Signal has introduced Automatic Key Verification, a key transparency feature that checks whether the public keys stored for your account actually belong to your own devices, reducing reliance on manually comparing safety numbers. Trail of Bits built one of three independent auditors that continuously verify this system by maintaining its own Merkle tree copy of the global key map and periodically signing it to confirm consistency.
blog.trailofbits.com
· 2026-09-12
Security researchers, including work from SpecterOps, have documented at least 39 distinct methods that can undermine passkey authentication despite the underlying FIDO2 cryptography remaining secure. These techniques target the surrounding infrastructure rather than the cryptographic keys themselves, including browsers, operating systems, password managers, sync services, Bluetooth transport, and account recovery workflows. Many have working proof-of-concept tools, and some techniques are already surfacing in real-world attack activity.
bleepingcomputer.com
· 2026-09-04
GoKawiil