正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

Most security programs are sleeping on Identity Exposure Management, and hackers are cashing in. The fastest path into an environment is almost always a leaked credential or a stolen session cookie sitting in an infostealer log. MFA doesn't help when the attacker already has the session. Password rotation doesn't... show more

JS0N Haddix

175,565 subscribers

29,140 次观看 • 6 个月前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

0 条评论

暂无评论

原始帖子的评论将显示在这里

相关视频

You can't pretend you care about security if you are still sharing API tokens in .env files or sharing SSH keys. This might be good enough to provide simple access to a resource, but it's a horrible way to do security when it really matters. Look into "Identity-Based Access". The state of the art today is Identity-Based Access. With traditional security, you have to present a key to get access to the resource (an API key, a password, or an SSH key). These are long-lived keys you need to keep secret somehow. If somebody steals your key, they become you and get the same access you had. With Identity-Based Access, you need to prove who you are instead. If you are a human, you can prove this with a passkey, SSO with Google or GitHub, or Multi-Factor Authentication. If you are a computer, you can use AWS IAM, Kubernetes, a cloud service account, or any other trusted environment. Once the system verifies your identity, it checks your permissions and gives you a short-lived credential. Prove identity → Permissions → Short-lived credential → Access The difference here is huge, because those credentials are: • Short-lived • Tied to a specific identity • Scoped to specific permissions • Automatically expired • Much easier to audit In practice, implementing this is as simple as integrating with Teleport, which will handle everything for you. Here is a full explanation of how Teleport works and how you can start using it: Thanks to the Teleport team for partnering with me on this post.

You can't pretend you care about security if you are still sharing API tokens in .env files or sharing SSH keys. This might be good enough to provide simple access to a resource, but it's a horrible way to do security when it really matters. Look into "Identity-Based Access". The state of the art today is Identity-Based Access. With traditional security, you have to present a key to get access to the resource (an API key, a password, or an SSH key). These are long-lived keys you need to keep secret somehow. If somebody steals your key, they become you and get the same access you had. With Identity-Based Access, you need to prove who you are instead. If you are a human, you can prove this with a passkey, SSO with Google or GitHub, or Multi-Factor Authentication. If you are a computer, you can use AWS IAM, Kubernetes, a cloud service account, or any other trusted environment. Once the system verifies your identity, it checks your permissions and gives you a short-lived credential. Prove identity → Permissions → Short-lived credential → Access The difference here is huge, because those credentials are: • Short-lived • Tied to a specific identity • Scoped to specific permissions • Automatically expired • Much easier to audit In practice, implementing this is as simple as integrating with Teleport, which will handle everything for you. Here is a full explanation of how Teleport works and how you can start using it: Thanks to the Teleport team for partnering with me on this post.

Santiago

20,971 次观看 • 2 个月前

"Maybe 1 billion people are hybrid aliens" Disclosure Day's first trailer said "7 billion people have the right to know the truth" while the finished film says 8 billion people. That is not an oversight you make on a film at that budget level. "Either they don't know how many people are on the planet, which seems unlikely, or maybe it doesn't take place in the present." "Or maybe a billion people are alien hybrids or whatever." "Is this the Mandela effect? Like, what is going on?" "That's not an oversight that you make on a movie of that level of budget." "Hundreds of people saw that, including Spielberg."

"Maybe 1 billion people are hybrid aliens" Disclosure Day's first trailer said "7 billion people have the right to know the truth" while the finished film says 8 billion people. That is not an oversight you make on a film at that budget level. "Either they don't know how many people are on the planet, which seems unlikely, or maybe it doesn't take place in the present." "Or maybe a billion people are alien hybrids or whatever." "Is this the Mandela effect? Like, what is going on?" "That's not an oversight that you make on a movie of that level of budget." "Hundreds of people saw that, including Spielberg."

American Alchemy

279,909 次观看 • 4 个月前

Most developers can't explain how Single Sign-On (SSO) works. This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. Here is a 5-minute overview of how Single Sign-On works. We all hate passwords; the less we use them, the better, and SSO helps with that. When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. Here is what happens when you try to access one application for the first time: 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. 4. Your browser grabs the token and presents it to YouTube. 5. YouTube checks the token, and if it is valid, lets you in. But then you want to access Google Drive: 1. You go to Google Drive, and the application redirects you to the IDP. 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. 3. Instead, the IDP generates a new token for Drive. 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website:

