Search: “YubiKey”

125 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Phishing & fraud 32 Vulnerability 18 Exploit / PoC 16 Data breach 16 Policy & legal 13 Industry 7 Threat actor 6 AI tools & infra 5 Ransomware 4 Research 3 Advisory 2 AI industry 2 Malware 1

SeverityAll critical 45 high 14 medium 42 low 17 info 7

ChatGPT advanced account security adds passkeys and hardware keys

OpenAI launches Advanced Account Security for ChatGPT and Codex, replacing passwords with passkeys or hardware keys and disabling email/SMS recovery.

The opt-in setting disables password sign-in plus email and SMS account recovery for ChatGPT and Codex accounts, allowing only passkeys, hardware security keys, and user-held recovery keys, with shortened sessions and automatic exclusion of enrolled accounts' conversations from model training. OpenAI partnered with Yubico to offer discounted bundles of the YubiKey C Nano and C NFC, while any FIDO2/WebAuthn-compliant key or software passkey is supported, mirroring standards adopted by Google, Microsoft, and GitHub. Individual members of Trusted Access for Cyber using the most permissive models must enable the setting from June 1, 2026, or their organizations can attest to phishing-resistant authentication in their single sign-on.

Help Net SecurityAug 24, 04:21 UTC · 23d agoAI industry

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker NewsAug 11, 12:45 UTC · Aug 11, 2026Vulnerability CVE-2026-34348