Okta: Integration with Google Workspaces, Part 1 — Provisioning

Vercel Flags no longer requires SDK Keys for Vercel deployments

Vercel Flags giờ đây tự động xác thực thông qua OIDC tokens ngắn hạn mà không cần SDK Keys hay biến môi trường FLAGS cho các triển khai trên Vercel. Chỉ cần vercel link và vercel env pull là đủ cho phát triển local, trong khi các dự án cũ vẫn giữ nguyên yêu cầu SDK Keys cho các trường hợp đặc biệt.

Lập trình viên cần đọc bài này để hiểu cách tối ưu hóa quản lý tính năng động (flags) trong dự án Vercel mới nhất, giảm thiểu rủi ro về bảo mật khi sử dụng SDK Keys và khám phá giải pháp tự động hóa cho phát triển và triển khai.

KDDI Breach Exposes Up to 14.2 Million Email Logins at Six ISPs

Japanese telecom KDDI disclosed a data breach affecting up to 14.2 million email accounts across six ISPs including STNet, JCOM, NIFTY, and BIGLOBE. Attackers exploited a vulnerability in unnamed third-party software on KDDI's shared email system, potentially exposing email addresses and passwords. Some passwords were stored hashed or encrypted, but KDDI did not disclose the method or proportion stored in plaintext. The breach was discovered June 17 and reported to Japanese regulators. Affected customers are advised to reset passwords and enable 2FA. CISOs are warned about downstream risks from shared provider infrastructure, credential stuffing, and business dependence on personal ISP email accounts for recovery workflows.

Order-Tracking App Shop Abused to Push Callback Phishing Attacks

Threat actors are abusing Shopify's Shop order-tracking app by injecting fake purchase receipts from brands like Norton, McAfee, Apple, and PayPal into users' order histories. The fraudulent receipts include a phone number victims are urged to call to dispute the charge — a callback phishing technique. Callers are then socially engineered into revealing credentials, payment details, or one-time passcodes, and sometimes tricked into installing remote access software. Shopify has deployed new controls to reduce the activity. The attack is notable because it exploits user trust in a legitimate app rather than email, and can escalate from consumer fraud to enterprise endpoint compromise if employees are targeted on work devices.

Telcos agree plan to tighten Sim registration under Rica

South Africa's mobile operators, coordinated through the Association of Comms & Technology (ACT), have agreed a framework to strengthen SIM card registration and combat SIM fraud. The framework introduces enhanced identity verification, tighter registration controls, improved compliance monitoring, and closer cooperation with law enforcement. It serves as an interim industry-led measure while ACT simultaneously pushes for legislative reform of Rica's section 40, which governs SIM registration. Key issues addressed include the bulk pre-registration of SIMs by distributors ('pre-Rica'd' cards) and packaging that exposes SIM identifying numbers. Proposed solutions include biometric authentication at registration points and secure SIM packaging. The Competition Commission was consulted to ensure the inter-operator coordination does not raise competition concerns.

Security boss thought MFA would be too much security

A security executive exempted themselves from MFA requirements they enforced on other employees, illustrating a classic 'one rule for workers, another for executives' double standard in corporate security policy. The story highlights how security leadership can undermine the very practices they mandate for others.

Defense-in-Depth for Mobile FinTech: Why No Single Security Control Is Enough

Các nền tảng FinTech di động cần áp dụng chiến lược "defense-in-depth" vì không có biện pháp bảo mật đơn lẻ nào đủ mạnh. Kiểm soát thiết kế, tín hiệu runtime, bảo vệ mạng, ủy quyền backend và đánh giá rủi ro giao dịch phải phối hợp chặt chẽ, với backend đóng vai trò là điểm tin cậy cuối cùng để xác minh danh tính, phiên giao dịch, tính toàn vẹn thiết bị và ngăn chặn các cuộc tấn công. Bài viết cũng chỉ ra những quan niệm sai lầm phổ biến và cung cấp checklist thực tế cho các luồng xử lý nhạy cảm.

Là lập trình viên phát triển ứng dụng tiền điện tử trên di động, bạn cần đọc bài này để hiểu cách xây dựng lớp bảo mật đa tầng (defense-in-depth) hiệu quả, tránh những lỗ hổng từ việc chỉ phụ thuộc vào một giải pháp kỹ thuật duy nhất.

How Verifiable Digital Credentials Are Reshaping Trust Architecture

Verifiable Digital Credentials (VDCs) introduce a new trust architecture layer where cryptographically signed credentials issued by authorities (DMVs, universities, employers) are held in user wallets and presented to verifiers on demand — eliminating document uploads, PII storage, and third-party intermediaries. The post explains the Issuer-Holder-Verifier trust triangle, the two key credential formats (SD-JWT VC for enterprise/web use cases and mdoc/ISO 18013-5 for government IDs), and the OpenID4VP/OpenID4VCI protocol stack. It distinguishes authentication (proving account ownership) from credential verification (proving specific claims), and outlines practical implementation guidance: build on redirect-based OpenID4VP as a baseline, treat trust lists and trust frameworks as first-class architectural requirements, and layer in the W3C Digital Credentials API as a progressive enhancement. The post ends with a call to explore Okta's VDC platform beta.