Most developers can't explain how Single Sign-On (SSO) works. This was one of my favorite questions during technical interviews. I love to ask about it because it's not a trivial topic. Here is a 5-minute overview of how Single Sign-On works. We all hate passwords; the less we use them, the better, and SSO helps with that. When you log in to Google once and visit YouTube, Gmail, Drive, and any other connected service without re-entering your password, three players are working behind the scenes: • A user trying to access an application. You, in this case. • The application you want to access. For example, YouTube. • An Identity Provider (IDP) that will verify your identity. Google, in this case. Here is what happens when you try to access one application for the first time: 1. You try to log in to YouTube, and the application redirects you to the Identity Provider (IDP) for authentication. 2. The IDP (Google) checks your credentials and confirms your identity. It creates a new session for you on its server and sets a session cookie in your browser. 3. The IDP also creates a token for YouTube—a small piece of data that contains information about your identity. 4. Your browser grabs the token and presents it to YouTube. 5. YouTube checks the token, and if it is valid, lets you in. But then you want to access Google Drive: 1. You go to Google Drive, and the application redirects you to the IDP. 2. The IDP recognizes that you are still logged in because you have the session cookie. It doesn't need to ask for your credentials. 3. Instead, the IDP generates a new token for Drive. 4. Your browser grabs the token and presents it to Google Drive. If the token is valid, Drive lets you in. You can now access multiple applications without re-entering your password. This is probably one of the best things we've invented since sliced bread! But, of course, implementing Single Sign-On is a nightmare! If you are a developer, don't try to reinvent the wheel. I've been implementing SSO since dinosaurs were around, and I can tell you you want to check out Auth0. Auth0 makes implementing SSO 100x easier. They just updated their free plan, and you get a lot without having to pay a single cent. 25,000 monthly active users, unlimited social connections, and you can go to production with custom domains. FOR FREE! They are sponsoring this post. To save your time, keep your sanity, and have a really solid and secure solution, head over to their website:

Santiago

205,086 次观看 • 2 年前

When government employees, members of the military, and citizens of a country are afraid of the leader of the country, you live in an authoritarian state

When government employees, members of the military, and citizens of a country are afraid of the leader of the country, you live in an authoritarian state

Piyush Mittal 🇺🇸🇺🇦🟧🌊🌈

71,085 次观看 • 1 年前

One thing that doesn't get nearly enough attention in the golf swing, in my opinion, is what the right shoulder does. And if you don't get this right, which almost everybody doesn't, then everything else in your swing doesn't really matter. Let me explain what I mean by this. ⬇️Click the link below and I can help you solve this common problem in as little as one range session ⬇️

One thing that doesn't get nearly enough attention in the golf swing, in my opinion, is what the right shoulder does. And if you don't get this right, which almost everybody doesn't, then everything else in your swing doesn't really matter. Let me explain what I mean by this. ⬇️Click the link below and I can help you solve this common problem in as little as one range session ⬇️

Top Speed Golf

114,323 次观看 • 6 个月前

The fastest way to turn a defensive around is simple. You don't need an elaborate scheme, you don't need the best talent in the world, you just need 11 guys who are extremely violent and physical and play with an extreme amount of intensity. #WPS #Arkansas #CollegeFootball

The fastest way to turn a defensive around is simple. You don't need an elaborate scheme, you don't need the best talent in the world, you just need 11 guys who are extremely violent and physical and play with an extreme amount of intensity. #WPS #Arkansas #CollegeFootball

D.J. Williams

37,171 次观看 • 1 年前

🚨 HOLY SH*T! GLOBAL ELITES BEGIN AI-ENFORCED BIOMETRIC CONTROL: “THIS IS THE LAST YEAR YOU WILL EVER USE A PASSWORD” On stage in the UAE, Tony Blair explains what must come first for AI-run governments to function properly: cloud services, massive data centers, and a unified digital identity - the “basic digital infrastructure” required so the rest of the system can work effectively. Then Larry Ellison says the most frightening part: “This is the last year you will ever log on with a password.” Ellison argues passwords are too easily stolen, too flexible, too human. The replacement isn’t a better password - it’s AI-assisted biometric verification, where the system recognizes your face, your voice, and even your fingerprint, and then decides whether it is “absolutely certain” that you are who you claim to be. Read that carefully. AI doesn’t help you log in - it judges your identity. Your body becomes the credential. Your biology becomes the key. Logging in is no longer something you do; it’s something that’s done to you. And once identity is centralized into digital ID systems tied to cloud infrastructure and AI enforcement, access stops being a right and starts becoming conditional. There is no password reset for your face. No workaround for your voice. No anonymity once your identity is the system. If AI decides you’re not you, you don’t just lose an account - you lose access: to banking, services, systems, travel, and participation itself. This isn’t about convenience or security. It’s about control at scale, announced calmly, publicly, and without apology. When your face is the password, how do you opt out without erasing yourself?

