SPF, DKIM and DMARC explained in plain terms: who is allowed to send for a domain, the signature that proves integrity, and the rule for what to do when the checks fail.
RFC 9729 defines an HTTP authentication scheme that won't even reveal whether a protected resource exists: what it is, the problem it solves, and what it's for.
Passkeys replace passwords with a cryptographic key pair. Since January 2025, the ones saved in Google Password Manager also sync to iPhone and iPad, on top of Android, Windows, macOS, Linux, and…
The IETF has published RFC 9700, the updated Best Current Practice for OAuth 2.0 security: what it is, what changes and why it matters for logins and APIs.