passwords; the less we use them, the better, and SSO helps with that. ​ When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: ​ • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. ​ Here is what happens when you try to access one application for the first time: ​ 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. ​ 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. ​ 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. ​ 4. Your browser grabs the token and presents it to YouTube. ​ 5. YouTube checks the token, and if it is valid, lets you in. ​ But then you want to access Google Drive: ​ 1. You go to Google Drive, and the application redirects you to the IDP. ​ 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. ​ 3. Instead, the IDP generates a new token for Drive. ​ 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. ​ You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! ​ But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. ​ Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! ​ They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website: ​

Santiago

204,895 views • 1 year ago

🚨 HOLY SH*T! GLOBAL ELITES BEGIN AI-ENFORCED BIOMETRIC CONTROL: “THIS IS THE LAST YEAR YOU WILL EVER USE A PASSWORD” On stage in the UAE, Tony Blair explains what must come first for AI-run governments to function properly: cloud services, massive data centers, and a unified digital identity - the “basic digital infrastructure” required so the rest of the system can work effectively. Then Larry Ellison says the most frightening part: “This is the last year you will ever log on with a password.” Ellison argues passwords are too easily stolen, too flexible, too human. The replacement isn’t a better password - it’s AI-assisted biometric verification, where the system recognizes your face, your voice, and even your fingerprint, and then decides whether it is “absolutely certain” that you are who you claim to be. Read that carefully. AI doesn’t help you log in - it judges your identity. Your body becomes the credential. Your biology becomes the key. Logging in is no longer something you do; it’s something that’s done to you. And once identity is centralized into digital ID systems tied to cloud infrastructure and AI enforcement, access stops being a right and starts becoming conditional. There is no password reset for your face. No workaround for your voice. No anonymity once your identity is the system. If AI decides you’re not you, you don’t just lose an account - you lose access: to banking, services, systems, travel, and participation itself. This isn’t about convenience or security. It’s about control at scale, announced calmly, publicly, and without apology. When your face is the password, how do you opt out without erasing yourself?
1:12

🚨 HOLY SH*T! GLOBAL ELITES BEGIN AI-ENFORCED BIOMETRIC CONTROL: “THIS IS THE LAST YEAR YOU WILL EVER USE A PASSWORD” On stage in the UAE, Tony Blair explains what must come first for AI-run governments to function properly: cloud services, massive data centers, and a unified digital identity - the “basic digital infrastructure” required so the rest of the system can work effectively. Then Larry Ellison says the most frightening part: “This is the last year you will ever log on with a password.” Ellison argues passwords are too easily stolen, too flexible, too human. The replacement isn’t a better password - it’s AI-assisted biometric verification, where the system recognizes your face, your voice, and even your fingerprint, and then decides whether it is “absolutely certain” that you are who you claim to be. Read that carefully. AI doesn’t help you log in - it judges your identity. Your body becomes the credential. Your biology becomes the key. Logging in is no longer something you do; it’s something that’s done to you. And once identity is centralized into digital ID systems tied to cloud infrastructure and AI enforcement, access stops being a right and starts becoming conditional. There is no password reset for your face. No workaround for your voice. No anonymity once your identity is the system. If AI decides you’re not you, you don’t just lose an account - you lose access: to banking, services, systems, travel, and participation itself. This isn’t about convenience or security. It’s about control at scale, announced calmly, publicly, and without apology. When your face is the password, how do you opt out without erasing yourself?

HustleBitch

158,152 views • 7 months ago

😱ARE YOU READY FOR WHAT'S COMING?😱 THE PARANORMAL SCENE IS EXPLAINED THAT'S CHILLING THE BLOOD OF ANYONE WHO SEES IT In a shadowy forest, a person dressed in light-colored clothes walks carefree… when suddenly, at their side, a dark and nebulous figure emerges, almost human but impossibly sinister. It doesn't move like a person. It floats. It distorts. It watches. Some swear it's a spirit trapped between worlds. Others try to explain it: a costume, an editing effect, or a strange distortion of light and fog. But when you watch the full video… you feel like something is watching you back. This kind of footage always starts as an "optical illusion"… until it stops being one. Do you think it's something real or just a visual trick?🤔
1:06

