The Future of Age Verification: Your Face Never Leaves Your Device

AI Arms Race in Recruiting

AI is transforming recruiting into an arms race where candidates use LLMs to optimize resumes, auto-apply to jobs, and generate assessment content, while recruiters deploy AI screening and sourcing tools to manage the flood. This cycle creates serious risks: signal degradation, algorithmic bias, unequal access to AI tools, and deepfake-driven identity fraud enabling insider threats. Real-world examples include candidates using others' LinkedIn profiles and deepfake video interviews. Recommended defenses include liveness detection, spontaneous contextual assessments, multi-step identity verification, and redesigning job evaluations to test AI-complementary skills like adaptability and critical thinking rather than routine tasks AI can easily replicate.

Identity verification for Shopify Partners starts today

Shopify bắt buộc đối tác xác thực danh tính khi gửi yêu cầu truy cập cửa hàng merchant, bắt đầu từ hôm nay nhưng ban đầu là tự nguyện. Quá trình xác thực qua Stripe yêu cầu ID chính phủ có ảnh và kiểm tra nhận diện (selfie/liveness check), mỗi thành viên trong tổ chức đối tác phải hoàn thành riêng lẻ trên Dev Dashboard.

Lập trình viên cần đọc bài này để hiểu cách bảo mật và hợp quy định mới của Shopify ảnh hưởng đến việc cấp quyền truy cập cho cộng tác viên, từ đó tránh rủi ro về quyền riêng tư và tuân thủ khi phát triển ứng dụng trên nền tảng này.

3 Ways AI Powers Service Desk Attacks and How to Prevent Them

AI is making service desk social engineering attacks more convincing, personalized, and scalable. Attackers use generative AI for realistic phishing emails, call scripts, and deepfake impersonation, while also leveraging AI-driven reconnaissance to gather employee details from LinkedIn, job posts, and social media. Onboarding is a particularly vulnerable window since new employees are unknown to IT teams. Three defensive measures are recommended: secure password delivery via enrollment links instead of SMS/email, biometric liveness detection to defeat deepfake impersonation, and mandatory identity verification before sensitive actions like password resets. The piece is sponsored by Specops Software and promotes their Secure Onboarding product.

Your Summer Holiday Has More Security Checks Than You Think

Modern travel relies on layers of invisible digital security infrastructure. Bots now account for 53% of all web traffic (40% malicious), making travel booking platforms prime targets for credential stuffing, price scraping, and fraudulent reservations. At airports, e-gates use cryptographic certificates and biometric matching on electronic passport chips to verify identity in seconds. Hotel digital check-ins move guest data across cloud systems, mobile apps, and third-party services — yet only 34% of organizations fully know where their data lives. Public Wi-Fi and banking app usage while traveling expose consumers to further risks, with 68% of people having abandoned a company due to trust issues with its digital services. Encryption, access controls, and data governance are the tools keeping convenience and security in balance across the travel journey.

Mass Assignment and the Identity Drift: From Profile Edit to Insurance Takeover

Một nhà nghiên cứu bảo mật phát hiện lỗ hổng mass assignment trong API cập nhật hồ sơ của nền tảng, cho phép ghi đè các trường nhận dạng nhạy cảm (tên pháp lý, ngày sinh, số CMND) mà vẫn giữ trạng thái eKYC đã xác minh. Lỗ hổng này dẫn đến "identity drift" (trôi dạt danh tính) và có thể leo thang thành chiếm quyền kiểm soát hồ sơ bảo hiểm bằng cách thao túng trường ngày sinh trong logic khớp chính sách.

Lập trình viên nên đọc bài này để hiểu cách một lỗ hổng mass assignment có thể biến đổi dữ liệu xác thực người dùng thành công cụ tấn công hệ thống tài chính, y tế hoặc chính sách bảo hiểm, và cách phòng ngừa bằng cách kiểm soát trường nhập liệu và phân cấp quyền tin cậy.

Proof of Human: How to Verify a Person Is Real and Unique

Proving a person is real and unique online is fundamentally different from authentication. Traditional defenses like CAPTCHAs, phone numbers, and IP limits all fail because they use proxies rather than binding verification to a unique human. A robust proof-of-human system requires five pillars: uniqueness (one-to-many biometric matching at billion-person scale using iris patterns), anonymity (secure multi-party computation splits biometric data across independent parties so no one sees the raw data), recovery (account-based key rotation with designated recovery agents instead of a single secret), verification (scoped nullifiers via oblivious pseudorandom functions and zero-knowledge proofs let relying parties enforce one-per-human rules without learning user identity), and delegation (AI agents can be registered against a human's credentials so their actions count against the human's quota). World ID by Tools for Humanity is used as a concrete implementation example throughout, including its Orb hardware, AMPC nodes, OPRF nodes, WorldIDRegistry, and AgentKit SDK.

AI Agents Could Get Verified Identities, Courtesy of DNS

The Linux Foundation has announced intent to launch the Agent Name Service (ANS), an open standard that extends DNS to give AI agents verifiable identities. Each registered agent gets a DNS-style versioned name backed by an identity certificate issued after standard DNS and ACME checks. All registrations, renewals, and revocations are recorded in a tamper-evident append-only Merkle log, and an offline tool called ans-verify can audit records without a live registry connection. GoDaddy originally built ANS on an existing IETF draft, reusing its existing certificate infrastructure handling over 100 million active TLS certificates. The reference implementation is MIT-licensed Go code hosted on GitHub and reportedly spins up in about 60 seconds.