A daily tech news roundup covering .NET, Azure, AI, web development, and DevOps updates, including NuGet security, Next.js 16.3, and AI coding tools.
Explains opaque, interoperable passkey records and a Go API for simplifying server-side WebAuthn implementation.
Explains what passkeys are, how they use asymmetric cryptography, and why they are more secure than passwords.
A guide on securing agent-to-agent (A2A) communication in multi-agent AI systems, covering risks, authentication, and practical controls.
Microsoft announces retirement of SMS and voice authentication by 2027, pushing passkeys as the default MFA method.
Optimizing a slow password reset query in CockroachDB, reducing row reads from 700k to 10.
Explains what IdentityServer is, its role as a .NET OAuth/OIDC identity provider, and when you need it versus simpler ASP.NET Identity.
How to implement constant-time equality checks in ColdFusion to prevent timing attacks on authentication code.
Microsoft Entra ID now supports Passkeys in Registration Campaigns, nudging users towards passwordless authentication.
Guide on identifying third-party apps with poor authentication in Microsoft Entra to prevent supply chain attacks.
Troubleshooting WeeChat using the wrong nickname after SASL authentication on IRC.
Microsoft Entra ID now allows restricting multi-tenant apps to specific authorized tenants, enhancing security for SaaS applications.
Explains how MCP tools in IBM watsonx Orchestrate use OAuth and SSO to act securely on behalf of users, with a code example.
Explains how to combine AWS AgentCore with Agentgateway for secure, identity-aware authentication in AI agent deployments.
A technical guide on implementing Two-Factor Authentication (2FA) using TOTP and QR codes in ASP.NET Core for enhanced security.
A guide to using OpenID Connect and tsidp for centralized authentication in a homelab, replacing passwords for services like Proxmox and Portainer.
A guide to implementing Conditional Access policies for securing Azure Virtual Desktop, covering architecture, policy configuration, and best practices.
Discusses the critical need for secure account recovery workflows when implementing passkeys, highlighting Microsoft Entra's new preview solution.
Troubleshooting guide for fixing the 'browser blocked popup' error when creating a Logic App connection in the Azure Portal.
A practical guide to implementing essential API security best practices in Spring Boot, including HTTPS, JWT authentication, authorization, and rate limiting.
