WhatsApp Adds Support for Multiple Passkeys on Single Account
WhatsApp has expanded account protection by now allowing users to register multiple passkeys on the same profile. The update primarily benefits individuals who switch between Android and iOS devices while seeking phishing-resistant login methods.
Passkeys replace traditional codes and passwords with authentication based on biometrics, facial recognition, or the device lock itself. According to Meta, more than one billion people already use the feature on WhatsApp. Support began on Android in 2023 and reached iOS in 2024.
With the new capability, different keys can be linked to the same account, reducing dependence on any single device during authentication. Users can manage registered keys in Settings > Account > Passkeys.
The technology makes it harder for attackers to capture credentials through fake pages, since authentication remains tied to the legitimate device and service. WhatsApp has also reinforced two-factor verification. The previous six-digit PIN can now be replaced by a longer password containing letters, numbers, and special characters, increasing resistance to guessing or account takeover attempts.
The recommendation remains to enable passkeys whenever available, strengthen two-factor verification, and remain cautious of requests for access codes. WhatsApp states it will continue expanding mechanisms for account protection and recovery.
Related articles
Russian ISPs Begin Disrupting Encrypted DNS Services from Google and Cloudflare
Users of several major Russian internet providers have reported widespread issues accessing encrypted DNS protocols offered by Google and Cloudflare. The affected services include DNS over HTTPS (DoH) and DNS over TLS (DoT), which are designed to prevent providers from inspecting domain queries. Measurements show that connections to Cloudflare addresses 1.1.1.1 and 1.0.0.1 on port 853 establish TCP handshakes but are then reset with ECONNRESET errors before TLS authentication completes. Google Public DNS endpoints experience different interference, with sessions stalling after the TLS ClientHello or terminating with unexpected EOF errors. The disruptions have been observed across Rostelecom, Dom.ru, Tattelecom, and SkyNet subscribers, with varying impact depending on region and operator. Tattelecom support reportedly advised one customer to disable both protocols to restore connectivity. No official confirmation of centralized blocking has been issued, yet the coordinated pattern across multiple providers suggests deliberate interference rather than random failure.
DuckDuckGo Study Shows Users Confide Sensitive Personal Details in AI Chatbots Without Realizing Data Retention
A new DuckDuckGo survey reveals that chatbots have evolved from simple search tools into digital confidants where users disclose highly personal information. Nearly one in three AI users admitted sharing details they would not discuss with friends, family, colleagues, or doctors. The figure rises sharply to 56 percent among users who describe themselves as strong AI enthusiasts. The research underscores that many people remain unaware that AI systems store and can later reference these conversations. This behavior creates significant privacy risks as conversational data becomes part of long-term model memory. The findings highlight a growing gap between user expectations and the actual data-handling practices of AI platforms.
Telegram Desktop Adds WEB Proxy to Hide MTProxy Traffic Inside HTTPS and WebSocket Connections
Telegram Desktop has received an initial implementation of a new WEB proxy designed to conceal messenger connections within ordinary HTTPS and WebSocket traffic. The feature makes user activity appear as simple website browsing to network providers while MTProxy continues to operate underneath. Developers inserted more than 3,000 lines of code, including a dedicated WEB-proxy transport, domain configuration options, and interface elements such as “Open browser” and “Waiting for browser.” The mechanism works by opening an embedded web page that establishes a secure WebSocket link to a domain resembling a regular site. Multiple MTProxy connections are multiplexed into a single stream and sent through this channel. On the server side an intermediate node demultiplexes the stream and forwards the individual connections to a standard MTProxy instance without decrypting message content.
Gesture Dynamics CAPTCHA Emerges as Privacy-Focused Drop-in Alternative to reCAPTCHA
A new open-source CAPTCHA system called Aptogon replaces traditional image-based challenges with analysis of hand gesture dynamics to verify human users. Instead of clicking on traffic lights or buses, visitors draw a free-form gesture for about ten seconds while the system measures velocity variance, pause entropy, rhythm irregularity, and micro-corrections that distinguish human motor patterns from bots. The solution addresses recent reCAPTCHA restrictions, including Google's reduction of free monthly verifications from one million to ten thousand and tightened GDPR data responsibility rules starting in April 2026. An iframe architecture loaded from the vendor origin eliminates cross-origin issues and CORS blocks while supporting public and secret key pairs for domain validation. Machine learning relies on a local gradient boosting model for confident decisions and an LLM only for borderline cases, with fail-closed behavior returning 503 errors when the classifier is unavailable. Coordinates never leave the browser; only derived statistics are sent, satisfying GDPR requirements without cookie banners or biometric templates. The project is released under AGPL-3.0 with a free tier of one thousand checks per month and integration examples for HTML, React, Node, Python, and PHP.