On iPhone: five rapid taps in succession on the lock button shuts off all biometrics.

New from 404 Media: the FBI has been unable to get into the iPhone of raided Washington Post journalist because the phone had Lockdown Mode enabled. Apple markets Lockdown Mode mostly to stop spyware like NSO. Here, a real world example of it stopping access too www.404media.co/fbi-couldnt-...

Lockdown Mode - use it or risk losing control of your data if someone is able to physically take your IOS (iPhone) device.

Exhibit 1 on why IOS Lockdown Mode is useful: www.404media.co/fbi-couldnt-...

Expect these strategies to proliferate to other professional leagues if they succeed consistently. Fortunately my Sunday league of soccer duffers has to worry about showing up for work on Monday uninjured - nobody wants to get hurt trying to crowd the keeper.

I felt obliged to write up an overview of all of the Fulton County fraud claims that have already been made — and dismissed. Let me know if I forgot any. www.pbump.net/o/some-thing...

People, think carefully before putting your sensitive personal information into random apps. They frequently have vulnerabilities and can leak your information. See below for the latest example courtesy of @404media.co .

"Nearly half of all American men aged 18 to 49 maintain an online sports-betting account...Emerging research suggests that the spread of sports gambling portends a huge increase in gambling addiction, which has the highest rate of suicide of any addictive behavior." harpers.org/archive/2026...

Want to red team azure?

Jimmy Butler can’t put weight on his right knee. Buddy Hield and Jonathan Kuminga helping him to the locker room after a concerning scene in Chase Center.

NEW: A hacking campaign targeted high-profile Gmail and WhatsApp users across the Middle East this week. I obtained a copy of the phishing page & analyzed it with the help of experts. The page stole passwords, hijacked WhatsApp accounts, and took location data. A bug also *exposed* victims' data.

Moxie Marlinspike—the engineer who set a new standard for private messaging with the creation of the Signal Messenger—is now aiming to revolutionize AI chatbots in a similar way. arstechnica.com/security/202...

More acquisitions in identity-land. Delinea moving to be the authorization vendor of choice by acquiring StrongDM. StrongDM shines in dynamic authorization and policy-based access control. delinea.com/news/delinea...

Hidden Telegram proxy links can reveal your IP address in one click www.bleepingcomputer.com/news/securit...

Tools that can create deepfakes are getting better, and the identity verification crowd needs to up its game. There are some new deepfake detection players like Get Real and Nametag that are changing the game - www.infosecurity-magazine.com/news/wef-dee...

I can now die a satisfied man. I've been quoted in the NYTimes before, but never in The Register (my absolute favorite IT tabloid). Today I was quoted in The Reg. Thank you @jessicalyons.bsky.social for letting me contribute to your article - www.theregister.com/2026/01/08/c...

Welcome to 2026 and the year's first identity security acquisition! Crowdstrike acquires SGNL for $740M as it continues to build out its identity portfolio. SGNL's ability to centralize identity & security context in an intelligence layer sharpens CRWD's threat focus. www.msn.com/en-us/money/...

A hacker known as Martha Root broke in and deleted three white supremacists websites at the end of a talk during the annual hacker conference Chaos Communication Congress in Germany.

Agentic AI, identity tool sprawl, and a surge of non‑human identities are reshaping how enterprises define and manage trust. In a new Dark Reading piece, I put on my industry analyst hat with four identity predictions for 2026 and practical steps you can take. www.darkreading.com/identity-acc...

My #identitysecurity #IAM prognostications for 2026 are published in @darkreading.bsky.social! I hope for omniscience, but am making a note to self to revisit it in 12 months to see what I got right and wrong. www.darkreading.com/identity-acc...

Astounding amounts of equity granted to OpenAI employees according to this WSJ article. And remember that 1 year cliff that most tech companies have in their option packages? It was 6 months at OpenAI, but that was dropped because they were losing a battle for talent. www.wsj.com/tech/ai/open...

Wisconsin, what is up with you? I get Alaska, Idaho, and Utah may have low vaccination rates, but didn't expect to see Wisconsin in that that group.

"Implementing Secure AI Framework (#SAIF) Controls in Google Cloud" security.googlecloudcommunity.com/ciso-blog-77... <- this blog launches a new paper on SAIF #AI controls in Google Cloud. More useful than fun, admittedly :-)

Former head of trust and safety at Twitter, Yoel Roth, demonstrating the intellectual dishonesty of “In Covid’s Wake” by showing how they distorted his own words to make them say the opposite of what he was arguing.

