Loading story…
RFC 2898 defines PBKDF2 as a password-based key-derivation function built around a pseudorandom function, with HMAC-SHA-1 specified as its default. PBKDF2 derives keys from a password, salt, iteration count, and requested output length; the salt and sufficiently high iteration count remain essential protections against precomputation and password-guessing attacks.
PBKDF2-HMAC can produce equivalent derived keys for distinct password inputs because HMAC normalizes keys longer than its hash block size by hashing them first. For an overlong password, using its HMAC hash digest as a shorter password can yield the same PBKDF2 result when the same salt, iteration count, PRF, and output length are used. Implementations should recognize this as an HMAC key-normalization property rather than a break in PBKDF2, avoid relying on raw password uniqueness for security decisions, and use modern password-hashing schemes and robust password-handling controls where possible.
See affected versions and whether adversaries are exploiting it.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Passwordless authentication methods are increasingly being adopted to address the security weaknesses of traditional passwords, which are often reused, forgotten, or stolen. Modern approaches such as passkeys and biometric authentication, including facial recognition and fingerprints, offer enhanced security and user convenience. Passkeys utilize public-key cryptography, where a private key remains securely on the user's device and a public key is shared with the service, making them resistant to phishing attacks. Biometric methods, like facial recognition, authenticate users based on unique physical characteristics, with the verification process occurring locally on the device. Despite misconceptions, passwordless authentication does not compromise security; instead, it often incorporates multi-factor elements by requiring both device possession and a unique user attribute, such as a fingerprint or PIN. These methods ensure that sensitive authentication data, like biometrics or PINs, never leave the device, significantly reducing the risk of credential theft. As organizations and users transition away from passwords, understanding the distinctions and strengths of passkeys and biometric authentication is essential for implementing secure and user-friendly access controls.
Jul 12, 2026
Security experts are increasingly recommending the use of long, random passphrases over traditional complex passwords, emphasizing that password length provides significantly greater resistance to brute-force attacks. Passphrases composed of several unrelated words are easier for users to remember, reduce the likelihood of password reuse or insecure storage, and align with updated guidance from organizations like NIST, which now prioritize length over forced complexity. Meanwhile, the adoption of passkeys—authentication methods based on public key cryptography—is gaining momentum as a more secure and user-friendly alternative to passwords. Passkeys eliminate the need for users to remember secrets and are resistant to phishing attacks, as authentication relies on cryptographic proof rather than shared secrets. While some skepticism remains due to marketing hype, the underlying technology offers substantial security benefits and represents a significant evolution in authentication practices.
Jun 29, 2026