🚨 HOLY SH*T! GLOBAL ELITES BEGIN AI-ENFORCED BIOMETRIC CONTROL: “THIS IS THE LAST YEAR YOU WILL EVER USE A PASSWORD” On stage in the UAE, Tony Blair explains what must come first for AI-run governments to function properly: cloud services, massive data centers, and a unified digital identity - the “basic digital infrastructure” required so the rest of the system can work effectively. Then Larry Ellison says the most frightening part: “This is the last year you will ever log on with a password.” Ellison argues passwords are too easily stolen, too flexible, too human. The replacement isn’t a better password - it’s AI-assisted biometric verification, where the system recognizes your face, your voice, and even your fingerprint, and then decides whether it is “absolutely certain” that you are who you claim to be. Read that carefully. AI doesn’t help you log in - it judges your identity. Your body becomes the credential. Your biology becomes the key. Logging in is no longer something you do; it’s something that’s done to you. And once identity is centralized into digital ID systems tied to cloud infrastructure and AI enforcement, access stops being a right and starts becoming conditional. There is no password reset for your face. No workaround for your voice. No anonymity once your identity is the system. If AI decides you’re not you, you don’t just lose an account - you lose access: to banking, services, systems, travel, and participation itself. This isn’t about convenience or security. It’s about control at scale, announced calmly, publicly, and without apology. When your face is the password, how do you opt out without erasing yourself?

HustleBitch

158,152 次观看 • 9 个月前

Comer: "Hakeem Jeffries has declared himself the leader, and he doesn't want anyone having differing opinions. That's what happens when you have socialism and communism ... that's the difference in the Democrats and Republicans. Republicans are open minded, free will ... the Democrats want to rule with an iron fist"

Comer: "Hakeem Jeffries has declared himself the leader, and he doesn't want anyone having differing opinions. That's what happens when you have socialism and communism ... that's the difference in the Democrats and Republicans. Republicans are open minded, free will ... the Democrats want to rule with an iron fist"

Aaron Rupar

195,023 次观看 • 2 个月前

Whether you’ve got a few minutes or you’re locked in for a longer session, this is what it feels like when everything clicks in The Division Resurgence - download now on your mobile device and become an agent.

Whether you’ve got a few minutes or you’re locked in for a longer session, this is what it feels like when everything clicks in The Division Resurgence - download now on your mobile device and become an agent.

Ubisoft

51,338 次观看 • 6 个月前

Saying you're making a film on the meaning of life is about the most pretentious thing you could ever say. Well! That is what we are in production on. That's what we are doing and how you can help.

Saying you're making a film on the meaning of life is about the most pretentious thing you could ever say. Well! That is what we are in production on. That's what we are doing and how you can help.

Cernovich

975,404 次观看 • 2 年前

This is Lavern Spicer and I have some REAL TALK for Mad Maxine Waters. Ma'am, you done spent 35 MUTHAFUCKIN YEARS in office telling your Black constituents the world is against them. When are you actually gonna do something that's FOR them? Where are your policies? Where are your results? And what is your plan to help the Black community move forward? OR DON'T YOU EVEN GIVE A FUCK?!

This is Lavern Spicer and I have some REAL TALK for Mad Maxine Waters. Ma'am, you done spent 35 MUTHAFUCKIN YEARS in office telling your Black constituents the world is against them. When are you actually gonna do something that's FOR them? Where are your policies? Where are your results? And what is your plan to help the Black community move forward? OR DON'T YOU EVEN GIVE A FUCK?!

Lavern Spicer 🇺🇸

19,813 次观看 • 13 天前

Hey Brits. A question. Whatever your identity - when you go to an event, do you just walk in? This 96 second video is not exciting. It is the depressing reality of Jewish life in the UK in 2026. Walking to an event in a synagogue - behind a mountain of security.

Hey Brits. A question. Whatever your identity - when you go to an event, do you just walk in? This 96 second video is not exciting. It is the depressing reality of Jewish life in the UK in 2026. Walking to an event in a synagogue - behind a mountain of security.

David Collier

32,752 次观看 • 5 个月前

THE FOOTAGE FROM THE SECURITY CAMERAS HAS BEEN LEAKED‼️❓ mind you this footage is from a month ago, that influencer and the artist are really kissing on the elevator, what’s next? the influencer has 3.4Million followers so of course someone leaked the video, besides that it’s a public place with cameras 😩….. is this when all started?

