Telecom signaling protocols SS7 and Diameter, used for carrier-to-carrier routing since the 1970s and 1990s respectively, can be exploited to locate phones, intercept SMS two-factor codes, and impersonate numbers without malware or phishing. The report notes these flaws were reportedly used by Iranian-linked actors to locate US personnel during the Iran war, and were previously demonstrated publicly when YouTuber Veritasium hijacked a tech influencer's calls and texts using only his phone number.
bleepingcomputer.com
· 2026-10-30
1Password has introduced a capability that allows AI agents to authenticate into websites on a user's behalf without directly accessing stored passwords. The company's existing product encrypts user credentials with AES-256 and syncs them across devices via its own servers.
techspot.com
· 2026-10-22
1Password has released 1Password for Agents, a feature that lets AI agents sign into accounts by verifying identity with a unique digital key instead of being handed a password. Users approve each sign-in request via notification on their own device, and 1Password autofills the credentials rather than passing them to the agent. The system already supports agents including Meta Muse, ChatGPT Work and Dots, Claude Duet, Grok Bot, and Town, with more partners reportedly integrating.
theverge.com
· 2026-10-22
Passkeys replace a secret you know with a key your device holds. That single change removes most of what makes phishing work, and it changes how account recovery should be set up.
gokawiil.com
· 2026-10-19
Apple quietly included a feature called Impersonation Risk Detection in iOS 27, alongside the headline Siri AI update. The tool analyzes interaction patterns, timing and context on-device to flag social-engineering scams as Unknown, Medium or High risk, sharing only that risk level with supporting apps rather than personal data. Users can enable it via Settings > Privacy & Security, though activation can take up to 24 hours.
cnet.com
· 2026-10-13
A new analysis of FBI data by Incogni found that 72% of elder fraud cases in 2024 were enabled by victims' personal information being exposed online, resulting in $4.2 billion in losses. The report details how scammers use publicly available data, family chat groups, and SIM-swapping techniques to impersonate relatives and bypass two-factor authentication.
9to5mac.com
· 2026-09-30
Security guidance is comparing two ways of handling two-factor authentication codes: storing them inside a password manager alongside saved passwords, or keeping them in a separate dedicated authenticator app. Password managers combine both login factors in one vault for convenience, while authenticator apps keep the second factor physically separate from the password itself, generating or sending one-time codes through methods like text messages, push notifications, email, or in-app codes.
engadget.com
· 2026-09-23
Google is rolling out a new 'Copy code' shortcut in Gmail that appears beneath the subject line of verification emails, letting users copy a 2FA code straight to their clipboard without opening the message. The feature is live on Gmail for Android version 2026.09.07.x and iOS version 6.0.260907, though it hasn't reached the web version yet.
androidauthority.com
· 2026-09-21
A Hacker News user described being locked out of Google, banking, email and Drive accounts after their phone was stolen, since 2FA and account recovery relied on that device and an old email they could no longer access. The poster noted Google's automated recovery flow offers only options tied to the lost phone or an outdated backup email, leaving no clear path to a human for help.
news.ycombinator.com
· 2026-09-17
Security researchers are flagging a fresh wave of email scams that no longer follow the old telltale patterns like poor grammar or suspicious links. These updated schemes are polished, convincing, and designed to slip past users who rely on outdated advice from corporate IT departments.
fastcompany.com
· 2026-08-31
GoKawiil