😱ARE YOU READY FOR WHAT'S COMING?😱 THE PARANORMAL SCENE IS EXPLAINED THAT'S CHILLING THE BLOOD OF ANYONE WHO SEES IT In a shadowy forest, a person dressed in light-colored clothes walks carefree… when suddenly, at their side, a dark and nebulous figure emerges, almost human but impossibly sinister. It doesn't move like a person. It floats. It distorts. It watches. Some swear it's a spirit trapped between worlds. Others try to explain it: a costume, an editing effect, or a strange distortion of light and fog. But when you watch the full video… you feel like something is watching you back. This kind of footage always starts as an "optical illusion"… until it stops being one. Do you think it's something real or just a visual trick?🤔

John F. Kennedy Jr Q

30,064 views • 2 months ago

One of the biggest challenges that marketers face today is... ...tracking the performance of marketing channels. Why? Simply, because during the customer journey, there are multiple touchpoints involved, ...and tracking the entire journey from the first touch to conversion is not an easy task, especially when using tools like GA4. It's like trying to follow the path of a squirrel in a thick forest... Which tree did it climb first? Which path did it take? That's exactly why we developed marketing attribution in Usermaven. This powerful tool makes it simple to see which channels and sources are influencing your pipeline and conversions the most. It's like having a GPS for your marketing efforts! I've recorded a short video to show you what I am talking about. This will help you streamline your marketing efforts in the right direction and put you on the fast track to growth. What's your biggest growth challenge right now?
8:47

One of the biggest challenges that marketers face today is... ...tracking the performance of marketing channels. Why? Simply, because during the customer journey, there are multiple touchpoints involved, ...and tracking the entire journey from the first touch to conversion is not an easy task, especially when using tools like GA4. It's like trying to follow the path of a squirrel in a thick forest... Which tree did it climb first? Which path did it take? That's exactly why we developed marketing attribution in Usermaven. This powerful tool makes it simple to see which channels and sources are influencing your pipeline and conversions the most. It's like having a GPS for your marketing efforts! I've recorded a short video to show you what I am talking about. This will help you streamline your marketing efforts in the right direction and put you on the fast track to growth. What's your biggest growth challenge right now?

Waqar Azeem

106,211 views • 1 year ago

Today, Search Live is available in English in the U.S. — no Labs opt-in required. ✨ You can now have a free-flowing, back-and-forth conversation with Search using your voice and phone camera. Live in Search combines the power of Google Lens and AI Mode to see and accurately identify objects in front of you. This allows Search to understand exactly what you are looking at and help you find the most relevant information across the web to respond to your questions in real time. Try it today by tapping Live in the Google app (iOS and Android) or Lens, and let us know what you think!
1:05

Today, Search Live is available in English in the U.S. — no Labs opt-in required. ✨ You can now have a free-flowing, back-and-forth conversation with Search using your voice and phone camera. Live in Search combines the power of Google Lens and AI Mode to see and accurately identify objects in front of you. This allows Search to understand exactly what you are looking at and help you find the most relevant information across the web to respond to your questions in real time. Try it today by tapping Live in the Google app (iOS and Android) or Lens, and let us know what you think!

Google AI

48,572 views • 11 months ago

WATCH: This police officer encounters an Army Veteran who is on the phone with the VA su*cide hotline in the middle of a crisis. The officer gives him a hug when he desperately needs it the most. To all of our Veterans out there who are struggling, just know that we hear you, see you and LOVE YOU. Thank you for your service and sacrifice. We love you.
1:09

WATCH: This police officer encounters an Army Veteran who is on the phone with the VA su*cide hotline in the middle of a crisis. The officer gives him a hug when he desperately needs it the most. To all of our Veterans out there who are struggling, just know that we hear you, see you and LOVE YOU. Thank you for your service and sacrifice. We love you.

