Threat Intelligence
What we see attacking identity, written down.
We run an identity provider, so we get a close view of credential phishing, brand impersonation and the infrastructure behind them. When we analyse something, we publish it — including the parts that are inconvenient for us.
- Observed, not inferred
- Where a detail is deduced rather than measured, the advisory says so.
- Infrastructure, never victims
- We name domains, addresses and operators. We do not identify who was affected.
- Defanged by default
- Hostile addresses are published inert, and never as working links.
Advisories
The Binance Verification-Code SMS That Uses a Real Binance Link
A user reported two SMS messages carrying a Binance verification code they never asked for, and a link on a genuinely authentic Binance domain. The link is real, the shortener is Binance's own, and the page at the end asks you for nothing at all. We decode the full chain and explain why the fake code is the cleverest part of the attack.
Zero Knowledge Is a Schema Decision
Calling a vault end-to-end encrypted is easy. Making it true is mostly about what columns exist. We walk through the Locker's derivation chain, why the server stores a wrapped key it cannot unwrap, why the authentication hash is a fast one on purpose, and the recovery design that follows from all of it.
Signed Requests, Signed Responses: Making OAuth FAPI-Shaped
Most OAuth deployments sign the token and leave everything around it unauthenticated. We moved access tokens to RS256, added private_key_jwt so clients authenticate with a key instead of a shared secret, and signed both the authorization request and the authorization response. Here is what each one actually stops.
Introducing Post-Quantum Session Signatures
Every session token issued by UniAuth is now signed with ML-DSA-44, a FIPS 204 post-quantum digital signature algorithm. We explain why we moved early, how the performance budget stays under 2ms, and what this means for your users when large-scale quantum computers arrive.
How Pairwise Privacy Protects Your Users
UniAuth never exposes real user IDs to OAuth clients. Instead, each app receives a deterministic, app-specific HMAC identifier that prevents cross-service correlation. We walk through the cryptographic construction, the privacy guarantees, and why even we cannot reverse the mapping without the HMAC key.
Contact
Abuse desks, registrars, CERTs and researchers: [email protected]. We answer, and we will share captured payloads and hashes on request.