cryptographic Archives

Winsage

April 24, 2026

Microsoft to roll out Entra passkeys on Windows in late April

Microsoft will introduce passkey support for phishing-resistant passwordless authentication on Microsoft Entra-protected resources starting in late April, with broader availability expected by mid-June 2026. This feature will allow passwordless sign-in on unmanaged Windows devices and will support various device types, including corporate, personal, and shared options. Administrators can manage passkeys through Conditional Access and Authentication Methods policies. Users can create device-bound passkeys stored securely within the Windows Hello container, using methods like facial recognition, fingerprint scanning, or a PIN. The passkeys will adhere to FIDO2 standards and will be securely bound to individual devices, preventing transmission over the network to enhance security against phishing and malware attacks. Microsoft has also announced plans for mandatory multifactor authentication registration for Entra tenants by October 2024 and that all new accounts will be passwordless by default starting in May 2025.

Tech Optimizer

April 23, 2026

Take Control: Customer-Managed Keys for Lakebase Postgres

Encryption at rest is essential for cloud environments, especially in regulated sectors. Lakebase offers Customer Managed Keys (CMK), allowing organizations to control their encryption keys from preferred Key Management Services (KMS) like AWS KMS, Azure Key Vault, or Google Cloud KMS. Lakebase CMK manages both persistent storage and ephemeral compute, ensuring data security. Lakebase's architecture separates storage and compute layers, enabling elastic scaling and serverless operations. The storage layer maintains persistent data, while the compute layer consists of dynamic Postgres instances. This separation poses encryption challenges, addressed by Lakebase CMK through a hierarchical Envelope Encryption model. The key hierarchy includes: 1. Customer Managed Key (CMK): The Root of Trust in the cloud KMS, never accessed in plaintext by Databricks. 2. Key Encryption Key (KEK): A transient key for wrapping data keys. 3. Data Encryption Keys (DEKs): Unique keys for each data segment, stored in an encrypted state. When data access is needed, Lakebase retrieves DEKs by unwrapping keys from the KMS. If a key is revoked, access to the data is denied, and ephemeral compute instances are terminated. In practice, CMK applies to: 1. Persistence Layer (Storage): All data segments are encrypted with keys controlled by the CMK. 2. Ephemeral Layer (Compute): Each compute instance generates a unique ephemeral key, and upon revocation, the instance is terminated, destroying in-memory keys. CMK implementation follows a delegation model, allowing Security Admins to manage keys without accessing data. The process includes key configuration, workspace binding, and lifecycle management. Key rotation is seamless, requiring no data re-encryption. All cryptographic operations involving the CMK are logged by the cloud provider's audit service. Lakebase CMK is available for Enterprise tier customers, allowing organizations to manage their encryption keys effectively.

Winsage

April 23, 2026

Engineering secure passkey sync in Microsoft Password Manager

Passkeys are a new form of authentication that replace traditional passwords, providing a phishing-resistant and streamlined sign-in process. Microsoft Password Manager allows users to save and synchronize passkeys across devices linked to their Microsoft accounts, enhancing accessibility. The architecture for passkey syncing includes confidential computing for sensitive operations, hardware-rooted key protection for encryption keys, tamper-evident recovery storage, and encrypted synchronization across devices. Sensitive passkey operations are executed in Azure's confidential computing environments, ensuring cryptographic materials are processed securely. The encryption keys are protected using Azure Managed HSM, with access governed by attestation-based mechanisms. Registration and recovery processes require user authentication and enforce security measures within confidential computing boundaries, including a lockout state after consecutive incorrect PIN attempts. The system aims to provide a secure and user-friendly experience as part of a transition to a passwordless future.

Tech Optimizer

April 20, 2026

Databricks Postgres Gets Customer Key Control

Databricks has introduced customer-managed keys (CMK) for its Lakehouse Postgres offering, allowing users to control their data encryption and utilize their own Key Management Service (KMS) from major cloud providers like AWS KMS, Azure Key Vault, or Google Cloud KMS. The Lakehouse Postgres architecture features a hierarchical envelope encryption model with three tiers: the customer-managed root key (CMK), a Key Encryption Key (KEK) used by Databricks' Key Manager Service, and unique Data Encryption Keys (DEKs) for each data segment. If a CMK is revoked, access to the data is denied, and active compute instances are terminated, serving as a failsafe for high-compliance workloads. The implementation allows for granular control over key management and supports seamless key rotation without data re-encryption or downtime. All cryptographic operations are logged within the customer's cloud audit services, available to Databricks Enterprise tier customers.

AppWizard

April 18, 2026

Android 17 Beta 4 arrives with post-quantum cryptography and new memory limits

On April 16, Google released Android 17 Beta 4, concluding its beta phase and focusing on app compatibility and platform stability. Developers must finalize updates for Android 17 to avoid delays when the stable version is released. Key behavioral changes for apps targeting Android 17 include: - Large-screen resizability restrictions, preventing apps from opting out of maintaining orientation, resizability, and aspect ratio constraints. - Expanded restrictions on dynamic code loading, requiring native files loaded via System.load() to be read-only. - Certificate Transparency is enabled by default. - Local network access is restricted by default, with a new ACCESSLOCALNETWORK permission for persistent access. - Stricter rules on background audio interactions, including playback and volume change APIs. Android 17 introduces per-app memory limits based on device RAM to target memory leaks and anomalies, with minimal impact expected on app sessions. Developers can check for memory limit impacts via ApplicationExitInfo and utilize profiling tools in Android Studio Panda. An on-device anomaly detection service monitors resource-intensive behaviors and provides profiling artifacts. Additionally, the Android Keystore now supports ML-DSA for quantum-safe signatures, allowing developers to generate keys and create signatures within secure hardware.