AmericanPapaBear™

96,340 views • 1 year ago

A father’s worst nightmare. His kids are in the back, facing a medical emergency. Every second feels like an eternity. He hits the gas, desperate to reach the hospital. But the sirens start wailing behind him. He runs. ​The truth is, when the lights come on, you’ve got to stop. If you’re in a race against time, pulling over immediately is your fastest route to help. Tell the officer what’s happening. They have the lights, the sirens, and the training to clear a path and escort you safely. ​Don't let panic turn a medical crisis into a legal catastrophe. Your children’s safety depends on your ability to stay grounded, even when the world feels like it's spinning out of control.
1:18

A father’s worst nightmare. His kids are in the back, facing a medical emergency. Every second feels like an eternity. He hits the gas, desperate to reach the hospital. But the sirens start wailing behind him. He runs. ​The truth is, when the lights come on, you’ve got to stop. If you’re in a race against time, pulling over immediately is your fastest route to help. Tell the officer what’s happening. They have the lights, the sirens, and the training to clear a path and escort you safely. ​Don't let panic turn a medical crisis into a legal catastrophe. Your children’s safety depends on your ability to stay grounded, even when the world feels like it's spinning out of control.

Desiree

10,102,093 views • 6 months ago

If you have an idea for an app and you want to build it fast and deploy it with a lot of the controls that a developer would want, the experience on Replit ⠕ is pretty amazing. I recorded this quick video while I'm sitting here at Philz before dinner tonight. Let me know your thoughts: Who's using Replit? Who likes it? What don't you like? What works? What doesn't?
3:00

If you have an idea for an app and you want to build it fast and deploy it with a lot of the controls that a developer would want, the experience on Replit ⠕ is pretty amazing. I recorded this quick video while I'm sitting here at Philz before dinner tonight. Let me know your thoughts: Who's using Replit? Who likes it? What don't you like? What works? What doesn't?

Ryan Carson

29,729 views • 1 year ago

One of John McAfee's final messages to the world: "Some of you may be living an existence of dissatisfaction... of emptiness... of longing." "This sense of longing... is really your loss of freedom. And it is freedom for which you yearn." "And you have none in this government. A government... which started out with the people being free and the government being our servants. It has become the government is free... and it's the people that are the servants." "You have woken up to your reality. That is what you are feeling." "Wake up a bit more and do something about it."
2:00

One of John McAfee's final messages to the world: "Some of you may be living an existence of dissatisfaction... of emptiness... of longing." "This sense of longing... is really your loss of freedom. And it is freedom for which you yearn." "And you have none in this government. A government... which started out with the people being free and the government being our servants. It has become the government is free... and it's the people that are the servants." "You have woken up to your reality. That is what you are feeling." "Wake up a bit more and do something about it."

Red Pill Dispenser

516,681 views • 1 year ago

Travis Kalanick says founders should date ideas before committing to them: "I have lots of ideas all the time. I'm an idea factory. But other people have great ideas, too." "I like to say, you go out on a date with the idea. Was it a good date? Did it go well? How did you and the idea get along?" "Who you are is going to be a big part of which idea works for you... Be in touch with who you are, and then when the right idea comes your way, you just know." travis kalanick w/ David Senra
0:46

Travis Kalanick says founders should date ideas before committing to them: "I have lots of ideas all the time. I'm an idea factory. But other people have great ideas, too." "I like to say, you go out on a date with the idea. Was it a good date? Did it go well? How did you and the idea get along?" "Who you are is going to be a big part of which idea works for you... Be in touch with who you are, and then when the right idea comes your way, you just know." travis kalanick w/ David Senra

a16z

99,368 views • 24 days ago

My understanding is that the Dulgarian controversy is not an isolated incident. I’ve spoken to multiple people who have either experienced or know of others who have been approached about their willingness to do something like this. Essentially: “Are you interested in throwing a fight for X amount of dollars?” This is a massive issue for the UFC. And when you consider the questionable refereeing as of late, you can’t help but wonder if there are integrity issues there as well.
2:51

My understanding is that the Dulgarian controversy is not an isolated incident. I’ve spoken to multiple people who have either experienced or know of others who have been approached about their willingness to do something like this. Essentially: “Are you interested in throwing a fight for X amount of dollars?” This is a massive issue for the UFC. And when you consider the questionable refereeing as of late, you can’t help but wonder if there are integrity issues there as well.

Ariel Helwani

500,628 views • 10 months ago