IT'S A WONDERFUL ESSAY: It seems people usually rewatch 'It's a Wonderful Life' just before Christmas. Can I commend to you this marvelous essay we published a few years ago? It could change the way you understand that classic movie. www.thebulwark.com/p/there-is-n...

ServiceNOW is acquiring Armis for $7.75B in cash. This follows on NOW's acquisition of Veza for ~$1B. NOW will be bumping heads with a bunch of security incumbents (CrowdStrike, PAN, Cisco, S1, etc), but securing AI agents provides a ripe enterprise problem to solve. techcrunch.com/2025/12/23/s...

This is bad. #cybersecurity

Vulnerability management solutions may detect things like missing patches, default/weak configs, insecure protocols, and exposed management interfaces. In cloud/ modern environments, that can include cloud security posture (public S3 buckets, overly permissive IAM roles). This risk requires nuance.

Identity security news is popping today! In the Identity Governance and Administration (IGA) space, Sailpoint crossed $1B ARR in their latest quarter while Saviynt announced a monster $700M Series B at $3B valuation. www.wsj.com/articles/cyb...

We very rarely do sales at @404media.co but today is an exception so pls consider and get all this stuff: www.404media.co/cyber-monday...

Realtors know that, in many parts of the country, if you educate people about climate risk, the housing market will collapse. www.nytimes.com/2025/11/30/c...

New, by me at this.weekinsecurity.com: Router maker TP-Link faces a potential U.S.-wide ban over its alleged links to China. In my latest analysis, I dive into why a TP-Link ban is unlikely to make America meaningfully safer from Chinese cyberthreats (or anywhere). Please share!

I just noticed that @hashicorp.com Vault now supports #SPIFFE (a Kubecon 2025 announcement). Great news that better secures AI agent deployments. Lots of goodness - verifiable IDs for AI agents, zero trust architecture, and lifecycle management. www.hashicorp.com/en/blog/spif...

Ok @hankgreen.bsky.social is my anger translator regarding stupid controversies about Jimmy Wales and @wikipedia.org. I was going to say something, but Hank says everything I would have said here. www.youtube.com/watch?v=9zi0...

Comet on Android has a sweet opening screen and some slick functionality.

Time to look into your settings, folks.

""The timeline for both vulnerabilities being disclosed is only days apart. Both vulnerabilities were patched by the vendor in prior product updates and with no disclosure at the time of patching," Rapid7 noted in the technical analysis. " Disclosure is transparency goodness.

My post about identity & access management and IGA app integration got published in @darkreading.bsky.social! Lots of IGA app integration knowledge goodness. #identitysecurity www.darkreading.com/identity-acc...

I am quibbling, but why can't the WSJ (and others) include in the headline that Trump is rolling back tariff that he raised? The lede paragraph has it, but not the headline. Many will read the headline and think Trump is rolling back tariffs that "the government" imposed. www.wsj.com/economy/trad...

If I recall correctly, California mandated bidirectional electric vehicle chargings (previously some vehicles did not support it). A cool use case powered by bidirectional EVs.

Five people pleading guilty to helping the North Korean regime land fake, remote IT workers. Four were US nationals and the fifth was Ukrainian.

NEW: Google is taking legal action against Chinese cybercriminals responsible for sending out millions of scam text messages—including those parcel delivery scams. Google hopes the lawsuit will help to disrupt the scammers' sprawling infrastructure

Sea Otters May Be Small Marine Mammals, But Their Effect on an Ecosystem Can Be Huge Their fur is so soft it almost led to their extinction, but otters’ recovery has been a boon to Pacific kelp forests, a key habitat for other sealife www.smithsonianmag.com/science-natu...

Big shakeup in VC-land with Sequoia Capital replacing its top leader Roelof Botha. Sequoia is a force in Silicon Valley VC circles - www.wsj.com/finance/inve...

Identity security for AI Agents heats up. CyberArk today announced its solution to secure AI agents, GA in December. It covers discovery/access management/governance/lifecycle management. It initially will discover agents on AWS Bedrock and Microsoft Copilot Studio www.cyberark.com/press/cybera...

A magnificent Sunday on the California coast (Point Lobos State Park). Autumn is the best time to see the coast in northern California - not so much fog.

TechCrunch Disrupt 2025 was exceptional event!

Agentic AI relies on MCP, and MCP relies on OAuth for authentication. Oso blog highlights insufficiencies of OAuth for AI agents - www.osohq.com/post/oauth-i...