AppWizard

March 26, 2026

Russia Plans Law Forcing Banks to Use State Messenger Max for Transaction Verification

Russian authorities are advancing legislation that requires banks to verify customer financial transactions through the state-controlled messaging platform, Max, as part of the "Antifraud 2.0" initiative, which is awaiting its second reading in the State Duma. The proposed law mandates confirmation via the government messenger for all significant remote actions, but lacks clarity on what constitutes a significant action. The National Financial Market Council has opposed the initiative, labeling it as legally excessive and costly, and expressing concerns about the security risks and technical limitations of the platform. Experts argue that existing banking security measures are more effective than those proposed, and users of Max have reported being subscribed to pro-war channels without consent, indicating a lack of trust in the platform among officials and employees.

Winsage

March 12, 2026

Microsoft Introduces Phishing-Resistant Windows Sign-Ins With Entra Passkeys

Microsoft will introduce phishing-resistant passwordless authentication through passkeys for Windows devices, integrated with Microsoft Entra. This feature is expected to enter public preview between mid-March and late April 2026 for global tenants, while government cloud environments will receive the update from mid-April to mid-May. Users can access Entra-protected resources using device-bound passkeys stored securely within Windows Hello, allowing authentication through biometric or local verification methods. This update expands passwordless authentication to unmanaged or personal Windows devices. Passkeys utilize public-key cryptography, enhancing security by storing a private key on the device and registering a matching public key with the service. Each passkey is uniquely associated with a specific device and cannot be exported or synchronized. Organizations must enable the Passkeys (FIDO2) authentication method in Entra for the preview. This initiative is part of Microsoft's broader strategy to eliminate passwords, responding to rising cybersecurity concerns related to password-based authentication.

Winsage

March 11, 2026

Windows Hello gets passkey support for Entra accounts

Microsoft is enhancing the sign-in process for Microsoft Entra on Windows devices by introducing support for passkeys that integrate with Windows Hello, reducing reliance on traditional passwords. This feature aims to improve resistance against phishing attacks and will begin its optional public preview between mid-March and the end of April 2026 for organizations globally. Government cloud environments will have a separate preview from mid-April to mid-May. Administrators must activate this functionality for users. Employees will be able to access Entra-secured services using Windows Hello through biometric recognition or a PIN code, with cryptographic keys securely stored on the device. This method protects against phishing and account abuse since the keys remain on the device and are not vulnerable to interception. Passkeys will also work on Windows systems not linked to Entra, allowing access to company resources without passwords on personal or shared devices. Each Entra account generates a unique passkey per device, and synchronization between devices is not supported. Administrators need to enable the FIDO2 passkey method within Entra’s authentication policy to activate this feature. Microsoft aims to gradually eliminate passwords, providing stronger defenses against phishing and account compromise.

AppWizard

March 11, 2026

Quantum Computing Isn’t Just Coming for Bitcoin—It Threatens Messaging Apps Too

IBM researchers are collaborating with Signal and Threema to develop messaging systems resilient to quantum computing threats, prompted by concerns that quantum technology could compromise current encryption methods. IBM's report stresses the need to redesign messaging protocols in anticipation of potential quantum capabilities that could break existing encryption. Cryptography expert Ethan Heilman highlighted that encrypted messaging platforms face immediate risks from quantum threats, specifically through "store-and-forward attacks." Both Signal and Threema are enhancing their security measures; Signal is implementing upgrades like PQXDH and SPQR for post-quantum protection, while Threema is integrating the ML-KEM algorithm for quantum-safe encryption. Research indicated that adapting the Signal protocol for quantum safety may increase bandwidth requirements, necessitating a complete redesign for efficiency.

AppWizard

March 11, 2026

How Advanced Browsing Protection Works in Messenger

Advanced Browsing Protection (ABP) in Messenger enhances user privacy by warning users about potentially harmful links shared in end-to-end encrypted communications. It analyzes links using on-device models and a dynamic watchlist of millions of potentially malicious sites, utilizing cryptographic techniques to maintain user privacy. ABP is based on a cryptographic primitive called private information retrieval (PIR), which minimizes the information a server learns from client queries. The system also employs oblivious pseudorandom functions (OPRFs) and manages URL queries through a privacy-preserving URL-matching scheme. The server groups links by domain, allowing clients to request a single bucket for domain-specific path components, and generates a ruleset to balance bucket sizes. To safeguard client queries, AMD's SEV-SNP technology creates a confidential virtual machine (CVM) that processes hash prefixes securely, generating attestation reports for integrity verification. The use of Oblivious RAM and Oblivious HTTP (OHTTP) enhances privacy by preventing exposure of memory access patterns and stripping identifying information from client requests. The lifecycle of an ABP request includes pre-processing phases where the server updates the URL database and computes rulesets, followed by client requests that involve calculating bucket identifiers, sending encrypted requests through a proxy, and checking for unsafe URLs based on server responses.