-
Agents knocking on your sign-up page: lessons from Okta's report on automated identity reconnaissance
What did Okta observe? What the agents were testing Why fake accounts are more than spam What you should check this week Conclusion Hi there, Yesterday we looked at a single percent-encoded “S” that broke Keycloak’s SAML signature check. Today’s topic is less elegant and probably more relevant to most...
-
When %53AMLResponse is not SAMLResponse: the Keycloak SAML redirect signature bypass
What happened? How the trick works Who is affected? What you should do now Conclusion Hi there, If you run Keycloak as an identity broker in front of SAML identity providers, please stop reading for a second and check your version. Done? Great. Then let’s talk about one of the...
-
AI in IAM – Hype, Hope, and Hard Reality
AI is everywhere. Literally everywhere. Refrigerators are suddenly “smart,” slide decks write themselves, and every second product now claims to be “AI-powered.” Naturally, Identity & Access Management couldn’t escape the wave. So let’s take a calm (but not humorless) look at AI in IAM: what actually helps, what’s mostly marketing,...