Sensitive content

THE FOOTAGE FROM THE SECURITY CAMERAS HAS BEEN LEAKED‼️❓ mind you this footage is from a month ago, that influencer and the artist are really kissing on the elevator, what’s next? the influencer has 3.4Million followers so of course someone leaked the video, besides that it’s a public place with cameras 😩….. is this when all started?

Val♡

24,193 次观看 • 1 个月前

That password you've used since 2016 is probably in a breach database right now. Credential stuffing bots test it against banking, email, and shopping sites automatically. Serus scans for your leaked credentials across breaches and the dark web, then keeps watching.

That password you've used since 2016 is probably in a breach database right now. Credential stuffing bots test it against banking, email, and shopping sites automatically. Serus scans for your leaked credentials across breaches and the dark web, then keeps watching.

Serus

398,949 次观看 • 1 个月前

That password you've used since 2016 is probably in a breach database right now. Credential stuffing bots test it against banking, email, and shopping sites automatically. Serus scans for your leaked credentials across breaches and the dark web, then keeps watching.

That password you've used since 2016 is probably in a breach database right now. Credential stuffing bots test it against banking, email, and shopping sites automatically. Serus scans for your leaked credentials across breaches and the dark web, then keeps watching.

Serus

4,844,560 次观看 • 3 个月前

.Kamala Harris: “When you are a black child in America going to an HBCU during that phase of life, it is an environment in which everything tells you you are special. You have a legacy to which you owe a duty and must honor, and much is expected of you.” 🎥: curly_binky

.Kamala Harris: “When you are a black child in America going to an HBCU during that phase of life, it is an environment in which everything tells you you are special. You have a legacy to which you owe a duty and must honor, and much is expected of you.” 🎥: curly_binky

best of kamala harris

19,247 次观看 • 10 个月前

😱ARE YOU READY FOR WHAT'S COMING?😱 THE PARANORMAL SCENE IS EXPLAINED THAT'S CHILLING THE BLOOD OF ANYONE WHO SEES IT In a shadowy forest, a person dressed in light-colored clothes walks carefree… when suddenly, at their side, a dark and nebulous figure emerges, almost human but impossibly sinister. It doesn't move like a person. It floats. It distorts. It watches. Some swear it's a spirit trapped between worlds. Others try to explain it: a costume, an editing effect, or a strange distortion of light and fog. But when you watch the full video… you feel like something is watching you back. This kind of footage always starts as an "optical illusion"… until it stops being one. Do you think it's something real or just a visual trick?🤔

😱ARE YOU READY FOR WHAT'S COMING?😱 THE PARANORMAL SCENE IS EXPLAINED THAT'S CHILLING THE BLOOD OF ANYONE WHO SEES IT In a shadowy forest, a person dressed in light-colored clothes walks carefree… when suddenly, at their side, a dark and nebulous figure emerges, almost human but impossibly sinister. It doesn't move like a person. It floats. It distorts. It watches. Some swear it's a spirit trapped between worlds. Others try to explain it: a costume, an editing effect, or a strange distortion of light and fog. But when you watch the full video… you feel like something is watching you back. This kind of footage always starts as an "optical illusion"… until it stops being one. Do you think it's something real or just a visual trick?🤔

John F. Kennedy Jr Q

30,064 次观看 • 4 个月前

One of the biggest challenges that marketers face today is... ...tracking the performance of marketing channels. Why? Simply, because during the customer journey, there are multiple touchpoints involved, ...and tracking the entire journey from the first touch to conversion is not an easy task, especially when using tools like GA4. It's like trying to follow the path of a squirrel in a thick forest... Which tree did it climb first? Which path did it take? That's exactly why we developed marketing attribution in Usermaven. This powerful tool makes it simple to see which channels and sources are influencing your pipeline and conversions the most. It's like having a GPS for your marketing efforts! I've recorded a short video to show you what I am talking about. This will help you streamline your marketing efforts in the right direction and put you on the fast track to growth. What's your biggest growth challenge right now?

One of the biggest challenges that marketers face today is... ...tracking the performance of marketing channels. Why? Simply, because during the customer journey, there are multiple touchpoints involved, ...and tracking the entire journey from the first touch to conversion is not an easy task, especially when using tools like GA4. It's like trying to follow the path of a squirrel in a thick forest... Which tree did it climb first? Which path did it take? That's exactly why we developed marketing attribution in Usermaven. This powerful tool makes it simple to see which channels and sources are influencing your pipeline and conversions the most. It's like having a GPS for your marketing efforts! I've recorded a short video to show you what I am talking about. This will help you streamline your marketing efforts in the right direction and put you on the fast track to growth. What's your biggest growth challenge right now?

Waqar Azeem

106,235 次观看 • 2 年前