We’re Tracking the Future of Security

Tag: Digital Identity

  • UK Expands Passkey Sign-In for GOV.UK One Login

    UK Expands Passkey Sign-In for GOV.UK One Login

    The UK government is broadening passkey sign-in for GOV.UK One Login, allowing users to authenticate with a device biometric or local passcode instead of entering a password and a separate security code. The option follows a trial and remains an alternative rather than the only sign-in route.

    Biometric Update reported that more than 300,000 users adopted passkeys during the trial. GOV.UK guidance explains that the biometric template used to unlock a credential stays with the user’s device or credential manager and is not sent to One Login.

    A passkey is distinct from the identity-checking process that may compare a selfie with an identity document. It authenticates possession of a cryptographic credential after an account has been established; it does not independently prove the civil identity behind that account.

    Why it matters

    Public-sector passkey deployments can reduce phishing exposure, but recovery and fallback paths remain part of the security boundary. A strong credential can be undermined if enrollment, account recovery or help-desk processes allow weaker impersonation routes.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Japan Digital Agency Says VPN Exploit Exposed Data on About 240,000 People

    Japan Digital Agency Says VPN Exploit Exposed Data on About 240,000 People

    Japan’s Digital Agency has disclosed that a vulnerability in a virtual private network product was exploited to access data connected with approximately 240,000 people. The agency published an official notice and a separate public FAQ describing the incident and response.

    The affected information was held in systems supporting government digital services. Public statements attribute the initial access to the VPN vulnerability; they do not justify broader claims about compromise of every agency platform or identity record.

    The agency’s response illustrates the risk created when a remote-access gateway becomes an entry point to higher-value data. VPN appliances concentrate authentication and network reach, so vulnerability management and segmentation around them are core controls rather than routine maintenance tasks.

    Why it matters

    Government identity and service platforms depend on public trust. Clear scope statements, affected-person notification and evidence about the initial access path help distinguish a bounded breach from speculation about an entire national digital infrastructure.

    For wider context, see SectechMedia’s related technical coverage.

    Sources

  • Passwordless Physical Access: Wallet Credentials and Digital Identity

    Passwordless Physical Access: Wallet Credentials and Digital Identity

    What passwordless means

    Users prove identity without entering a reusable secret. A device-bound credential protected by secure hardware and local authentication can provide stronger assurance than a badge alone.

    Wallet credentials

    Digital wallets support remote provisioning and central revocation tied to HR or identity lifecycle systems.

    Identity convergence

    A shared authoritative identity can govern application sign-in and physical entry, reducing duplicate records and improving auditability.

    Security and resilience

    Phone possession can be combined with biometric verification, while fallback processes remain necessary for dead batteries, lost devices and visitors.

    Conclusion

    Passwordless physical access is part of a broader shift toward unified cyber-physical identity governance.

  • Is Traditional Access Control Becoming Obsolete?

    Is Traditional Access Control Becoming Obsolete?

    Why the old model is under pressure

    Legacy systems built around isolated doors, trusted networks and proprietary controllers are increasingly difficult to integrate with identity platforms, mobile credentials and modern cybersecurity controls. The shift is from door-centric security to policies that consider identity, role, device and context.

    Mobile credentials and digital identity

    NFC, Bluetooth Low Energy and wallet credentials can reduce physical card issuance and simplify remote provisioning and revocation. Device authentication can add protection beyond a passive badge.

    OSDP and secure reader communication

    Secure bidirectional reader protocols such as OSDP add encryption, supervision and remote configuration. New projects should treat secure reader-to-controller communication as a baseline requirement.

    Cloud, hybrid and integration

    Cloud management can simplify multi-site administration while resilient controllers continue making local decisions during outages. Access systems increasingly connect with video, visitor management, HR and security operations workflows.

    A practical modernization path

    Organizations should inventory readers, controllers, credentials, software and network dependencies, then address unsupported software, insecure communications and shared credentials before cosmetic upgrades.

    Conclusion

    Traditional access control is not obsolete, but isolated and weakly protected assumptions are. Gradual modernization can improve security and usability without replacing every door at once.