Information security
fromThe Hacker News
15 hours agoNo Exploit Needed: How Attackers Walk Through the Front Door via Identity-Based Attacks
Stolen credentials remain the primary entry point for attackers, despite advancements in cybersecurity.
The internet you experience daily-endless scrolling, algorithmic feeds serving content you didn't ask for, AI-generated slop clogging search results-isn't the only internet available. It's just the one that's easiest to stumble into. You're not stuck with the internet that has evolved alongside the rise of hegemonic platforms. We're 20-plus years into the social internet, and the winners of the last round of audience capture have made clear they're shifting to optimize for social broadcasting instead of networking, to maximize market share and market cap.
Most design specs break down in development because they're built for designers, not developers. This article shows how to write specs that reflect real-world logic, states, constraints, and platform behavior not just pixels. Rafael Basso Jan 20, 2026 11 min read A practical guide to AI in UX design, covering predictive UX, generative assistance, personalization, automation, and the risks of overusing AI. Shalitha Suranga Jan 14, 2026 11 min read
FOSDEM 2026 Amid growing interest in digital sovereignty and getting data out of the corporate cloud and into organizations' ownership, the Matrix open communication protocol is thriving. The project was co-founded by Matthew Hodgson and Amandine le Pape, and The Reg FOSS desk met both at this year's FOSDEM for a chat about what's happening with Matrix. The Register has covered Matrix and its commercial Element side quite a few times over the years,
What I walked through wasn't just an immigration gate. It was a node in a rapidly expanding global infrastructure of digital identity, one being constructed at extraordinary speed, across dozens of countries, by a mix of governments, multilateral organizations, and private technology vendors. The people building it believe they are solving real problems: fraud, statelessness, inefficient public services, financial exclusion.
An FBI informant helped run the Incognito dark web market and allegedly approved the sale of fentanyl-laced pills, including those from a dealer linked to a confirmed death, WIRED reported this week. Meanwhile, Jeffrey Epstein's ties to Customs and Border Protection officers sparked a Department of Justice probe. Documents say that CBP officers in the US Virgin Islands were still friendly with Epstein years after his 2008 conviction, illustrating the infamous sex offender's tactics for cultivating allies.
Discord presents its move as inevitable. It's not. I know that Discord isn't trying to harm anyone. The company genuinely believes it's protecting users. But good intentions don't prevent the drift. They accelerate it. There's also the risk that the collected data becomes exposed.
Traditional IAM and IGA systems are designed primarily for human users and depend on manual onboarding and integration for each application - connectors, schema mapping, entitlement catalogs, and role modeling. Many applications never make it that far. Meanwhile, non-human identities (NHIs): service accounts, bots, APIs, and agent-AI processes are natively ungoverned, operating outside standard IAM frameworks and often without ownership, visibility, or lifecycle controls.
While you're thinking about third-party add-ons for your computer and phone, take a moment to review everything you have installed on both fronts and consider how many of those programs you actually still use. The fewer cracked windows you allow on your Google account, the better - and if you aren't even using something, there's no reason to keep it connected.
Zero trust is not a thing; it is an idea. It is not a product; it is a concept - it is a destination that has no precise route and may never be reached. But it is described very succinctly: trust nothing until the trust is justified. Justification starts with verifying every subject's identity and authority. This is the single constant in all zero trust journeys: they start with the subject's identity. Zero trust's reliance on identity, and identity's reliance on AI Two questions. Can you have zero trust without effective identity verification? No. Can you have effective identity verification in the age of AI? Maybe, and maybe not.